Title says it all.
A user with administrator rights could remove the passsword of CIS. More information can be found here:
Is it possible to block specific registry entries (or just those that involve CIS in the equation) from an administrator without blocking regedit.exe using CIS?
No matter what you do to block access to registry keys Administrator rights will give you a way to remove/change them
You have only one choice to stop access to registry keys LUA
I agree with you but can’t I just remove the password-removal ability from CIS? There is absolutely no implementations regarding this subject?
I do agree that some users might want to reset it but some might want the opposite.
I do not really see how as it is active or not.
I suppose you could change the key permissions this might work, or it could corrupt your installation.