Title says it all.
A user with administrator rights could remove the passsword of CIS. More information can be found here:
Is it possible to block specific registry entries (or just those that involve CIS in the equation) from an administrator without blocking regedit.exe using CIS?
Thank you.
No matter what you do to block access to registry keys Administrator rights will give you a way to remove/change them 
You have only one choice to stop access to registry keys LUA
Dennis
Hi,
I agree with you but can’t I just remove the password-removal ability from CIS? There is absolutely no implementations regarding this subject?
I do agree that some users might want to reset it but some might want the opposite.
Thank you.
I do not really see how as it is active or not.
I suppose you could change the key permissions this might work, or it could corrupt your installation.
Dennis