Adamancia Vault

Mac Vault · removal protection

Protect application files · administrator Terminal

Mac Vault has no built-in uninstall lock. For an existing copy at the path below, administrator ownership and restricted write access protect the app’s files from changes by standard accounts. If your copy has a different name or location, replace the path in both command blocks. This does not prevent quitting the app or guarantee an administrator prompt when moving it to Trash; the containing folder’s permissions also affect removal.

sudo chown -R root:wheel /Applications/AdamanciaVault.app
sudo chmod -R go-w /Applications/AdamanciaVault.app
ls -ld /Applications /Applications/AdamanciaVault.app

Check the final output: the app should be owned by root:wheel, with no group or other write permission. Review the containing folder’s permissions too; file protection alone is not an uninstall lock.

Restore the current user’s write access · administrator Terminal

Use the same app path you protected. These commands give your account ownership and write access again.

sudo chown -R "$(id -un):staff" /Applications/AdamanciaVault.app
sudo chmod -R u+w /Applications/AdamanciaVault.app

Windows Vault · removal protection

Check removal protection · administrator PowerShell

Windows Vault has no built-in uninstall lock. An existing Program Files copy normally inherits permissions that let standard users read and run it, while reserving changes and removal for administrators. The current Setup.exe installs for your user, so it does not create the Program Files copy described here. A user-local copy remains removable by its owner. These permissions do not prevent quitting the app, and an administrator can still remove it. Use your actual app folder if it differs from the path below.

icacls "$env:ProgramFiles\Windows Vault"

Check that BUILTIN\Users has read/execute access, not Modify or Full control. If this folder has custom permissions, have the administrator review it before treating it as a protected copy.

Restore a standard user’s modification access

In administrator PowerShell, replace your-standard-user with the local account name and use the same folder you checked. This grants that account permission to change and delete the app folder.

$account = "$env:COMPUTERNAME\your-standard-user"
icacls "$env:ProgramFiles\Windows Vault" /grant:r "${account}:(OI)(CI)M" /T

Microsoft’s file-permission command reference ↗

Chrome removal protection and recovery

Chrome’s managed-extension policy can prevent removal and disabling of Vault on your own computer. These steps apply to Google Chrome only. For a work or school device, ask its administrator to manage the policy.

The policy does not prevent using another browser or guarantee protection in Incognito. An administrator can undo it. Before changing anything, check chrome://policy; if extension policies already exist, ask their administrator to add Vault to the existing configuration.

curl --fail --location https://customblocker.com/assets/install/vault-chrome.mobileconfig --output "$HOME/Downloads/vault-chrome.mobileconfig"
open "$HOME/Downloads/vault-chrome.mobileconfig"

sudo profiles remove -identifier com.adamancia.vault.chrome-install

sudo profiles list -type configuration

$id = 'mcbmcmephdaapjepopobikobjmfdeamm'
$chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
if (Get-ItemProperty -Path $chrome -Name ExtensionSettings -ErrorAction SilentlyContinue) { throw 'Existing ExtensionSettings: ask its administrator to add Vault.' }
$list = "$chrome\ExtensionInstallForcelist"
New-Item -Path $list -Force | Out-Null
$entry = "$id;https://clients2.google.com/service/update2/crx"
$key = Get-Item $list
$names = @($key.GetValueNames())
$present = @($names | Where-Object { $key.GetValue($_) -eq $entry })
if ($present.Count -eq 0) {
  $slot = 1
  while ($names -contains "$slot") { $slot++ }
  New-ItemProperty -Path $list -Name "$slot" -PropertyType String -Value $entry | Out-Null
}

$id = 'mcbmcmephdaapjepopobikobjmfdeamm'
$list = 'HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist'
if (Test-Path $list) {
  $key = Get-Item $list
  foreach ($name in $key.GetValueNames()) {
    if ([string]$key.GetValue($name) -match "^$id(;|$)") {
      Remove-ItemProperty -Path $list -Name $name
    }
  }
}

Safari Vault · containing-app protection

Protect application files · administrator Terminal

Safari Vault is bundled inside its containing macOS app. Protect that app’s files using the same administrator ownership and write restrictions as Mac Vault. These commands target an existing /Applications/Safari Vault.app; replace the path in both blocks if your containing app has a different name or location.

sudo chown -R root:wheel "/Applications/Safari Vault.app"
sudo chmod -R go-w "/Applications/Safari Vault.app"
ls -ld /Applications "/Applications/Safari Vault.app"

Check that the app is owned by root:wheel with no group or other write permission. These permissions protect the app’s files from changes by standard accounts. They do not guarantee an administrator prompt when moving it to Trash; the containing folder’s permissions also affect removal.

Limits of this protection

Safari Vault has no built-in uninstall lock. Protecting the containing app does not stop users from disabling the extension in Safari’s settings, changing its website access or quitting Safari. An administrator can restore write access and remove the app.

Restore the current user’s write access · administrator Terminal

Use the same containing-app path you protected. These commands give your account ownership and write access again.

sudo chown -R "$(id -un):staff" "/Applications/Safari Vault.app"
sudo chmod -R u+w "/Applications/Safari Vault.app"

Apple’s Safari extension controls ↗