Why don't you restrict the ability to unsintall roaming client without providing administrator password.