If it's running as their user account then they can see it and remove it. The point of the admin account is to prevent this by obfuscation and permission hijack.