I've done some tests, and it pretty much works, the only problem I've found is that admin users can delete the file (although they cannot recreate another one in the directory). Because they can't write to the directory, it means they can't update the ini file, but it would be good to disallow them to delete as well...

Is there a simple way to do this?