I'm currently managing and re-factoring a piece of software that has been used at my company for over a decade now. One of the elements of this application is a sort of admin or power-user mode which provides things like some additional/internal input as well as the ability to turn off input limits.
Historically this mode has been turned on by placing a specifically named file in a specific place in the windows system directory (both of which were hard coded into the application), the file being named 'something.DLL', even though it was an empty ASCII file and not a dll.
So I recently added some code and a little modal form that allows the user to enter an admin password to turn this functionality on. It is a set password, not user specific. When the correct password is entered, it does sort of the same thing by creating a 'key file' in the applications root directory so that the program can start in admin mode if that file is present.
Now the manager of the department that this software is mostly for doesn't like that idea so much. He thinks that if we have just a simple, preset password that it will easily 'get out', and he doesn't want inexperienced users accessing those extra features.
So my question is, what other methods are there for providing this kind of access that would be somewhat more secure? It's pretty much just me when it comes to maintaining and managing this software, so anything that isn't almost completely built in or automated wouldn't help (such as sending requests for 'license keys' or something similar to that).
Notes: This application is written in VB.NET (.NET 4.0), and I am currently planning on using click-once deployment when the new version is done.