How to Add custom MMC "Snap-Ins" in GPO (Windows 2003 AD)

with "custom snap-in" you mean an mmc snap-in from an ISV (3rd party software), right?
(this is different from "customized mmcs".)

if so, you can do the following:

- locate the ID string of the snap-in underneath the following registry key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns
   You can identify the ID by searching for the "NameString" registry value.
   (Make sure you choose the correct registry key with two sub keys called "NodeTypes" and "StandAlone")

   e.g. the software DriveLock from CenterTools adds a new snap-in to the mmc with the ID {AE1F876B-4B9A-4235-80A3-9DC8441ABF99}

    (The software, that adds that snap-in has to be installed on that machine in order to be listed in the registry)

    Copy that ID.

- now, create a new GPO and remember the GUID of the GPO.
   You can retrieve the GUID from the GPO by displaying the properties of the GPO ("Unique name"), e.g. {31B2F340-016D-11D2-945F-00C04FB984F9}

- navigate to your SYSVOL share (\\%USERDOMAIN%\SYSVOL\<yourdomain>\Policies) and locate the newly created GPO, listed with its GUID you remembered
  (in my example {31B2F340-016D-11D2-945F-00C04FB984F9})

- navigate to the "adm" folder (where all the administrative templates for that GPO are stored).
  The administrative templates define what registry settings you can alter with the GPO.

- open the "system.adm" template with notepad

- search for the string "CATEGORY !!MMC_RESTRICT" (this is where all the GPO restrictions for snap-ins are defined)

- create a new Policy by inserting a new policy between the other ones, e.g.

              POLICY !!MMC_CenterToolsDriveLock
                                    KEYNAME "Software\Policies\Microsoft\MMC\{AE1F876B-4B9A-4235-80A3-9DC8441ABF99}"
                                    #if version >= 4
                                    SUPPORTED !!SUPPORTED_Win2k
                        #endif

                                    EXPLAIN !!MMC_Restrict_Explain
                                    VALUENAME "Restrict_Run"
                                    VALUEON   NUMERIC 0
                                    VALUEOFF  NUMERIC 1
              END POLICY

  The Policyname (in my example "MMC_CenterToolsDriveLock" can be chosen as you like)
  Change the ID of the snap-in to the one you remembered (in my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

- then, search again for "MMC_ActiveDirDomTrusts" in the file to add a name for the policy to be displayed in the GPO snap-in

- insert the string "MMC_CenterToolsDriveLock="CenterTools DriveLock" (or as you wish)
  in my example "CenterTools DriveLock" will be displayed underneath the mmc snap-ins in the GPO which can be edited then

- save the file "system.adm"

- open the newly created GPO and navigate to
  "User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\ Restricted/Permitted snap-ins"
   and voila, your newly created snap-in is listed and can be enabled or disabled


I hope my contribution helped you solve your problem (and I haven't forgotten anything ;-)

If not, please let me know.

ATB
Markus