How to Add custom MMC "Snap-Ins" in GPO (Windows 2003 AD)


I currently use a GPO to restrict users from loading Snap-Ins in the MMC.
But I would like to allow some only two or three specific custom non Microsoft Snap-Ins to be run by some users.

How could I add these custom snap-ins in the GPO in the following entry :

User Configuration/Administrative Templates/Microsoft Management Console/Restricted/Permitted snap-ins

Many thanks for your help.

Who is Participating?
MarkusKolbeckConnect With a Mentor Commented:
with "custom snap-in" you mean an mmc snap-in from an ISV (3rd party software), right?
(this is different from "customized mmcs".)

if so, you can do the following:

- locate the ID string of the snap-in underneath the following registry key:
   You can identify the ID by searching for the "NameString" registry value.
   (Make sure you choose the correct registry key with two sub keys called "NodeTypes" and "StandAlone")

   e.g. the software DriveLock from CenterTools adds a new snap-in to the mmc with the ID {AE1F876B-4B9A-4235-80A3-9DC8441ABF99}

    (The software, that adds that snap-in has to be installed on that machine in order to be listed in the registry)

    Copy that ID.

- now, create a new GPO and remember the GUID of the GPO.
   You can retrieve the GUID from the GPO by displaying the properties of the GPO ("Unique name"), e.g. {31B2F340-016D-11D2-945F-00C04FB984F9}

- navigate to your SYSVOL share (\\%USERDOMAIN%\SYSVOL\<yourdomain>\Policies) and locate the newly created GPO, listed with its GUID you remembered
  (in my example {31B2F340-016D-11D2-945F-00C04FB984F9})

- navigate to the "adm" folder (where all the administrative templates for that GPO are stored).
  The administrative templates define what registry settings you can alter with the GPO.

- open the "system.adm" template with notepad

- search for the string "CATEGORY !!MMC_RESTRICT" (this is where all the GPO restrictions for snap-ins are defined)

- create a new Policy by inserting a new policy between the other ones, e.g.

              POLICY !!MMC_CenterToolsDriveLock
                                    KEYNAME "Software\Policies\Microsoft\MMC\{AE1F876B-4B9A-4235-80A3-9DC8441ABF99}"
                                    #if version >= 4
                                    SUPPORTED !!SUPPORTED_Win2k

                                    EXPLAIN !!MMC_Restrict_Explain
                                    VALUENAME "Restrict_Run"
                                    VALUEON   NUMERIC 0
                                    VALUEOFF  NUMERIC 1
              END POLICY

  The Policyname (in my example "MMC_CenterToolsDriveLock" can be chosen as you like)
  Change the ID of the snap-in to the one you remembered (in my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

- then, search again for "MMC_ActiveDirDomTrusts" in the file to add a name for the policy to be displayed in the GPO snap-in

- insert the string "MMC_CenterToolsDriveLock="CenterTools DriveLock" (or as you wish)
  in my example "CenterTools DriveLock" will be displayed underneath the mmc snap-ins in the GPO which can be edited then

- save the file "system.adm"

- open the newly created GPO and navigate to
  "User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\ Restricted/Permitted snap-ins"
   and voila, your newly created snap-in is listed and can be enabled or disabled

I hope my contribution helped you solve your problem (and I haven't forgotten anything ;-)

If not, please let me know.


Here you cannot add the user defined custom entries.
jeffd001Author Commented:
Is there any way to define and allow a custom snap-ins to be run via the GPO ?
Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

jeffd001Author Commented:
Hello Markus,

Yes you're right, I mean exactly adding a 3rd party snap-ins in the MMC, which is not listed.

I tested your solution setp-by-step and it works perfectly ! Many thanks !!
The only things which is remaining is that each time I open the corresponding snap-in, I get a MMC Message saying "The snap-in below, referenced in this document has been restricted by policy. Contact your administrator for details." with only a OK button. I click OK and the snap-ins open and works.

Is it a normal behavior or is there a possibility to prevent this message from appearing ?

Hi Jeff,

is the referenced Class ID (CLSID) in the mmc "Snap-In Creation Failed"-Window the exact same as the one you restricted?
(In my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

In my case (with the snap-in from CenterTools) it works perfectly ... The mmc opens and the snap-in does not work.
If I open the mmc and try to add the snap-in manually it is not listed (with the policy setting configured to "disabled").

I don't think you can disable this error message after all.

jeffd001Author Commented:
Hello Markus,

Yes, the Class ID is exactly the same.
The Snap-in load and function correctly, the only "annoying" problem is that each time you open it, you get this message and you need to click OK.

Hi Jeff,

I agree, but unfortunately I do not know any solution for disabling those popups.

jeffd001Author Commented:
Hi Markus,


Thanks again for your help!
No problem.


Is anybody able to update this for a Win2K8 server?

As it does not use adm files but ADMX there is no system.adm file.

I have found mmc.admx, MMCSnapins.admx and MMCSnapins2.admx but these do not contain a list of the contents of the Restrcted/Permitted Snapins List
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.