We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now

x

How to Add custom MMC "Snap-Ins" in GPO (Windows 2003 AD)

jeffd001
jeffd001 asked
on
Medium Priority
6,333 Views
Last Modified: 2011-07-21
Hello,

I currently use a GPO to restrict users from loading Snap-Ins in the MMC.
But I would like to allow some only two or three specific custom non Microsoft Snap-Ins to be run by some users.

How could I add these custom snap-ins in the GPO in the following entry :

User Configuration/Administrative Templates/Microsoft Management Console/Restricted/Permitted snap-ins



Many thanks for your help.
Jeff

Comment
Watch Question

Here you cannot add the user defined custom entries.

Author

Commented:
Is there any way to define and allow a custom snap-ins to be run via the GPO ?
with "custom snap-in" you mean an mmc snap-in from an ISV (3rd party software), right?
(this is different from "customized mmcs".)

if so, you can do the following:

- locate the ID string of the snap-in underneath the following registry key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MMC\SnapIns
   You can identify the ID by searching for the "NameString" registry value.
   (Make sure you choose the correct registry key with two sub keys called "NodeTypes" and "StandAlone")

   e.g. the software DriveLock from CenterTools adds a new snap-in to the mmc with the ID {AE1F876B-4B9A-4235-80A3-9DC8441ABF99}

    (The software, that adds that snap-in has to be installed on that machine in order to be listed in the registry)

    Copy that ID.

- now, create a new GPO and remember the GUID of the GPO.
   You can retrieve the GUID from the GPO by displaying the properties of the GPO ("Unique name"), e.g. {31B2F340-016D-11D2-945F-00C04FB984F9}

- navigate to your SYSVOL share (\\%USERDOMAIN%\SYSVOL\<yourdomain>\Policies) and locate the newly created GPO, listed with its GUID you remembered
  (in my example {31B2F340-016D-11D2-945F-00C04FB984F9})

- navigate to the "adm" folder (where all the administrative templates for that GPO are stored).
  The administrative templates define what registry settings you can alter with the GPO.

- open the "system.adm" template with notepad

- search for the string "CATEGORY !!MMC_RESTRICT" (this is where all the GPO restrictions for snap-ins are defined)

- create a new Policy by inserting a new policy between the other ones, e.g.

              POLICY !!MMC_CenterToolsDriveLock
                                    KEYNAME "Software\Policies\Microsoft\MMC\{AE1F876B-4B9A-4235-80A3-9DC8441ABF99}"
                                    #if version >= 4
                                    SUPPORTED !!SUPPORTED_Win2k
                        #endif

                                    EXPLAIN !!MMC_Restrict_Explain
                                    VALUENAME "Restrict_Run"
                                    VALUEON   NUMERIC 0
                                    VALUEOFF  NUMERIC 1
              END POLICY

  The Policyname (in my example "MMC_CenterToolsDriveLock" can be chosen as you like)
  Change the ID of the snap-in to the one you remembered (in my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

- then, search again for "MMC_ActiveDirDomTrusts" in the file to add a name for the policy to be displayed in the GPO snap-in

- insert the string "MMC_CenterToolsDriveLock="CenterTools DriveLock" (or as you wish)
  in my example "CenterTools DriveLock" will be displayed underneath the mmc snap-ins in the GPO which can be edited then

- save the file "system.adm"

- open the newly created GPO and navigate to
  "User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\ Restricted/Permitted snap-ins"
   and voila, your newly created snap-in is listed and can be enabled or disabled


I hope my contribution helped you solve your problem (and I haven't forgotten anything ;-)

If not, please let me know.

ATB
Markus


Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
Hello Markus,

Yes you're right, I mean exactly adding a 3rd party snap-ins in the MMC, which is not listed.

I tested your solution setp-by-step and it works perfectly ! Many thanks !!
The only things which is remaining is that each time I open the corresponding snap-in, I get a MMC Message saying "The snap-in below, referenced in this document has been restricted by policy. Contact your administrator for details." with only a OK button. I click OK and the snap-ins open and works.

Is it a normal behavior or is there a possibility to prevent this message from appearing ?

Jeff
Hi Jeff,

is the referenced Class ID (CLSID) in the mmc "Snap-In Creation Failed"-Window the exact same as the one you restricted?
(In my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

In my case (with the snap-in from CenterTools) it works perfectly ... The mmc opens and the snap-in does not work.
If I open the mmc and try to add the snap-in manually it is not listed (with the policy setting configured to "disabled").

I don't think you can disable this error message after all.

ATB
Markus

Author

Commented:
Hello Markus,

Yes, the Class ID is exactly the same.
The Snap-in load and function correctly, the only "annoying" problem is that each time you open it, you get this message and you need to click OK.

Jeff
Hi Jeff,

I agree, but unfortunately I do not know any solution for disabling those popups.

ATB
Markus

Author

Commented:
Hi Markus,

OK.

Thanks again for your help!
Jeff
No problem.

Cheers

Markus

Commented:
Is anybody able to update this for a Win2K8 server?

As it does not use adm files but ADMX there is no system.adm file.

I have found mmc.admx, MMCSnapins.admx and MMCSnapins2.admx but these do not contain a list of the contents of the Restrcted/Permitted Snapins List
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.