How to Add custom MMC "Snap-Ins" in GPO (Windows 2003 AD)

Posted on 2006-10-31
Last Modified: 2011-07-21

I currently use a GPO to restrict users from loading Snap-Ins in the MMC.
But I would like to allow some only two or three specific custom non Microsoft Snap-Ins to be run by some users.

How could I add these custom snap-ins in the GPO in the following entry :

User Configuration/Administrative Templates/Microsoft Management Console/Restricted/Permitted snap-ins

Many thanks for your help.

Question by:jeffd001
LVL 10

Expert Comment

ID: 17841863
Here you cannot add the user defined custom entries.

Author Comment

ID: 17841944
Is there any way to define and allow a custom snap-ins to be run via the GPO ?

Accepted Solution

MarkusKolbeck earned 500 total points
ID: 17864959
with "custom snap-in" you mean an mmc snap-in from an ISV (3rd party software), right?
(this is different from "customized mmcs".)

if so, you can do the following:

- locate the ID string of the snap-in underneath the following registry key:
   You can identify the ID by searching for the "NameString" registry value.
   (Make sure you choose the correct registry key with two sub keys called "NodeTypes" and "StandAlone")

   e.g. the software DriveLock from CenterTools adds a new snap-in to the mmc with the ID {AE1F876B-4B9A-4235-80A3-9DC8441ABF99}

    (The software, that adds that snap-in has to be installed on that machine in order to be listed in the registry)

    Copy that ID.

- now, create a new GPO and remember the GUID of the GPO.
   You can retrieve the GUID from the GPO by displaying the properties of the GPO ("Unique name"), e.g. {31B2F340-016D-11D2-945F-00C04FB984F9}

- navigate to your SYSVOL share (\\%USERDOMAIN%\SYSVOL\<yourdomain>\Policies) and locate the newly created GPO, listed with its GUID you remembered
  (in my example {31B2F340-016D-11D2-945F-00C04FB984F9})

- navigate to the "adm" folder (where all the administrative templates for that GPO are stored).
  The administrative templates define what registry settings you can alter with the GPO.

- open the "system.adm" template with notepad

- search for the string "CATEGORY !!MMC_RESTRICT" (this is where all the GPO restrictions for snap-ins are defined)

- create a new Policy by inserting a new policy between the other ones, e.g.

              POLICY !!MMC_CenterToolsDriveLock
                                    KEYNAME "Software\Policies\Microsoft\MMC\{AE1F876B-4B9A-4235-80A3-9DC8441ABF99}"
                                    #if version >= 4
                                    SUPPORTED !!SUPPORTED_Win2k

                                    EXPLAIN !!MMC_Restrict_Explain
                                    VALUENAME "Restrict_Run"
                                    VALUEON   NUMERIC 0
                                    VALUEOFF  NUMERIC 1
              END POLICY

  The Policyname (in my example "MMC_CenterToolsDriveLock" can be chosen as you like)
  Change the ID of the snap-in to the one you remembered (in my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

- then, search again for "MMC_ActiveDirDomTrusts" in the file to add a name for the policy to be displayed in the GPO snap-in

- insert the string "MMC_CenterToolsDriveLock="CenterTools DriveLock" (or as you wish)
  in my example "CenterTools DriveLock" will be displayed underneath the mmc snap-ins in the GPO which can be edited then

- save the file "system.adm"

- open the newly created GPO and navigate to
  "User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\ Restricted/Permitted snap-ins"
   and voila, your newly created snap-in is listed and can be enabled or disabled

I hope my contribution helped you solve your problem (and I haven't forgotten anything ;-)

If not, please let me know.



Author Comment

ID: 17880399
Hello Markus,

Yes you're right, I mean exactly adding a 3rd party snap-ins in the MMC, which is not listed.

I tested your solution setp-by-step and it works perfectly ! Many thanks !!
The only things which is remaining is that each time I open the corresponding snap-in, I get a MMC Message saying "The snap-in below, referenced in this document has been restricted by policy. Contact your administrator for details." with only a OK button. I click OK and the snap-ins open and works.

Is it a normal behavior or is there a possibility to prevent this message from appearing ?


Expert Comment

ID: 17880463
Hi Jeff,

is the referenced Class ID (CLSID) in the mmc "Snap-In Creation Failed"-Window the exact same as the one you restricted?
(In my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

In my case (with the snap-in from CenterTools) it works perfectly ... The mmc opens and the snap-in does not work.
If I open the mmc and try to add the snap-in manually it is not listed (with the policy setting configured to "disabled").

I don't think you can disable this error message after all.

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.


Author Comment

ID: 17881790
Hello Markus,

Yes, the Class ID is exactly the same.
The Snap-in load and function correctly, the only "annoying" problem is that each time you open it, you get this message and you need to click OK.


Expert Comment

ID: 17887155
Hi Jeff,

I agree, but unfortunately I do not know any solution for disabling those popups.


Author Comment

ID: 17888534
Hi Markus,


Thanks again for your help!

Expert Comment

ID: 17888732
No problem.



Expert Comment

ID: 36230356
Is anybody able to update this for a Win2K8 server?

As it does not use adm files but ADMX there is no system.adm file.

I have found mmc.admx, MMCSnapins.admx and MMCSnapins2.admx but these do not contain a list of the contents of the Restrcted/Permitted Snapins List

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Introduction How to create multiboot configuration with XP\Vista and Windows 7 on it? And most important question - how to do this correctly so not to have any kind of nightmares we get when system gets screwed? First of all one should realize t…
Many people tend to confuse the function of a virus with the one of adware, this misunderstanding of the basic of what each software is and how it operates causes users and organizations to take the wrong security measures that would protect them ag…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video discusses moving either the default database or any database to a new volume.

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now