Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


How to Add custom MMC "Snap-Ins" in GPO (Windows 2003 AD)

Posted on 2006-10-31
Medium Priority
Last Modified: 2011-07-21

I currently use a GPO to restrict users from loading Snap-Ins in the MMC.
But I would like to allow some only two or three specific custom non Microsoft Snap-Ins to be run by some users.

How could I add these custom snap-ins in the GPO in the following entry :

User Configuration/Administrative Templates/Microsoft Management Console/Restricted/Permitted snap-ins

Many thanks for your help.

Question by:jeffd001
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 10

Expert Comment

ID: 17841863
Here you cannot add the user defined custom entries.

Author Comment

ID: 17841944
Is there any way to define and allow a custom snap-ins to be run via the GPO ?

Accepted Solution

MarkusKolbeck earned 2000 total points
ID: 17864959
with "custom snap-in" you mean an mmc snap-in from an ISV (3rd party software), right?
(this is different from "customized mmcs".)

if so, you can do the following:

- locate the ID string of the snap-in underneath the following registry key:
   You can identify the ID by searching for the "NameString" registry value.
   (Make sure you choose the correct registry key with two sub keys called "NodeTypes" and "StandAlone")

   e.g. the software DriveLock from CenterTools adds a new snap-in to the mmc with the ID {AE1F876B-4B9A-4235-80A3-9DC8441ABF99}

    (The software, that adds that snap-in has to be installed on that machine in order to be listed in the registry)

    Copy that ID.

- now, create a new GPO and remember the GUID of the GPO.
   You can retrieve the GUID from the GPO by displaying the properties of the GPO ("Unique name"), e.g. {31B2F340-016D-11D2-945F-00C04FB984F9}

- navigate to your SYSVOL share (\\%USERDOMAIN%\SYSVOL\<yourdomain>\Policies) and locate the newly created GPO, listed with its GUID you remembered
  (in my example {31B2F340-016D-11D2-945F-00C04FB984F9})

- navigate to the "adm" folder (where all the administrative templates for that GPO are stored).
  The administrative templates define what registry settings you can alter with the GPO.

- open the "system.adm" template with notepad

- search for the string "CATEGORY !!MMC_RESTRICT" (this is where all the GPO restrictions for snap-ins are defined)

- create a new Policy by inserting a new policy between the other ones, e.g.

              POLICY !!MMC_CenterToolsDriveLock
                                    KEYNAME "Software\Policies\Microsoft\MMC\{AE1F876B-4B9A-4235-80A3-9DC8441ABF99}"
                                    #if version >= 4
                                    SUPPORTED !!SUPPORTED_Win2k

                                    EXPLAIN !!MMC_Restrict_Explain
                                    VALUENAME "Restrict_Run"
                                    VALUEON   NUMERIC 0
                                    VALUEOFF  NUMERIC 1
              END POLICY

  The Policyname (in my example "MMC_CenterToolsDriveLock" can be chosen as you like)
  Change the ID of the snap-in to the one you remembered (in my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

- then, search again for "MMC_ActiveDirDomTrusts" in the file to add a name for the policy to be displayed in the GPO snap-in

- insert the string "MMC_CenterToolsDriveLock="CenterTools DriveLock" (or as you wish)
  in my example "CenterTools DriveLock" will be displayed underneath the mmc snap-ins in the GPO which can be edited then

- save the file "system.adm"

- open the newly created GPO and navigate to
  "User Configuration\Administrative Templates\Windows Components\Microsoft Management Console\ Restricted/Permitted snap-ins"
   and voila, your newly created snap-in is listed and can be enabled or disabled

I hope my contribution helped you solve your problem (and I haven't forgotten anything ;-)

If not, please let me know.


Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Author Comment

ID: 17880399
Hello Markus,

Yes you're right, I mean exactly adding a 3rd party snap-ins in the MMC, which is not listed.

I tested your solution setp-by-step and it works perfectly ! Many thanks !!
The only things which is remaining is that each time I open the corresponding snap-in, I get a MMC Message saying "The snap-in below, referenced in this document has been restricted by policy. Contact your administrator for details." with only a OK button. I click OK and the snap-ins open and works.

Is it a normal behavior or is there a possibility to prevent this message from appearing ?


Expert Comment

ID: 17880463
Hi Jeff,

is the referenced Class ID (CLSID) in the mmc "Snap-In Creation Failed"-Window the exact same as the one you restricted?
(In my example {AE1F876B-4B9A-4235-80A3-9DC8441ABF99})

In my case (with the snap-in from CenterTools) it works perfectly ... The mmc opens and the snap-in does not work.
If I open the mmc and try to add the snap-in manually it is not listed (with the policy setting configured to "disabled").

I don't think you can disable this error message after all.


Author Comment

ID: 17881790
Hello Markus,

Yes, the Class ID is exactly the same.
The Snap-in load and function correctly, the only "annoying" problem is that each time you open it, you get this message and you need to click OK.


Expert Comment

ID: 17887155
Hi Jeff,

I agree, but unfortunately I do not know any solution for disabling those popups.


Author Comment

ID: 17888534
Hi Markus,


Thanks again for your help!

Expert Comment

ID: 17888732
No problem.



Expert Comment

ID: 36230356
Is anybody able to update this for a Win2K8 server?

As it does not use adm files but ADMX there is no system.adm file.

I have found mmc.admx, MMCSnapins.admx and MMCSnapins2.admx but these do not contain a list of the contents of the Restrcted/Permitted Snapins List

Featured Post

New feature and membership benefit!

New feature! Upgrade and increase expert visibility of your issues with Priority Questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction How to create multiboot configuration with XP\Vista and Windows 7 on it? And most important question - how to do this correctly so not to have any kind of nightmares we get when system gets screwed? First of all one should realize t…
I don't know if many of you have made the great mistake of using the Cisco Thin Client model with the management software VXC. If you have then you are probably more then familiar with the incredibly clunky interface, the numerous work arounds, and …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question