INTRODUCTION
The Restrict users to the explicitly permitted list of snap-ins Group Policy setting lets you selectively enable or disable specific Microsoft Management Console (MMC) snap-ins. However, before you enable this setting, you must enable the settings in the "Restricted/Permitted snap-ins" folder for MMC snap-ins that you want to use.
More Information
Important If you enable the Restrict users to the explicitly permitted list of snap-ins policy setting but do not enable any settings in the "Restricted/Permitted snap-ins" folder, you cannot use any MMC snap-ins.
If you enable the Restrict users to the explicitly permitted list of snap-ins policy setting, all MMC snap-ins are prohibited, except MMC snap-ins that you explicitly enable. You may enable the Restrict users to the explicitly permitted list of snap-ins policy setting if you want to disable most MMC snap-ins.
To explicitly enable an MMC snap-in in Microsoft Windows XP
-
Click Start, click Run, type gpedit.msc, and then click OK.
-
Expand User Configuration, and then expand Administrative Templates.
-
Expand Windows Components, and then click Microsoft Management Console.
-
Double-click Restricted/Permitted snap-ins, and then enable the setting for the MMC snap-in that you want to use.
Note If a setting in the "Restricted/Permitted snap-ins" folder is disabled or not configured, the corresponding MMC snap-in is disabled.
To explicitly enable an MMC snap-in in Windows Vista
-
Click Start
-
Expand User Configuration, and then expand Administrative Templates.
-
Expand Windows Components, and then click Microsoft Management Console.
-
Double-click Restricted/Permitted snap-ins, and then enable the setting for the MMC snap-in that you want to use.
Note If a setting in the "Restricted/Permitted snap-ins" folder is disabled or not configured, the corresponding MMC snap-in is disabled.
If you disable or do not configure the Restrict users to the explicitly permitted list of snap-ins policy setting, all MMC snap-ins are enabled, except MMC snap-ins that you explicitly disable. You may disable or not configure the Restrict users to the explicitly permitted list of snap-ins policy setting if you want to enable use of most MMC snap-ins.
To explicitly disable an MMC snap-in in Windows XP
-
Click Start, click Run, type gpedit.msc, and then click OK.
-
Expand User Configuration, and then expand Administrative Templates.
-
Expand Windows Components, and then click Microsoft Management Console.
-
Double-click Restricted/Permitted snap-ins, and then disable the setting for the MMC snap-in that you want to disable.
Note If a setting in the "Restricted/Permitted snap-ins" folder is enabled or not configured, the corresponding MMC snap-in is enabled.
To explicitly disable an MMC snap-in in Windows Vista
-
Click Start
-
Expand User Configuration, and then expand Administrative Templates.
-
Expand Windows Components, and then click Microsoft Management Console.
-
Double-click Restricted/Permitted snap-ins, and then disable the setting for the MMC snap-in that you do not want to use.
Note If a setting in the "Restricted/Permitted" snap-ins folder is enabled or not configured, the corresponding MMC snap-in is enabled.
When an MMC snap-in is disabled, the snap-in does not appear in the Add/Remove Snap-in dialog box in MMC. Additionally, when you open a console file that includes a disabled snap-in, the console file opens. However, the disabled snap-in does not appear.
