3

Windows Server 2012 R2 Domain with Windows 10 Pro clients.

I'm poking around in GPO under

User Configuration -> Policies -> Administrative Templates -> Windows Components -> Microsoft Management Console -> Restricted/Permitted snap-ins

Looks like the perfect place for it to be, but it isn't

Can I add it manually anyway?

Improve this question
2
  • Since Authorization Manager has been deprecated, I'm not aware of any way to implement RBAC for Hyper-V other than with SCVMM.
    – joeqwerty
    Aug 28, 2016 at 22:07
  • I'm not even looking to specify per-user roles at this point. I'm looking for a hammer. I'd like to just completely disable the snap-in. That seems like it should be a terribly easy task, and yet it is not. At this point I'm just going to try restricting access to MMC.exe entirely.
    – Daniel
    Aug 28, 2016 at 22:19

1 Answer 1

Reset to default
3

You can edit administrative template file "C:\Windows\PolicyDefinitions\MMCSnapins.admx" and see what is changed if you enable any of the settings in that GPO section. It'll show you that it's using the ID of the snap-in and the value Restrict_Run with a value of 1.

  1. Google for "mmc snap-in registry location"
  2. Open regedit and go to HKEY_LOCAL_MACHINE\Software\Microsoft\MMC\Snapins
  3. Install Hyper-V Management Tool and check the new snap-in's ID in this location
  4. If snap-in is already installed, just browse the keys and find related snap-in and its ID

Now you know your snap-in's ID, you need to use it in GPO. There are couple of ways to do that.

You can edit the administrative template file ("C:\Windows\PolicyDefinitions\MMCSnapins.admx") you used before and add a new policy section with Hyper-V snap-in's ID, or, you can use admx file to see what is modified in registry when you change that Group Policy setting and deploy correct settings with GP preferences.

Instead, I just changed one of the settings using gpedit.msc , opened "C:\Windows\System32\GroupPolicy\User\Registry.pol" in notepad to see what it changed, opened regedit and added the new key with snap-in's ID and value.

After testing to see if it worked, you can export it and deploy it using GP preferences.

SOFTWARE\Policies\Microsoft\MMC\FX:{922180d7-b74e-45f6-8c74-4b560cc100a5}
"Restrict_Run"=dword:00000001
Improve this answer
4
  • Details as to how you found this GUID would be really useful for folks in the future.
    – Tim Brigham
    Aug 29, 2016 at 0:55
  • Ooooh. Ya, tell us how this works.
    – Daniel
    Aug 29, 2016 at 1:02
  • Thanks to your lead I found this page that seems to detail how to add it to a custom Administrative Template: asteriksz.wordpress.com/2010/11/06/… Seems to be in Hungarian, but Google does a decent job of auto-translate.
    – Daniel
    Aug 29, 2016 at 6:02
  • worked, though you have an extraneous bracket there
    – Daniel
    Aug 29, 2016 at 8:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .