I'm on Windows Server 2012 R2.
What I'm trying to accomplish
I'm trying to give certain users access to certain snap-ins of MMC by adding them to specific groups which grant them access to a certain snap-in.
I've created a GPO object and linked it in my
Users folder (not the default one).
That GPO object disabled all the snap-ins by enabling:
Restrict users to the explicitly permitted list of snap-ins.
This works fine. Now I'm trying to create some groups, for example:
- MMC_ADUC_ACCESS -> Should grant access to Active Directory Users and Computers.
- MMC_DHCP_ACCESS -> Should grant access to the DHCP snap-in.
What's going wrong
So, I've created the groups and created a GPO object for both of them respectively. But it refuses to overwrite the one that disables all of the snap-ins. (All the snap-ins are on the "Not configured" setting).
What I've tried
I've set the scope of the object to the respective group, in the delegation settings I've configured it so that it should only apply to the group. Not to anything else.
My question: Why isn't the one GPO overwriting the other?
I'm also open to any other suggestions to get this to work. Thank you in advance.