I'm on Windows Server 2012 R2.

What I'm trying to accomplish

I'm trying to give certain users access to certain snap-ins of MMC by adding them to specific groups which grant them access to a certain snap-in.

I've created a GPO object and linked it in my Users folder (not the default one).

That GPO object disabled all the snap-ins by enabling:

Restrict users to the explicitly permitted list of snap-ins.

This works fine. Now I'm trying to create some groups, for example:

  • MMC_ADUC_ACCESS -> Should grant access to Active Directory Users and Computers.
  • MMC_DHCP_ACCESS -> Should grant access to the DHCP snap-in.

What's going wrong

So, I've created the groups and created a GPO object for both of them respectively. But it refuses to overwrite the one that disables all of the snap-ins. (All the snap-ins are on the "Not configured" setting).

What I've tried

I've set the scope of the object to the respective group, in the delegation settings I've configured it so that it should only apply to the group. Not to anything else.

My question: Why isn't the one GPO overwriting the other?

I'm also open to any other suggestions to get this to work. Thank you in advance.

  • Did you set the precedence of the GPO that disables all snapins to be lower than the other two? – Greg Askew Feb 20 at 19:31
  • The one that disables all the snapins is linked in the Users OU. The other one just applies to the group, where should I link it? Because it doesn't show up in the inheritance tab. – rpm192 Feb 20 at 19:36
  • 1
    Link it in a hierarchy where the user accounts are located. Linking a GPO to an OU with groups doesn't do anything. – Greg Askew Feb 20 at 19:38
  • That worked. Thanks! I would think that linking it to the hierachy where the user accounts are would apply it to all of the users? Did it not do that because I changed the scope to only apply it to the group? Anyway, you can add it as an answer and I'll accept it.. – rpm192 Feb 20 at 19:47
  • You link it to the OU or Container where the user accounts are. You filter it on your group so that it only applies to members of that group. – joeqwerty Feb 20 at 19:55

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.