RestrictToPermittedSnapins

  • Article

HKCU\Software\Policies\Microsoft\MMC

Data type

Range

Default value

REG_DWORD

0 | 1

0

Description

Selectively permits or prohibits the use of Microsoft Management Console (MMC) snap-ins.

This entry stores the setting of the Restrict users to the explicitly permitted list of snap-ins Group Policy. Group Policy adds this entry to the registry with a value of 1 when you enable the policy. If you disable the policy, Group Policy sets the value to 0. If you set the policy to Not configured, Group Policy deletes the entry from the registry, and the system behaves as though the value is 0.

Value

Meaning

0 (or not in the registry)

The policy is disabled or not configured. All snap-ins are permitted, except those explicitly prohibited.
Snap-ins are explicitly prohibited when the value of the Restrict_Run entry in the Class-ID subkey for that snap-in is 0. (If the Restrict_Run entry for that snap-in is not in the registry or if its value is 1, the snap-in is permitted.)

1

The policy is enabled. All snap-ins are prohibited, except those explicitly permitted.
Snap-ins are explicitly permitted when the when the value of the Restrict_Run entry in the Class-ID subkey for that snap-in is 1. (If the Restrict_Run entry for that snap-in is not in the registry or if its value is 0, the snap-in is prohibited.)

A value of 1 prohibits users from running any snap-ins except those you explicitly permit them to use. Use this value if you plan to prohibit use of all or most snap-ins.

A value of 0 (the default value) lets users run all snap-ins except those that you explicitly prohibit them from using. Use this value if you plan to permit use of all or most snap-ins.

Change method

To change the value of this entry, use Group Policy. This entry corresponds to the Restrict users to the explicitly permitted list of snap-ins Group Policy (User Configuration\Administrative Templates\Windows Components\Microsoft Management Console).

Note Image Note

To explicitly permit or prohibit a snap-in, use the policies in the Restricted/Permitted snap-ins folder in Group Policy.

To prohibit use of all snap-ins, enable the Restrict users to the explicitly permitted list of snap-ins Group Policy (which sets the value of this entry to 1), and do not configure any of the policies in the Restricted/Permitted snap-ins folder.

If the value of this entry is 1 and none of the policies in the Restrict/Permitted snap-ins Group Policy folder are enabled, users cannot use any MMC snap-ins.

Tip Image Tip

See a list of the Class-ID subkeys and the snap-ins they represent.

For detailed information about particular Group Policy settings, see the Windows 2000 Resource Kit Group Policy Reference.

For general information about Group Policy, see Windows 2000 Server Help or Windows 2000 Professional Help.

To see a table associating policies with their corresponding registry entries, see the Group Policy Registry Table .

Related Entries

Page Image

Restrict_Run