Home / server / Questions / 799634
Accepted
Daniel
Asked: 2016-08-29 12:47:56 +0800 CST

Any way to restrict access to Hyper-V Administrator snap-in via GPO?

  • 772

Windows Server 2012 R2 Domain with Windows 10 Pro clients.

I'm poking around in GPO under

User Configuration -> Policies -> Administrative Templates -> Windows Components -> Microsoft Management Console -> Restricted/Permitted snap-ins

Looks like the perfect place for it to be, but it isn't

Can I add it manually anyway?

group-policy hyper-v windows-server-2012-r2

1 Answers

  1. Best Answer

    You can edit administrative template file "C:\Windows\PolicyDefinitions\MMCSnapins.admx" and see what is changed if you enable any of the settings in that GPO section. It'll show you that it's using the ID of the snap-in and the value Restrict_Run with a value of 1.

    1. Google for "mmc snap-in registry location"
    2. Open regedit and go to HKEY_LOCAL_MACHINE\Software\Microsoft\MMC\Snapins
    3. Install Hyper-V Management Tool and check the new snap-in's ID in this location
    4. If snap-in is already installed, just browse the keys and find related snap-in and its ID

    Now you know your snap-in's ID, you need to use it in GPO. There are couple of ways to do that.

    You can edit the administrative template file ("C:\Windows\PolicyDefinitions\MMCSnapins.admx") you used before and add a new policy section with Hyper-V snap-in's ID, or, you can use admx file to see what is modified in registry when you change that Group Policy setting and deploy correct settings with GP preferences.

    Instead, I just changed one of the settings using gpedit.msc , opened "C:\Windows\System32\GroupPolicy\User\Registry.pol" in notepad to see what it changed, opened regedit and added the new key with snap-in's ID and value.

    After testing to see if it worked, you can export it and deploy it using GP preferences.

    SOFTWARE\Policies\Microsoft\MMC\FX:{922180d7-b74e-45f6-8c74-4b560cc100a5}
"Restrict_Run"=dword:00000001
    • 3