You must explicitly enable MMC snap-ins that you want to use before you enable the "Restrict users to the explicitly permitted list of snap-ins" Group Policy setting in Windows XP and in Windows Vista

Important If you enable the Restrict users to the explicitly permitted list of snap-ins policy setting but do not enable any settings in the "Restricted/Permitted snap-ins" folder, you cannot use any MMC snap-ins.

If you enable the Restrict users to the explicitly permitted list of snap-ins policy setting, all MMC snap-ins are prohibited, except MMC snap-ins that you explicitly enable. You may enable the Restrict users to the explicitly permitted list of snap-ins policy setting if you want to disable most MMC snap-ins.

To explicitly enable an MMC snap-in in Microsoft Windows XP

1. Click Start, click Run, type gpedit.msc, and then click OK.
2. Expand User Configuration, and then expand Administrative Templates.
3. Expand Windows Components, and then click Microsoft Management Console.
4. Double-click Restricted/Permitted snap-ins, and then enable the setting for the MMC snap-in that you want to use.
   
   Note If a setting in the "Restricted/Permitted snap-ins" folder is disabled or not configured, the corresponding MMC snap-in is disabled.

To explicitly enable an MMC snap-in in Windows Vista

1. Click Start , type gpedit.msc in the Start Search box, and then press ENTER.
2. Expand User Configuration, and then expand Administrative Templates.
3. Expand Windows Components, and then click Microsoft Management Console.
4. Double-click Restricted/Permitted snap-ins, and then enable the setting for the MMC snap-in that you want to use.
   
   Note If a setting in the "Restricted/Permitted snap-ins" folder is disabled or not configured, the corresponding MMC snap-in is disabled.

If you disable or do not configure the Restrict users to the explicitly permitted list of snap-ins policy setting, all MMC snap-ins are enabled, except MMC snap-ins that you explicitly disable. You may disable or not configure the Restrict users to the explicitly permitted list of snap-ins policy setting if you want to enable use of most MMC snap-ins.

To explicitly disable an MMC snap-in in Windows XP

1. Click Start, click Run, type gpedit.msc, and then click OK.
2. Expand User Configuration, and then expand Administrative Templates.
3. Expand Windows Components, and then click Microsoft Management Console.
4. Double-click Restricted/Permitted snap-ins, and then disable the setting for the MMC snap-in that you want to disable.
   
   Note If a setting in the "Restricted/Permitted snap-ins" folder is enabled or not configured, the corresponding MMC snap-in is enabled.

To explicitly disable an MMC snap-in in Windows Vista

1. Click Start , type gpedit.msc in the Start Search box, and then press ENTER.
2. Expand User Configuration, and then expand Administrative Templates.
3. Expand Windows Components, and then click Microsoft Management Console.
4. Double-click Restricted/Permitted snap-ins, and then disable the setting for the MMC snap-in that you do not want to use.
   
   Note If a setting in the "Restricted/Permitted" snap-ins folder is enabled or not configured, the corresponding MMC snap-in is enabled.

When an MMC snap-in is disabled, the snap-in does not appear in the Add/Remove Snap-in dialog box in MMC. Additionally, when you open a console file that includes a disabled snap-in, the console file opens. However, the disabled snap-in does not appear.