Novell Home

My Favorites

Close

Please to see your favorites.

Restricting a user from editing a Group Policy prevents the Administrator from changing the Group Policy.

(Last modified: 14Jul2005)

This document (10088881) is provided subject to the disclaimer at the end of this document.

fact

Novell ZENworks 6.5 Desktop Management - ZfD6.5

Novell ZENworks for Desktops 4.0.1 - ZfD4.0.1

Novell ZENworks for Desktops 4 - ZfD4

Novell ZENworks Desktop Management

Novell ZENworks Management Agent

Microsoft Windows XP Professional

Microsoft Windows 2000 Professional

symptom

Restricting a user from editing a Group Policy prevents the Administrator from changing the Group Policy.

The Group Policy setting "GROUP POLICY SNAPIN" set to disable, prevents the Microsoft Management Console from configuring the Group Policy

Error: "MMC - The snapin below, referenced in this document has been restricted by policy. Contact your administrator for details."

note

Setting is found in:

- User Configuration | Administrative Templates | Windows Components | Microsoft Management Console | Restrict the user from entering author mode = Enabled
- User Configuration | Administrative Templates | Windows Components | Microsoft Management Console | Restricted/Permitted snap-ins | Group Policy | Group Policy Management = Disabled

fix

This issue will NOT be fixed for ZEN 4.01, but there is a work around.  Coolsolution coming soon.

For ZDM 6.5, these updated files shipped as part of the final released code of the product. (Confirmed fixed in ZEN 6.5 SP1)

note

Understanding the Fix/Code Change:

The Group Policy snapins have been changed so that when editing the Group Policy through ConsoleOne, the Group Policy ZENworks Snap-in looks first for settings that could affect the loading of the MMC to modify the Group Policy. The settings that it looks for can be defined in a file called GpRstrct.pol, which can be created in the ConsoleOne/1.2/bin directory.

If the file is found, and its defined settings are detected, a message box is displayed stating there are settings the prevent the editing of the Group Policy and gives the option to view them or not. If Yes is selected , the settings (as displayed in GPEDIT) and the key names are displayed in notepad text window. This allows the administrator to see which of these restricted settings are set. After the MMC editor is closed, the ZENworks Snap-in takes these displayed settings and merges them with the changed Group Policy Settings. If there are conflicts, the edited Group Policy takes precedence. Since such settings will always show Not Configured, if an Administrator wants to clear a such setting, simply change it to enabled. When the when settings are merged, the enabled setting will replace the disabled setting.

fix

Workaround - Microsoft gives a workaround on their Support website in Article ID# 263166, which goes through changing the registry to undo the restriction on a workstation if the logged in user has the correct rights to the modify the registry.

disclaimer

The Origin of this information may be internal or external to Novell. Novell makes all reasonable efforts to verify this information. However, the information provided in this document is for your information only. Novell makes no explicit or implied claims to the validity of this information.
Any trademarks referenced in this document are the property of their respective owners. Consult your product manuals for complete trademark information.

  • Document ID:
  • 10088881
  • Solution ID: NOVL94012
  • Creation Date: 18Nov2003
  • Modified Date: 14Jul2005
    • NovellManagement Products

Did this document solve your problem? Provide Feedback