How to block all the (.MSC) commands/windows in Windows devices via Intune?

Question

How to block all the (.MSC) commands/windows in Windows devices via Intune?

For example: lusrmgr.msc this command/window

Answer 1

@Vinod Survase, Thanks for posting in Q&A. Based on my researching, I find we can configure "Restrict Users to the explicitly permitted list of snap-ins" and "Restricted/Permitted snap-ins" to restrict the .msc access. Here is a link with more details:

https://www.itprotoday.com/windows-78/how-can-i-restrict-access-mmc-snap-ins

https://admx.help/?Category=Windows_11_2022&Policy=Microsoft.Policies.ManagementConsole::MMC_Restrict_To_Permitted_Snapins

Note: Non-Microsoft link, just for the reference.

In Intune, the policy settings are also available in Setting Catalog, you can configure there:

Hope the above information can help.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@Vinod Survase, Thanks for the reply. Based on my test, when I configure the policy as below:

After the policy is applied, I get the following error when I enter lusrmgr.msc in run

And is unable to access as below:

From your description, I know you also get error. Is it the same as the one I get? Which snap ins you are testing? If it is a different one, please let me know the name to let me test.