Restrict Remote MMC

Question

Restrict Remote MMC

segun abefe 21

Hi,

Current: Domain user can launch MMC console on their computer, select remote server A, select and use MMC snap-ins to work on the remote server A.

Goal: I want to block MMC on the remote server A so that if a domain user launch MMC console on their computer, select remote server A and then select MMC snap-ins, domain users will be notified that restriction is in place or access is denied.

Domain administrator should be able to launch MMC console from remote server B, select remote server A, select and use MMC snap-ins to work on the remote server A.

Domain user should be able to use MMC snap-ins on their own computer.

segun abefe 21 Reputation points

2021-03-31T03:38:28.457+00:00

Please i will appreciate any help and guide.

Thank you
MotoX80 37,151 Reputation points

2021-03-31T13:24:07.32+00:00

What snap-in (or WMI query) are you really trying to block? Since the Domain User does not have administrator rights, they will not be able to make any changes that the Domain Admin would be able to make. The user is already limited as to what they can do.

Will the Domain User access network shares or web sites on Server A?

Are all 3 machines on the same or different subnets? (Can you block access by IP address?)
segun abefe 21 Reputation points

2021-03-31T14:04:44.607+00:00

This is what i want to achieve:
Scenario

1.On server A, Domain admin disable Services snap-ins under Restricted/Permitted snap-ins
2. On server A, Domain admin launch mmc console and could not access Services snap-ins because it is disabled
3. Domain user login to a workstation on the same network and same domain as server A
4. Domain user launch mmc console on the workstation, select server A as the computer to manage and select Services as the snap-ins to manage on server A
5, Domain user was able to launch Services snap-ins on server A remotely and was able modify Services snap-in on server A (despite that it is restricted and disabled on server A)

If I restrict a snap-in on server A and anyone that login to server A locally is restricted from using that snap-in on server. I also want the restriction to affect anyone that is using mmc console to remotely connect to server A not to be able to use a restricted snap-ins on the server A.

Thank you
MotoX80 37,151 Reputation points

2021-03-31T14:24:16.44+00:00

Domain user was able to launch Services snap-ins on server A remotely and was able modify Services snap-in on server A (despite that it is restricted and disabled on server A)

From my understanding, Server A is does not see a remote snap-in. It sees an RPC/DCOM/WMI call to query services.

I would suggest that you NOT focus on snap-in's. Instead focus on the functionality that you wish to prevent. Even if you could block the snap-in, the user could probably use a Powershell command or WMIC call to query the resource.

What functionality are you trying to block? Enumerating the names of services on Server A?
segun abefe 21 Reputation points

2021-04-01T01:45:40.88+00:00

All the systems are on same subnet. I want to block snap-ins like services, disk management, device management and bunch of them
MotoX80 37,151 Reputation points

2021-04-01T12:29:38.563+00:00

Since the user does not have Administrator authority on the server, most of the snapin's are not going to function anyway.

I ran compmgmt.msc with a standard user and connected to a test VM that I have. Win10 to Win10.

Nothing worked. About the only thing that I could see was the names of the event logs. I could not read any events.

But your server might be configured differently. Have you tested access from a client? You may be trying to fix a problem that you don't have.

Answer accepted by question author

1 additional answer

Your answer

segun abefe 21 Reputation points

2021-03-31T03:38:28.457+00:00

Please i will appreciate any help and guide.

Thank you
MotoX80 37,151 Reputation points

2021-03-31T13:24:07.32+00:00

What snap-in (or WMI query) are you really trying to block? Since the Domain User does not have administrator rights, they will not be able to make any changes that the Domain Admin would be able to make. The user is already limited as to what they can do.

Will the Domain User access network shares or web sites on Server A?

Are all 3 machines on the same or different subnets? (Can you block access by IP address?)
segun abefe 21 Reputation points

2021-03-31T14:04:44.607+00:00

This is what i want to achieve:
Scenario

1.On server A, Domain admin disable Services snap-ins under Restricted/Permitted snap-ins
2. On server A, Domain admin launch mmc console and could not access Services snap-ins because it is disabled
3. Domain user login to a workstation on the same network and same domain as server A
4. Domain user launch mmc console on the workstation, select server A as the computer to manage and select Services as the snap-ins to manage on server A
5, Domain user was able to launch Services snap-ins on server A remotely and was able modify Services snap-in on server A (despite that it is restricted and disabled on server A)

If I restrict a snap-in on server A and anyone that login to server A locally is restricted from using that snap-in on server. I also want the restriction to affect anyone that is using mmc console to remotely connect to server A not to be able to use a restricted snap-ins on the server A.

Thank you
MotoX80 37,151 Reputation points

2021-03-31T14:24:16.44+00:00

Domain user was able to launch Services snap-ins on server A remotely and was able modify Services snap-in on server A (despite that it is restricted and disabled on server A)

From my understanding, Server A is does not see a remote snap-in. It sees an RPC/DCOM/WMI call to query services.

I would suggest that you NOT focus on snap-in's. Instead focus on the functionality that you wish to prevent. Even if you could block the snap-in, the user could probably use a Powershell command or WMIC call to query the resource.

What functionality are you trying to block? Enumerating the names of services on Server A?
segun abefe 21 Reputation points

2021-04-01T01:45:40.88+00:00

All the systems are on same subnet. I want to block snap-ins like services, disk management, device management and bunch of them
MotoX80 37,151 Reputation points

2021-04-01T12:29:38.563+00:00

Since the user does not have Administrator authority on the server, most of the snapin's are not going to function anyway.

I ran compmgmt.msc with a standard user and connected to a test VM that I have. Win10 to Win10.

Nothing worked. About the only thing that I could see was the names of the event logs. I could not read any events.

But your server might be configured differently. Have you tested access from a client? You may be trying to fix a problem that you don't have.

Answer 1

MotoX80 37,151

One way to stop MMC is to define a firewall rule that blocks all outbound connections on non-admin desktops.

As I noted in prior post, this will not stop the user from executing a Powershell command to query remote resources that they have access to.

And if the user has admin access on their own desktop, they can just temporarily turn off the firewall to bypass that rule. So you would need to lock down the desktop further with Active Directory group policy.

segun abefe 21 Reputation points

2021-04-02T01:05:35.407+00:00

This approach will work

Thank you

Answer 2

Hi,
Please refer to the information in the link below:
Restrict remote mmc
https://stackoverflow.com/questions/22485479/restrict-windows-server-2008-r2-remote-mmc
You may could disable the setting Restrict users to the explicitly permitted list of snap-ins in GPO.
If you disable this setting, all snap-ins are permitted. Then you could disable the snap-in which you want to disable under the path User Configuration/Administrative Templates/Windows Components/Microsoft Management Console.
Hope this helps and please help to accept as Answer if the response is useful.
Best Regards,
Carl

Share via

Restrict Remote MMC

1 additional answer

Your answer