Windows Server 2012 MMC Administration (part 1) - Using the MMC - MMC snap-ins, MMC modes

THE Microsoft Management Console (MMC), and the prepackaged administration tools that use it, help you more readily manage computers, users, and other aspects of the network environment. Not only does the MMC simplify administration, it also helps to integrate the many disparate tools in the Windows operating system.

The advantages of having a unified interface are significant because after you learn the structure of one MMC tool, you can apply what you’ve learned to all the other MMC tools. Equally significant is the capability to build your own consoles and customize existing consoles. You can, in fact, combine administrative components to build your own console configuration and then store this console for future use. You would then have quick access to the tools you use the most through a single console.

1. Using the MMC

The MMC is a framework for management applications that offers a unified interface for administration. It is not designed to replace management applications; rather, it is designed to be their central interface. As such, the MMC doesn’t have any inherent management functions. It uses add-in components, called snap-ins, to provide the necessary administrative functionality.

Keep in mind that the MMC isn’t a one-size-fits-all approach to administration. Some administrative functions aren’t implemented for use with the MMC. You configure many system and operating system properties using Control Panel utilities. Many other system and administrative functions are accessed using wizards. Most administrative tools, regardless of type, have command-line counterparts that run as separate executables from the command line.

The really good news, however, is that you can integrate all non-MMC tools and even command-line utilities into a custom console by creating links to them. In this way, your custom console remains the central interface for administration, and you can use it to access quickly any type of tool with which you routinely work.

For selected snap-ins, the MMC supports the following capabilities:

• Multiple-item selecting and editing These features allow you to select multiple objects and perform the same operations on them, including editing.

• Drag-and-drop functionality This allows you to perform such tasks as dragging a user, computer, or group from one organizational unit (OU) to another in Active Directory Users And Computers.

For the Active Directory Users And Computers snap-in, you can do the following:

• Reset access permissions to the default values for objects, show the effective permission for an object, and show the parent of an inherited permission.

• Save Active Directory queries, and reuse them so that you can easily perform common or complex queries.

MMC 3.0 is designed to support snap-ins created for MMC 2.0 and MMC 1.2. You can add these snap-ins to an MMC 3.0 console, and they will run as they do in the versions of MMC for which they were designed. You can use MMC 3.0 to open a console created using MMC 2.0 or 1.2. If you then save the console, you will be prompted to save the console in MMC 3.0 format. Doing so will update the console so that it uses the MMC 3.0 framework. However, you will not be able to open the console on computers running previous versions of MMC. The reason for this is that MMC 2.0 and 1.2 do not support MMC 3.0 snap-ins or consoles.

MMC snap-ins

To take advantage of what the MMC framework has to offer, you add any of the available standalone snap-ins to a console. A console is simply a container for snap-ins that uses the MMC framework. Dozens of preconfigured snap-ins are available from Microsoft, and they provide the functionality necessary for administration. Third-party tools from independent software vendors now use MMC snap-ins as well.

Note

The terms console and tool are often used interchangeably. For example, in the text, I often refer to something as a tool when technically it is a preconfigured console containing a snap-in. For example, Active Directory Users And Computers is a tool for managing users, groups, and computers. Not all tools are consoles, however. The System tool in Control Panel is a tool for managing system properties, but it is not a console.

Although you can load multiple snap-ins into a single console, most of the preconfigured consoles have only a single snap-in. For example, most of the tools on the Tools menu in Server Manager consist of a preconfigured console with a single snap-in—even the Computer Management tool, as shown in Figure 1, consists of a preconfigured console with the Computer Management snap-in added to it.

Figure 1. A preconfigured console with a snap-in added to it.

The many features of the Computer Management snap-in are good examples of how snap-ins can have nodes and extension components. A node defines a level within the console or within a snap-in. Computer Management has a root node, which is labeled Computer Management, and three top-level nodes, which are labeled System Tools, Storage, and Services And Applications. An extension component is a type of snap-in that is used to extend the functionality of an existing snap-in. Computer Management has many extensions. In fact, each entry under the top-level nodes is an extension—and many of these extensions can themselves have extensions.

These particular extensions are also implemented as standalone snap-ins, and when you use them in your own console, they add the same functionality as they do in the precon-figured administration tools. You’ll find that many extensions are implemented as both extensions and standalone snap-ins. Many doesn’t mean all: Some extensions are meant only to add functionality to an existing snap-in, and they are not also implemented as standalone snap-ins.

Keep in mind extensions are optional and can be included or excluded from a snap-in by changing options within the console when you are authoring it. For example, if you didn’t want someone to be able to use Disk Management from within Computer Management, you could edit the extension options for Computer Management on that user’s computer to remove the entry for Disk Management. The user would then be unable to manage disks from within Computer Management. The user would still, however, be able to manage disks using other tools.

MMC modes

An MMC has two operating modes: author mode and user mode. In author mode, you can create and modify a console’s design by adding or removing snap-ins and setting console options. In user mode, the console design is frozen, and you cannot change it. By default, the prepackaged console tools for administration open in user mode, and this is why you are unable to make changes to these console tools.

When you open a console that is in author mode, you have additional options on the File menu that help you design the interface. You can use these options to create new consoles, open existing consoles, save the current console, add or remove snap-ins, and set console options. In contrast, when you are working with one of the preconfigured console tools or any other tool in user mode, you have a limited File menu. With user mode, you can access a limited set of console options or exit the console—that’s it.

In author mode, you also have a Favorites menu, which you can use to add and organize favorites. The Favorites menu does not appear in user mode.

When you are finished designing a console tool, you should change to user mode. Console tools should be run in user mode, and author mode should be used only for configuring console tools. Three user-mode levels are defined:

• User mode—full access Users can access all window-management commands in the MMC but can’t add or remove snap-ins or change console properties.

• User mode—limited access, multiple window Users can access only the areas of the console tree that were visible when the console was saved. Users can create new windows but cannot close existing windows.

• User mode—limited access, single window Users can access only the areas of the console tree that were visible when the console was saved and are prevented from opening new windows.

A console’s mode is stored when you save the console and is applied when you open the console. In author mode, you can change the console mode by using the Options dialog box, which you display by selecting Options from the File menu. You cannot change the mode when a console is running in user mode. That doesn’t mean you can’t change back to author mode, however, and then make further changes as necessary.

To open any existing console tool in author mode, press and hold or right-click the tool’s icon and choose Author. This works for the preconfigured administration tools as well. Simply navigate to the %SystemRoot%\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools folder, press and hold or right-click the related shortcut, and then choose Author. You will then have full design control over the console, but remember that if you make changes, you probably don’t want to overwrite the existing .msc file for the console. So, instead of choosing Save from the File menu after you make changes, choose Save As, and save the console with a different name. 

Group Policy settings control authoring and snap-in availability

Remember that at any time, a user with appropriate permissions can enter author mode by pressing and holding or right-clicking the console’s shortcut and selecting Author, or by running the console tool from the command line with the /A switch. In author mode, users could change the configuration of the tool. One way to prevent this is to restrict authoring in Group Policy.

You can restrict all authoring by users at the local machine, OU, or domain level by enabling the Restrict The User From Entering Author Mode policy setting in User Configuration\Administrative Templates\Windows Components\Microsoft Management Console within Group Policy.

You can set specific restricted and permitted snap-ins and extensions as well. One way to do this is first to prohibit the use of all snap-ins by enabling the Restrict Users To The Explicitly Permitted List Of Snap-Ins policy setting in User Configuration\Administrative Templates\Windows Components\Microsoft Management Console within Group Policy. Then specifically enable the snap-ins and extensions that are permitted using the additional policy settings in the same location. All other snap-ins and extensions would then be prohibited.

Alternatively, you can disable Restrict Users To The Explicitly Permitted List Of Snap-Ins and then explicitly prohibit snap-ins by disabling them using the policy settings under User Configuration\Administrative Templates\Windows Components\Microsoft Management Console within Group Policy. All other snap-ins and extensions would then be permitted.