You can control access either entirely or granuarly to mmc snapins in user
configuration/administrative templates/Windows components/Microsoft
Management Console/restricted and permitted snapins. Note that under
administrative templates you can do a lot more locking down in categories
such as desktop and start menu. By default a Group Policy applied will
affect all users in the "scope of influence" so if you do not want
restrictions to apply to domain administrators either put the users or
admins in their own OU [OU's by default inherit defined settings if no OU
policy is configured] or filter the GPO so that administrators have deny
permissions to apply permission. See the link below for more details. ---
Steve
