You can use Group Policy to [1] restrict users' ability to Enter author
mode, and [2] only allow users access to the specific snap-ins that you've
authorized.
User Configuration\Administrative Templates\Windows Components\Microsoft
Management Console