Eng. Alessandro Mazzanti: May 2023

Server - MMC GPO Security Options errors - MMC cannot initialize the snap-in

Using MMC snapin, on windows server (in my case on 2016 version), basically managing GPOs, you might face below errors.

I get the error message stated in the subject line whenever I try to open Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> from GPO.

I found three alternatives to manage this error:

Option 1

This was broken with the September 8, 2020—KB4577015 update. currently the only solution is to uninstall it.

https://community.spiceworks.com/topic/2291581-windows-2016-mmc-snap-in-error
Then install KB4571694, reboot and try again or patch KB4580346 (I did not investigate at 100%)

https://community.spiceworks.com/topic/2291581-windows-2016-mmc-snap-in-error

https://learn.microsoft.com/en-us/answers/questions/124913/server-2016-mmc-has-detected-an-error-in-a-snap-in

Option 2

Export REG key:

reg export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit\Reg Values\MACHINE/Software/Microsoft/Windows/CurrentVersion/Policies/System/DontDisplayLockedUserId" C:\Temp\DontDisplayLockedUserId.reg
Deleting REG key

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit\Reg Values\MACHINE/Software/Microsoft/Windows/CurrentVersion/Policies/System/DontDisplayLockedUserId" /f
Change GPO
Reimport Register key
Double clicking here
C:\Temp\DontDisplayLockedUserId.reg
Original article:

https://learn.microsoft.com/en-us/answers/questions/124913/server-2016-mmc-has-detected-an-error-in-a-snap-in

Option 3

On a full patched server or PC install RSAT and solve problem in this way
https://www.alessandromazzanti.com/2019/05/windows-10-how-to-install-rsat-on.html
Server - How to Execute RSAT snapins with different users without server/client logon necessity
https://www.alessandromazzanti.com/2017/10/server-how-to-execute-rsat-snapins-with.html

REFERENCES

"The crash can be avoided by deleting the following registry key. Please make sure to export the reg key before deleting anything. Deleting the key will cause the “Interactive logon: Display user information when the session is locked” policy to not appear in the console. (The policy is still effective, but you can’t see it in the UI to edit it). You will need to import the key back later, after the fix has been released.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SecEdit\Reg Values\MACHINE/Software/Microsoft/Windows/CurrentVersion/Policies/System/DontDisplayLockedUserId"
Alternatively follow below article https://learn.microsoft.com/en-us/answers/questions/124913/server-2016-mmc-has-detected-an-error-in-a-snap-in
https://community.spiceworks.com/topic/2291581-windows-2016-mmc-snap-in-error

Tutorial - PFX to PEM certificate exporting procedure #HOW TO

If you have necessity to transform .PFX certificate to .PEM files you have to follow a specific procedure:

Consider that PFX file is a certificate, in PKCS#12 format, it contains SSL certificate (public keys) and corresponding private keys.
Be aware that a PEM file is a text file, containing one or more items, in Base64 ASCII encoding, each with plain-text headers and footers (e.g. -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----)

Here they are steps that you should take place

Install OpenSSL
https://slproweb.com/products/Win32OpenSSL.html
Copy .pfx files in same folder where OpenSSL.exe is located
First case: To convert a PFX file to a PEM file that contains both the certificate and private key:

Launch below commands:
openssl pkcs12 -in original_certificate.pfx -nocerts -out Exported_certificate_private_key-encrypted.key

(you will be prompted to insert original password and new one)

openssl pkcs12 -in original_certificate.pfx -clcerts -nokeys -out Exported_certificate_private_key-encrypted.crt
Second case: How to convert PFX file to PEM file (that contains both certificate and private key):
openssl pkcs12 -in original_certificate.pfx -out Exported_certificate.pem -nodes

(you will be prompted to insert original password and new one)