How to Completely Disable ‘Device Manager’ (devmgmt.msc) via Group Policy in Windows 11

The Device Manager (devmgmt.msc) is a critical administrative MMC snap-in in Windows 11 that allows users to view, configure, update, or uninstall hardware drivers. While essential for IT professionals troubleshooting hardware faults, granting standard users or malicious actors access to the Device Manager is highly dangerous. A user could accidentally disable the network adapter, uninstall the display driver (resulting in a black screen), or forcibly install a malicious, unsigned driver to execute kernel-level code. In a strictly managed enterprise environment, a kiosk deployment, or a shared workstation, access to hardware configuration must be absolutely forbidden.

This guide explains how to completely disable access to the Device Manager system-wide using the Group Policy Editor in Windows 11, ensuring the hardware abstraction layer remains untouched.

Disable Device Manager via Group Policy

To enforce a strict block that prevents the execution of the Device Manager MMC snap-in, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   User Configuration > Administrative Templates > Windows Components > Microsoft Management Console > Restricted/Permitted snap-ins

5. In the right-hand pane, scroll down to locate the policy named Device Manager.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled. (Note: In the context of MMC snap-in policies, “Disabled” explicitly denies access to the snap-in).
8. Click Apply, then click OK.

Verify the Security Lockdown

To enforce the change immediately across the system, open an elevated Command Prompt and execute gpupdate /force. Note that because this is a User Configuration policy, it applies to the user sessions on that machine.

To verify the restriction is active, press the Windows key, type “Device Manager” and press Enter, or press Win+R and execute devmgmt.msc. Instead of launching the hardware tree, the system will immediately throw a critical error dialog stating: “The snap-in below, referenced in this document, has been restricted by policy. Contact your administrator for details.” The workstation’s hardware configuration is now completely shielded from user tampering.