Active Directory User/Machine MMC

I serve a school. I want to be able to allow teachrs to log on to a a workstation and reset the password of kids in their class. I would like the MMC to be part of heir start Menu.Each time I create a MMC and delegate the password reset right to a teacher, the snap in only works from the server where I created it and when I save the snap-in in the “redirected folder”, log on to a workstation as a member of staff and run it, it tells me a policy restricts me from running this snap-in. What policy restriction do I need to lift. Please help.