Allow users to install local printers

Does anyone know of a group policy or method of allowing Users group to install local printers?

The grouppolicy to allow installing of print drivers is already enabled.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

Webmaster

By default only members of the local Administrators group can install local printers. If you assign the user right "Load and unload device drivers" to the Power Users group, members of that group can also install local printers. I don't know of any group policy setting or other method to override this and allow regular use to install a printer.

mynameisboring

Thanks I'll give it a try, but its the "Users" group that I'm concerned about and not the "Power Users".

Jerz

mynameisboring wrote:

The grouppolicy to allow installing of print drivers is already enabled.

hmm...do you mean the"Devices: Prevent users from installing printer drivers" policy is enabled? If so shouldn't it be disabled?

"Devices: Prevent users from installing printer driversComputer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Description
For a computer to print to a network printer, the driver for that network printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of adding a network printer. If this setting is enabled, only Administrators and Power Users can install a printer driver as part of adding a network printer. If this setting is disabled, any user can install a printer driver as part of adding a network printer. This setting can be used to prevent unprivileged users from downloading and installing an untrusted printer driver.

Default:

Enabled on servers.
Disabled on workstations.
Notes

If an administrator has configured a trusted path for downloading drivers, this setting has no impact. When trusted paths are used, the print subsystem attempts to use the trusted path to download the driver. If the trusted path download succeeds, the driver is installed on behalf of any user. If the trusted path download fails, the driver is not installed and the network printer cannot be added.
If this setting is enabled, but the driver for a network printer already exists on the local machine, users can still add the network printer.
This setting does not affect the ability to add a local printer.
For more information, see:

Security Configuration Manager Tools"

Webmaster

It seems Mynameisboring wants users to be able to install local printers, and as you quoted yourself: "This setting does not affect the ability to add a local printer."

Adding a local printer is not just installing a printer driver, but adding hardware, which is typically something only Administrators can do. For a non-administrator to be able to add a local printer, the user needs to be a member of the Power Users group and have the right to load and unload device drivers. Although I don't know of or think there is a way around this, it wouldn't suprise me if there's some trick or work around that would allow regular users to install local printers as I can imagine there are situation you don't want users to be admins power users 'just' to install a local printer. Though it is one of the primary reasons remote users are given admin or power user permissions on their notebooks, so they can install a local printer when they are at a client for example.

Keep us posted if you do find a way.

Jerz

Ooops...my bad. I've looked and can't find anything just what you already said "To install local printer drivers, you must be a member of the Power User or Administrator group and have permission to Load and unload device drivers."

Webmaster

No bad, and you gave me a good idea for a practice question