By default, non-admin users do not have permission to install the printer drivers on their computers. To install a driver, the user should have local admin privileges (must be a member of the local Administrators group). This security feature helps prevent Windows from installing incorrect or fake device drivers that could compromise computer or slow system performance. However, this is extremely inconvenient as it requires the IT support team to get involved every time a user wants to install a new driver.
You can allow non-administrator users to install printer drivers on their Windows computers (without granting local administrator rights) by using Active Directory Group Policies.
Table of Contents
Windows users can themselves connect to a shared network printer published on a print server. To do this, open the list of printers on the print server (Win+R > \\YourPrintServerName), right-click on the printer you want to use and click Connect.
If a driver for a particular printer is installed in the Driver Store on your computer, that printer will be added to your session. If the driver is missing, the UAC “Printer driver software installation” window will appear, and you will be asked to enter the administrator password to install the driver.
Enable Point and Print Restrictions Policy with GPO
The Point and Print Restrictions policy allows you to specify trusted print servers from which users can download and install drivers without UAC elevation.
- Open the AD Group Policy Management console (gpmc.msc), right-click the Active Directory OU (AD container) containing the computers to which you want to apply the policy, and create a new GPO;
- Edit your GPO;
- Go to Computer Configuration > Policies > Administrative Templates > Printers;
- Enable the policy Point and Print Restrictions;
- Check the option Users can only point and print to these servers. Enter the names (FQDNs) of the trusted print servers, separated by semicolons;
- For the last two options, select Do not show warning or elevation prompt;
Save your changes and edit the Package Point and print – Approved servers policy.
- Change the policy state to Enabled;
- Click the Show and add your trusted print server FQDNs.
Printers deployed using the GPO are automatically installed on user computers after the Print Restrictions policy is applied to them (requires restart). Windows automatically downloads and installs printer drivers from trusted print servers.
This policy also allows the non-admin user to manually install any signed package-aware drivers from a trusted print server.
However, if you try to install the unpackaged printer driver, you will see the “Do you trust this printer?” warning will appear with the Install driver UAC button, which requires the printer driver to be installed under the admin account.
If UAC is disabled, Windows displays an error when you try to install the printer as a non-admin user “Windows cannot connect to the printer. Access is denied“.
Use Package-aware Print Drivers on Print Server
Non-admin users can only manually install a printer driver from a print server that meets the following requirements:
- The driver must be signed with a trusted digital signature;
- The driver must be packaged (Package-aware v3print drivers). Non-admin users cannot install unpacked (non-package-aware) drivers via Point and Print Restrictions policy.
You can check your driver type on the print server. Open the Print Management snap-in and go to Print Servers > Server Name > Drivers. For package-aware print drivers, you can see the True value in the Packaged column.
Microsoft recommends you using only packaged print drivers on print servers.
For some older printer models, only non-package aware drivers are available and you will need to use an additional workaround to enable the installation of such drivers.
Using Point and Print Policy After PrinNightmare Fixe
Microsoft patches (released in August 2021) block non-admins from installing unsigned non-packaged print drivers. This change addresses the PrintNightmare vulnerability and is related to Windows Print Spooler security issues.
You can work around the new requirements by disabling the GPO option Limit print driver installation to Administrator under Computer Configuration > Administrative Templates > Printers (should be used rarely due to security risks).
If this option is missing in the GPO console, you will need to update the administrative template (ADMX) files on the Active Directory domain controller, or you can enable this setting through the registry.
Limit print driver installation to Administrator policy sets the RestrictDriverInstallationToAdministrators registry entry under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\ to 0.
You can deploy this registry parameter to computers through Group Policy
Create a new registry parameter under the GPO section Computer Configuration > Preferences > Windows Settings > Registry.
- Action: Replace
- Hive: HKEY_LOCAL_MACHINE
- Key path: Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
- Value name: RestrictDriverInstallationToAdministrators
- Value type: REG_DWORD
- Value data: 0
Once this option is set, your users will be able to connect shared network printers and install print drivers from trusted print servers.
Important note! However, be very careful about using a value of zero (0) for the RestrictDriverInstallationToAdministrators parameter, as this will make your Windows vulnerable. We recommend that you set this option temporarily while you allow users to install the printer. It is desirable to return this registry key to its default value of one (1) after the printer has been installed.
20 comments
Thank you a lot, guy!
In our environment, we only have like 3 models of printers, used by 1,000 users.
Would it just make sense to push out drivers for these few model printers to *everyone*, then users can point-and-print to add a printer, but since the *driver* would have been pre-loaded, they won’t get a UAC print?
If so, suggestions on how?
This seems like the best of both worlds – security (only our trusted drivers) + convenience (users can pick which printers they need and install them on their own, without UAC)
I agree that pushing out all of the drivers first would be ideal, but I am not sure how to best do that.
Great article. Thank you for helping me years later. Did not know about Package-aware print drivers.
Hello,
Does this still work with the new the August Patch release for windows 10?
Thanks,
Aj
I was hoping your article would help with August 10, 2021—KB5005033, but it doesn’t. My users can’t install print drivers without admin credentials.
Same here. Is there any solution for this?
we had the same problem and turns out adjusting the printer driver from false to true in the Packaged column solved the issue for us.
Those who do want to make the registry change can open a Command Prompt window with elevated permissions and enter the following:
reg add “HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint” /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 0 /f
For those of us stuck after CVE-2021-34481 — has anyone tried following MS’s instructions? They didn’t work for me. I’m still stuck going around to every computer and manually downloading drivers.
https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872
I have tried the Registry Edit and it works but no amount of farting around with the different registry policies worked. Maybe I’m missing the correct ADMX but I just couldn’t get it to go. In the end I made a “create” registry in group policy and pushed that out.
HKEY_LOCAL_MACHINE
SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
RestrictDriverInstallationToAdministrators
REG_DWORD
00000000
Hexadecimal
What is the difference between the following two methods?
– setting it via the group policy `Microsoft Endpoint > Administrative Template > Printers > Point and Print Restrictions`
– setting the registry value for `RestrictDriverInstallationToAdministrators` manually
Because we have rolled out it to all compuers in the tenant and we noticed that it worked for some devices in combination with some printers and it didn’t work for other devices which were using a different printer.
out of all the fixes mentioned, only the last one states it will circumvent the security for the Printnightmare issue. Will all the fixes above compromise the clients as well or is it just the “RestrictDriverInstallationToAdministrators” DWORD change that gives exposure?
The “Do not show warning or elevation prompt” is not an option in my GPO. I only have “Show warning only” and “Show warning and elevation prompt”. I have updated my ADMX files.
Since I do not want the warning, am I obligated to use the reg key to change RestrictDriverInstallationToAdministrators to 0 ?
This worked for me. Here is my situation. We have some unsigned print drivers due to modifying with the canon driver modification utility. Had they not been modified, i would have just pushed them out. But scripting unsigned drivers doesn’t seem to work. So i got this to work with 1) The restrictdriverinstallationtoadministrators to 0, 2) restrict point and print to my print servers, 3) restrict package point and print to my print servers, and 4) disabling the security option to prevent users from installing print drivers, and finally 5) adding those driver classes as described.
Did all of this and still having issues deploying shared printers with GPO.
After all this getting nothing but 0x800704ec errors in event viewer after updating the GPO on the client machine.
As of 5-3-2022 no go; prompting “do you trust” and then asking for admin creds…regardless of GPO and verified regedit keys as explained…
Hi, good article!
Only with this reg add command via GPO (Computer side), i think to solve:
Action: Replace
Hive: HKEY_LOCAL_MACHINE
Key path: Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
Value name: RestrictDriverInstallationToAdministrators
Value type: REG_DWORD
Value data: 0
BUT, now i updated a printer driver on print server and user cannot instal driver update because they are prompted to use user with admin rights.
There is a solution? User can install printer if they never logged in on pc, if they have a previous login on pc, when try to print, they are prompted to update driver with admin rights.
thanks
The solution is works for us but printer restriction is not working properly. Users can install the printer from the printer server which is not defined in restriction settings.
Please advise.
Thanks muchly.
Helped me solve print sharing this morning as a matter of urgency.
Only issue is there are so many steps to follow. I had to repeat the steps 3 times for 3 different printers, despite them all being Canon MFC’s and using the same driver. I was creating the GPO’s from the Printer Management console and did not see a way to select multiple printers. I’m mainly a Linux admin so I could have missed something somewhere – be gentle.!
Cheers,
ak.