none
Allowing Vista Standard Users to install printer drivers

    Question

  • We are using Group Policy to deploy printers to our users which is working great, except on Vista. We have one Vista user so far so it's not such a big deal, but when they try to use a printer that has been deployed to them for the first time they are prompted for credentials to install the printer driver. I know ther is a GPO that I can add hardware ID types and Hardware classes to, but where do i find the ID type or the Class for a network printer? Physically installed printers put that info in the Device Manager but not ones using TCPIP ports. Thanks in advance Smile

    Friday, November 23, 2007 5:03 PM

Answers

  • Hello,

     

    Thanks for your post!

     

    The class ID related to printers are:

     

    {49ce6ac8-6f86-11d2-ble5-0080c72e74a2}

    {4d36e979-e325-11ce-bfc1-08002be10318}

    {4658ee7e-f050-11d1-b6bd-00c04fa372a7}

    {4d36e97a-e325-11ce-bfc1-08002be10318}

     

    You can add these IDs into the following policy in Windows Vista PC (include the brackets):

     

    Local Computer Policy – Computer Configuration – Administrative Templates – System – Driver Installation – Allow non-Administrators to install drivers for these device setup classes.

     

    Restart the Windows Vista-based PC and check the issue again.

     

    For more information about the hardware class ID, please refer to:

     

    System-Supplied Device Setup Classes

    http://msdn2.microsoft.com/en-us/library/ms791134.aspx

     

    For the group policy object:

     

    Allow Standard Users to Install Drivers For Devices from Specified Setup Classes

    http://technet2.microsoft.com/windowsserver2008/en/library/0572688f-5860-4728-be1e-ebaaab00da0e1033.mspx?mfr=true

     

    If the problem still persists or you have extra questions about this issue, please let me know. I’m happy to be of further assistance.

     

    Regards,

    Lionel Chen

    Microsoft Online Community Support

     

    Wednesday, November 28, 2007 6:31 AM

All replies

  • Hello,

     

    Thanks for your post!

     

    The class ID related to printers are:

     

    {49ce6ac8-6f86-11d2-ble5-0080c72e74a2}

    {4d36e979-e325-11ce-bfc1-08002be10318}

    {4658ee7e-f050-11d1-b6bd-00c04fa372a7}

    {4d36e97a-e325-11ce-bfc1-08002be10318}

     

    You can add these IDs into the following policy in Windows Vista PC (include the brackets):

     

    Local Computer Policy – Computer Configuration – Administrative Templates – System – Driver Installation – Allow non-Administrators to install drivers for these device setup classes.

     

    Restart the Windows Vista-based PC and check the issue again.

     

    For more information about the hardware class ID, please refer to:

     

    System-Supplied Device Setup Classes

    http://msdn2.microsoft.com/en-us/library/ms791134.aspx

     

    For the group policy object:

     

    Allow Standard Users to Install Drivers For Devices from Specified Setup Classes

    http://technet2.microsoft.com/windowsserver2008/en/library/0572688f-5860-4728-be1e-ebaaab00da0e1033.mspx?mfr=true

     

    If the problem still persists or you have extra questions about this issue, please let me know. I’m happy to be of further assistance.

     

    Regards,

    Lionel Chen

    Microsoft Online Community Support

     

    Wednesday, November 28, 2007 6:31 AM
  • Can you tell me all of the class ID's I would need to put in the exception list to allow a user to install an all-in-one device?  Specifically I am trying to test on a HP Deskjet f4140.  I have been through the list of device setup classes, allowed every single one of them that I could think plausible, and I still get prompted for the admin user/password when I try to install the driver on a machine with user access.

     

    Thanks

     

    Saturday, December 08, 2007 12:30 AM
  • Hello Sam,

     

    Thanks for your post!

     

    For all the class ID of devices, please refer to the following page:

     

    System-Supplied Device Setup Classes

    http://msdn2.microsoft.com/en-us/library/ms791134.aspx

     

    Please note, this local policy is only applies to INF-based driver. For installing EXE-based driver package, the administrator privilege may be needed still. Please try to extract the EXE-based driver package into a folder first, make sure the extracted folder contains the INF-based file (file type: setup information) then try to add the driver in printer with standard user account.

     

    Note: You may also double-click the INF file to see the content, the class ID of corresponding device is written in the first few lines.

     

    If it passes the test, you may deploy the configuration as the next step.

     

    For more information about the configuration, please refer to:

     

    Allow Standard Users to Install Drivers For Devices from Specified Setup Classes

    http://technet2.microsoft.com/windowsserver2008/en/library/0572688f-5860-4728-be1e-ebaaab00da0e1033.mspx?mfr=true

     

    Hope it help!

     

    Regards,

    Lionel Chen

    Microsoft Online Community Support

    Monday, December 10, 2007 2:52 AM
  •  

    Thanks for the Reply, but I'm still having trouble.

     

    I went as far as plugging the printer into another vista machine, installing it, and making sure all of the devices it installed were in my list of approved on the Group Policy, but the vista workstation I am testing on is still prompting for an admin user to install a driver from a particular .inf.  The .inf it is using is also one I have copied the device class from and put into the group policy allow... Furthermore, I am allowing device driver installations in two places in the group policy.  Under admin templates/system/driverinstllation/allow non-admins to install drivers for these device setup classes and admin templates\system\device installation\device installation restrictions\allow installation of devices using drivers...

     

    I am basically trying to shotgun this, because nothing microsoft has posted seems to actually work.  I have gone through the entire group policy and allowed installation of printers and drivers etc, and it still isn't working.  Is it really this complicated?

     

    The only other thing I could think that it's requiring an admin login for, would be the certificate for the drivers, but those require an admin to install anyway, so what is the point?

     

    sorry, I have just been working on this for a while, I heard vista allowed users to install printers, and was hoping they made it easier to deal with than this.  I understand it's a cinch if the driver is already on Vista, but that is certainly not always the case.

     

    Thanks

    Monday, December 10, 2007 9:19 PM
  • Hello Sam,

     

    Thanks for your post and test!

     

    I’d love to share my test process on this topic with you. Let’s check if some differences in steps cause the differences in result:

     

    1.    The group policy object is not configured yet. I Log on with standard user account SU01.

    2.    In Printers, click Add a printer, then click Add a local printer, then click Next.

    3.    Select Have Disk… , then use Browse… to navigate to the INF-based driver, double-click it and select the model.

    (In my test, I use Kyocera Mita KM-1650 KX, because it doesn’t have in-box driver. I download the driver for Windows Vista from official website.)

    4.    UAC prompt appears.

    5.    I switch to administrator account AU01, run gpedit.msc.

    6.    In Group Policy Object Editor, locate to Allow non-administrators to install drivers for these device setup classes, double-click it.

    7.    Select Enable, click Show…, then click Add…, enter the class ID {4D36E979-E325-11CE-BFC1-08002BE10318}. (brackets included.) Click OK, OK, then close the editor.

    8.    Switch to SU01, repeat the steps 1-3.

    9.    The installation is finished without UAC prompt.

    10. In Command Prompt, type pnputil –e, then find the driver of Kyocera Mita KM-1650 KX has been added into Driver Store as a 3rd party driver package. (If the driver package is added into Driver Store, stand users can install the driver without need to use the group policy.)

    If I misunderstood anything about your post or you have anything unclear on this topic, please let me know.

    Thanks again for your suggestions and patience, we always try our best to help customers. However, please understand that in some cases the issue may be complex and we need time to collect information, narrow down problem’s scope and then find a solution which may make the troubleshooting process time-consuming. We never give up assistance for customers and always do our best to address the issues. Your understanding is greatly appreciated.

     

    Regards,

    Lionel Chen

    Microsoft Online Community Support

     

    Tuesday, December 11, 2007 3:59 AM
  • Hi Lionel,

     

    Thanks again for your assistance with this.  It's nice to be able to step through it with the list you provided above.  I believe I have a better understanding of where we are seeing differences.

     

    If I follow the steps you list above, then I can install the new printer driver without any problems, which is great.  What I have been doing, however, is plugging the printer in and using the "found new hardware" popup.

     

    Step 1:  Select "I don't have a disk.  Show me other options"

    Step 2:  Select "browse my computer for driver software"

    Step 3:  Select the folder with the drivers

     

     

    This is the point that I get a UAC prompt for the very .inf file that I can install as a user via the add printer wizard. 

     

    The main reason I was trying to do it this way is because I wanted to simulate what our reps would be doing with their laptops/printers out in the field.  Do you know if there's a way to allow the installation of drivers through the hardware wizard, or can you test with your printer and see if you have the same problem I do? 

     

     

     

    Tuesday, December 11, 2007 5:56 PM
  • Hello Lionel,

    I trying to install a shared print on the server, but when i browser the printer on server the still ask me the administrator rights.

    Network Printers uses diferent classes ids ??

    I looked in .inf of the printer driver and the classe id is one of there four.

    Tuesday, April 27, 2010 9:11 PM
  • Hello Lionel,

    I trying to install a shared print on the server, but when i browser the printer on server the still ask me the administrator rights.

    Network Printers uses diferent classes ids ??

    I looked in .inf of the printer driver and the classe id is one of there four.


    Can anyone solve it?
    Friday, June 11, 2010 6:50 AM