locked
Adding network printers in Windows 7 fails as domain user RRS feed

  • Question

  • I have an issue with Windows 7, as a domain user when they try to add a network printer it all goes to plan until it pops up with UAC asking for an admin username and password.
    We run Server 2003 and I have tried allowing users to load and unload driver via GPO, this doesnt help, so its down to UAC, to me this is a  major issue, end users should be allowed to add networked printers without admin assistance, it worked fine under XP. the alternative is to turn off UAC so what benifir is there to having UAC at all.

    Can someone advise a work around to this so UAC for the most part is still operational but allow the addition of network printers by a dom ain user to be allowed.

    What version of AD Server allows you to alter UAC settings via GPO is there an update for GPMC for server 2003
    THat allows control over UAC?
    Wednesday, November 25, 2009 8:47 AM

Answers

  • Hi PSSROV, I'm not 100% sure without seeing the prompt you are getting but it sounds like the point and print restrictions to me.

    Take a look in local or group policy under computer config -> Admin Templates -> Printers and set "Point and Print Restrictions" to "Enabled" and set the the 2 settings to "Do not show warning or elevation prompt".

    Does this help?
    • Edited by Rob.Ford Wednesday, November 25, 2009 6:54 PM oops
    • Marked as answer by Dale Qiao Wednesday, December 2, 2009 1:45 AM
    Wednesday, November 25, 2009 6:53 PM
  • Hi,

    Please make sure that the client users are allowed to connect to Windows Server, you may need to modify the Point and Print Restrictions setting  and permit users to connect only to specific print servers that you trust. To do this, please refer to the following document:

    Control Printer Driver Installation Security

    Best Regards
    Dale
    • Marked as answer by Dale Qiao Wednesday, December 2, 2009 1:45 AM
    Friday, November 27, 2009 7:11 AM

All replies

  • Hi PSSROV, I'm not 100% sure without seeing the prompt you are getting but it sounds like the point and print restrictions to me.

    Take a look in local or group policy under computer config -> Admin Templates -> Printers and set "Point and Print Restrictions" to "Enabled" and set the the 2 settings to "Do not show warning or elevation prompt".

    Does this help?
    • Edited by Rob.Ford Wednesday, November 25, 2009 6:54 PM oops
    • Marked as answer by Dale Qiao Wednesday, December 2, 2009 1:45 AM
    Wednesday, November 25, 2009 6:53 PM
  • Hi,

    Please make sure that the client users are allowed to connect to Windows Server, you may need to modify the Point and Print Restrictions setting  and permit users to connect only to specific print servers that you trust. To do this, please refer to the following document:

    Control Printer Driver Installation Security

    Best Regards
    Dale
    • Marked as answer by Dale Qiao Wednesday, December 2, 2009 1:45 AM
    Friday, November 27, 2009 7:11 AM
  • Hi Rob,

    The settings you refer to as not available under server 2003, I have found the seeting under the user section as posted by Dale, finding so far are

    I am getting somewhere and nowhere at the same time. Two things are getting in the way UAC and permissions on two fronts!!

    Some help was found at this link http://social.technet.microsoft.com/Forums/en/w7itprosecurity/thread/adebbc69-4623-4a96-a84a-d4c324e326c0

      the following was tested as a domain user, a user with admin rights can install the printer from either the 2003 or 2008 server.

    1.     Use link suggestion, UAC as default, go through process to printer shared from 2003 server= Prompt for username and password (UAC)-failed.

    2.     Use Link suggestion, Turn off UAC, go through process to printer shared from 2003 server= Access denied prompt-failed

    3.     Use Link suggestion, Turn off UAC, go through process to printer shared from 2008 server= Success

    Friday, December 11, 2009 2:56 PM
  • HI PSSROV, our print server is 2003 based, too. We have UAC off and the 2 print settings I mentioned set in local Windows 7 policy and I'm not seeing prompts and printing is working ok. Once we migrate our AD to 2008 R2, I'll start using group policy for this but for now I just copied the local policy as part of the image process.

    Edit: I think what I meant to type over 2 years ago was "Now, if I can just stop Windows 7 from not letting me RDP to my local subnet servers...".
    • Edited by Rob.Ford Wednesday, May 2, 2012 7:10 PM
    Saturday, December 12, 2009 8:21 PM
  • Our scenario is a bit unique, installing printer drivers (both network and local) is not an issue but we need users to be able to share out their printers locally for their Citrix sessions.  The only way I found to be effective with regards to circumventing UAC for non-administrative users is to go to Devices and Printers --> Print Server Properties (highlight a printer) and grant Everyone local group permission to Print, Manage Printers, Manage Documents, View Server and Manager Server.  As this is a universal requirements, we made the change from within the thin image.  By granting users print server rights I would imagine it will fix alot of other print driver issues as well.

    Wednesday, May 2, 2012 7:02 PM