none
How to print to Network Printers without Admin Rights Windows 7 Enterprise to 2003/2008 AD

    Question

  • Good Morning

    We are rolling out Windows 7 Enterprise to our clients and when a user tries to install a network printer they always get prompted for an administrator username and password.  We have used Windows XP for over 6 years and never had this issue. 

    I have seen suggestions on what to do such as make the user part of the local admin group on that computer.   I can tell you that will not happen.  We only need them to install network printers without having admin rights.  Live I said before, this works fine with Windows XP Professional that the same user is not part of any administrative group.

    Any help would be greatly appreciated as we are deailing with over 5000 users and 1700 clients.

    Thanks

    Wednesday, April 07, 2010 1:59 PM

Answers

  • You need to follow the steps below on one of the Windows 7 computers to edit the policy to allow standard user accounts to install hardware drivers and apply this policy to all Windows 7 clients in the domain.

    Click Start, in the Start Search box type "gpedit.msc" and press Enter. Locate to "Computer configuration"->"Driver installation"->"Allow non-administrators to install drivers for these device setup" classes, double-click it. Select Enable, click Show…, then click Add…, enter the class ID {4D36E979-E325-11CE-BFC1-08002BE10318}. (brackets included.).

    Please perform the above steps to adjust the local policy on a problematic Windows 7 computer, then run the following command to refresh the policy change:

    Gpudate /force

    After that, please check whether the previous logon script can be executed without asking for administrator credentials. If yes, it should be the root cause.

    If you want, you can deploy this setting to many client computers by using a domain based GPO (instead of the local policy). However, if you are using SBS 2003 DC, the steps will be a little special. The above "Allow non-administrators to install drivers for these device setup" policy may not available on a SBS 2003-based DC, because it is not aware of the Windows 7 policies.

    As a workaround, you can create a domain based GPO, and do not open it on the DC. Instead, go to a Windows 7 client computer, run MMC, add the Group Policy snap-in, load the newly created domain GPO, and then adjust the "Allow non-administrators to install drivers for these device setup" settings.


    Arthur Xie - MSFT
    Friday, April 09, 2010 9:36 AM
    Moderator
  • Hi,

    I agree with Arthur and to make it simpler, I think you'd be able to get this working by disabling the GPO: Devices: Prevent Users from installing  printer drivers.. It's under Computer Configuration> Window Settings->Security Settings->Local Policies->Security Options.


    ~Cheers Visit my Blog@ http://blog.helpforsure.info
    Sunday, April 25, 2010 7:31 AM

All replies

  • Im no expert but..........

    you mentioned the local admin group. I think there's a "print operators" or some other similar standard group that implies users can basically administer print jobs.. this may be the answer

     

    I am guessing that to add a printer as a local printer you would require local admin rights by default.

     

    However if the printer is installed as a local machine on one computer (print server), and appropriate share permissions are set  then users should be able to add the printer from the active directory or workgroup structure?

    I'm basing this on the fact I have access to two networks one of which adds printers direct by IP and prompts for local admin rights, and one advertises the printers in AD and does not need admin at all.

     

    though both networks use xp/2003 >.<

    Hope this provides some food for thought if nothing else :)

    Thursday, April 08, 2010 2:38 AM
  • You need to follow the steps below on one of the Windows 7 computers to edit the policy to allow standard user accounts to install hardware drivers and apply this policy to all Windows 7 clients in the domain.

    Click Start, in the Start Search box type "gpedit.msc" and press Enter. Locate to "Computer configuration"->"Driver installation"->"Allow non-administrators to install drivers for these device setup" classes, double-click it. Select Enable, click Show…, then click Add…, enter the class ID {4D36E979-E325-11CE-BFC1-08002BE10318}. (brackets included.).

    Please perform the above steps to adjust the local policy on a problematic Windows 7 computer, then run the following command to refresh the policy change:

    Gpudate /force

    After that, please check whether the previous logon script can be executed without asking for administrator credentials. If yes, it should be the root cause.

    If you want, you can deploy this setting to many client computers by using a domain based GPO (instead of the local policy). However, if you are using SBS 2003 DC, the steps will be a little special. The above "Allow non-administrators to install drivers for these device setup" policy may not available on a SBS 2003-based DC, because it is not aware of the Windows 7 policies.

    As a workaround, you can create a domain based GPO, and do not open it on the DC. Instead, go to a Windows 7 client computer, run MMC, add the Group Policy snap-in, load the newly created domain GPO, and then adjust the "Allow non-administrators to install drivers for these device setup" settings.


    Arthur Xie - MSFT
    Friday, April 09, 2010 9:36 AM
    Moderator
  • Hi,

    I agree with Arthur and to make it simpler, I think you'd be able to get this working by disabling the GPO: Devices: Prevent Users from installing  printer drivers.. It's under Computer Configuration> Window Settings->Security Settings->Local Policies->Security Options.


    ~Cheers Visit my Blog@ http://blog.helpforsure.info
    Sunday, April 25, 2010 7:31 AM
  • hello,

    I have tried both your suggestions, but it doesn't work. I have a similar environment to mhalverson.

    Any ideas what may course that it wont work? Or any other idea what may work?

     

    Thanks.

    Thursday, October 14, 2010 10:03 AM
  • Hi,

    I am just at the testing stage myself. I am deploying printers from a print server to Windows XP and 7 machines with a 2008 GPO.From what i have read up on,I need to:

    - Install the http://support.microsoft.com/kb/943729 update for my XP machines to pick up the GP Preferences.

    -Set - disabling the GPO: Devices: Prevent Users from installing  printer drivers.. It's under Computer Configuration> Window Settings->Security Settings->Local Policies->Security Options (for Windows 7 machines)

    -Add the printers i want: \\computer configuration\policies\windows setting\deployed printers to whatever OUs i need.

    is it just me, or will this work. The main issue is with Windows 7 and asking for admin right? Let me know if I am missing anything as I am starting testing tomorrow!

    M

     


    • Edited by The Futurist Wednesday, November 16, 2011 11:08 PM spelling!
    Wednesday, November 16, 2011 11:07 PM