Share via

Change driver installation security for printers deployed using Group Policy

  • Article

Applies To: Windows Server 2008

The default security settings for Windows Vista and Windows Server 2008 allow a user who is not a member of the local Administrators group to install only trustworthy printer drivers, such as those provided with Windows operating systems or in digitally signed printer-driver packages.

To allow users who are not members of the local Administrators group to install printer connections that are deployed using Group Policy and include printer drivers that are not digitally signed, you must configure the Point and Print Restrictions Group Policy settings. If you do not configure these Group Policy settings, users might need to provide the credentials of someone who belongs to the local Administrators group.

Note

The following procedure assumes that you are using the version of the Group Policy Management Console (GPMC) that is included with Windows Server 2008. To install GPMC on Windows Server 2008, use the Add Features Wizard in Server Manager. If you are using a different version of GPMC, the steps might vary slightly.

To change driver installation security settings for printers that are deployed by using Group Policy

  1. Open the GPMC.

  2. Open the GPO where the printer connections are deployed, and navigate to User Configuration, Policies, Administrative Templates, Control Panel, and then Printers.

  3. Right-click Point and Print Restrictions, and then click Properties.

  4. Click Enabled.

  5. Clear the following check boxes:

    • Users can only point and print to these servers

    • Users can only point and print to machines in their forest

  6. In the When installing drivers for a new connection box, select Do not show warning or elevation prompt.

  7. Scroll down, and in the When updating drivers for an existing connection box, select Show warning only.

  8. Click OK.

After configuring these settings, all users are able to receive printer connections and the drivers to their user accounts by using Group Policy, without prompts or warning. Users receive a warning before updated drivers from the print server are installed, but they do not need to belong to the local Administrators group to install the updated drivers.

Additional references

For more information about working with Group Policy: