Allow Domain Clients to install local Printers (and Network Printers) without
Admin rights via Group Policy
This is a common requirement where IT administrators face the ultimate challenge. How do you lock down a
workstation but open up certain functions to make them practical? For instance, the most common requirement is to
give users the right to install Local Printers for those mobile workforce (roaming or "road warriors") without opening up
the whole domain pc/laptop to full administrative access by that user.
Let's face it, if it were up to us, we wouldn't even let our users power the darn things on! But, since we all have a job
to do, including our users, this guide will enable you to deploy a group policy to an organisation unit that will enable
the (selected) domain users within that unit to install local printers. (Say, they have a beautiful HP inkjet at home they
wish to use, or that laserjet in their remote office they travel to).
This guide is also suitable to enable programs that require the creation of a Printer Driver during operation such as
Adobe Acrobat Standard/Professional and Pegasus Opera II Enterprise client (for example). In fact, this guide was
written specifically to solve the problem for the latter!
So the trick is not easy or fast! Well, unless you use Guru Guy's guide!
Pre-requisites:
•
Create a Domain Security Group of the desired Domain Users whom will be given rights to install
the printers E.g. “Printer Users”; Add all deesired members to this group.
•
Optionally, create a Domain Security Group "Printer Computers" with desired machines/computers
as members to which you want to allow printers to be installed on. (By default, when you assign a
Group Policy to an Organisation Unit, all machines in that unit are affected - this security group will
allow further filtering by only affecting the desired machines within that unit!) Much more affective
way to ensure that the users don't have full printer rights across the whole organisation!
•
Create an Organisational Unit in Active Directory for all of the machines (computers/laptops) to
which desired users can install the printers on. E.g. “Test OU” (You can use an existing OU but see
the note below! Guru Guy recommends creating a test OU for small deployement, specifically where
modification of user rights is concerned!)
•
Place a test PC or 2 into this OU so that only a couple of computers are affected (once complete and
tested, move the rest into this or apply the policy to your existing OU - again, see note below)
•
Install the Group Policy Management Tool (GPMT) to allow advanced modification and creation of
domain Group Policies.
Never modify the default domain policy. Always create organisational units and never
include domain admins or server computers in these units. For these instructions we
have created an Organisation Unit (OU) called “test”.
So, you should have:
1.
Printer Users (of all desired domain users e.g. Polly Edwards, Diane Lane etc.)
2.
Printer Computers (of all desired machines as members to which your users can install printers
on)
3.
Test Organisational Unit to deploy the Group Policy into the desired computer group, with a test
workstation computer moved into the OU in Active Directory
4.
Group Policy Management Tool installed
Step-by-Step instructions
Assuming you’ve followed the pre-requisites above, continue below for deployment:
1.
Open up the Group Policy Management Tool
2.
Navigate to your TEST OU that should be located our underneath the domain policy.
3.
Create and Link a new Group Policy Object (GPO) to the Organisation Unit and call it “Power
Users”. This GPO will increase the users to a level that can install printers even if they are standard
(restricted) domain users of that workstation/laptop and are NOT a member of the local machine
Adminstrators group. (This policy will inherently allow user general “Power User” privileges such
as modifying system time & date etc. This GPO will apply to all users of the PCs/Laptops in that
Organisation Unit and any members logging onto those PCs listed in the “Printer Users” group. For
full information about the Power User group privileges, consult the Windows XP documentation.
4.
In the New GPO, navigate to: Computer Configuration\Windows Settings\Security
Settings\Local Policies\User Rights Assignment
5.
Under “Load and Unload Device Drivers” edit the properties.
6.
Tick “Define these policy settings” and add the Printer Users Group via Domain\Group format e.g.
“GURUGUY\Printer Users”. Also, be sure to add "Administrator" and "Administrators" to the list. This
will allow local admins to each PC having full access. Wihtout adding these two groups, you
essentially remove priveledges of the Administrators! Once done, click OK to close the policy.
7.
Navigate to: Computer Configuration\Windows Settings\Security Settings\Local
8.
Under the policy “Devices: Prevent Users from installing printer drivers” define the policy to be
Policies\Security Options
“Disabled”.
9.
Navigate to Computer Configuration\Windows Settings\Security Settings\Restricted
Policies
This section enables modification of the laptop/computer local user groups. What we need to do
here is allow the desired "printer users" to be a member of the “Power Users” group on that local
PC…
Warning: Modification of the "Restricted Policies" is very powerful and complex. NEVER modify this
policy which affects domain Admins, Servers, Domain Controllers etc. This policy should only apply
to a hand-ful of desired workstation machines. For more information consult's MS Knowledgebase
on Restricted Policies.
10. Right-Click “Restricted Groups” and click “Add Group” and name it “Power Users”. (Make sure it is a
group name that does NOT exist in the domain active directory so the policy is not misinterpretted.)
11. In “Members of this Group” section, add DOMAIN\GROUP e.g. "GURUGUY\Printer Users”
12. In the “this group is a member of” section, add and type: “Power Users”.
13. OK out of that window and you should have something like the below:
14. Navigate to Computer Configuration\Administrative Templates\Printers modify the policy
“Disallow installation of printers using Kernel-mode drivers” to Disabled
15. Navigate to User Configuration\Administrative Templates\Control Panel/Printers and
modify the policy “Point and Print Restrictions” to disabled.
16. Close the GPO and view the “scope” tab of the policy in the Group Policy Management Pane.
Under Security Filtering add “Printer Users” and “Printer Computers”.
17. Once users have been assigned to both security groups, and a machine is moved from Active
Directory “Computers” into your new Organisation Unit, log into a machine to test the policy.
18. Type in the Start->Run “gpupdate /force” on a test workstation. This will refresh the group policy.
19. Reboot the computer, login, and to see the Group Policy has taken affect, go to Control Panel ->
Printers -> Add Printer. After the Wizard introduction the option to select "Local Printer" should NOT
be greyed out. (Normally it is and only Install Network Printer" is available to choose from). If not,
update Group Policy again after making sure the PC is in the Organisational Unit you recreated, the
machine you are on is a member of the "Printer PCs" group and the User you are logged in as is a
member of the DOMAIN\Printer Users Group.
20. Congratulations, you've not enabled your desired users to install printers on your desired PCs!