Local Printers

[MatthewL]

I need to disable users from adding local printers i.e. USB/WSD based but not prevent them from connecting to shares i.e. \\pcname\printer.

 

I can disable the add a printer option in Windows 10 but that then stops me browsing to \\pcname\printer and adding that way, any suggestions?

[djm968]

If you are running Windows 10 ENT - you can do this with AppLocker. If not have a look at this -

[Koldov]

I can disable the add a printer option in Windows 10 but that then stops me browsing to \\pcname\printer and adding that way, any suggestions?

 

Sorry to hijack... can you please tell me how you did this?

 

Because I am having the opposite problem!

 

I have a user and a computer in an OU with no other GPOs and applied just one GPO with a computer setting:

 

COMPUTER CONFIGURATION > POLICIES > WINDOWS SETTINGS > SECURITY SETTINGS > LOCAL POLICIES/SECURITY OPTIONS

 

DEVICES > POLICY = Devices: Prevent users from installing printer drivers - ENABLED

 

But logging on as a standard user I can still quite happily install all the printers...

 

I have fully deleted all the drivers on the machine and made sure the following reg key is set to "1"

 

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers

 

All our printers are shared on the server and set via GPP, so there's no need for users to install any others.

[MatthewL]

What you did there stopped it from working for me.

 

When I did this last users were restricted unless a GPO was enabled but now it seems opposite. I have quite a few GPO's to go through and see what other policies are applied.

 

I could go down the app locker route but we have lots of local printers that I cannot afford to stop working. I know GPO does it ok just finding the right policy.

[MatthewL]

I'm stuck with this one, I need to restrict local printer addition but allow users to map via \\machine\share but don't seem to have much luck.

 

I can stop printers been added but now allow a shared one to work, years ago by default it was stopped but now they allow any printer to be added.

 

Any suggestions?

[GaryPad]

I don't believe there is a specific policy for this. You can mitigate, for example the policy Local Computer Policy | Computer Configuration | Administrative Templates | Printers | Limits print driver installation to Administrators - might help.

 

There's also User Configuration | Administrative Templates | Printers | Prevent addition of printers which "Prevents users from using familiar methods to add local and network printers....However, this setting does not prevent users from using the Add Hardware Wizard to add a printer. Nor does it prevent users from running other programs to add printers." so users should be able to add network queues by mapping to \\print_server\share_name or by having scripts do this for them, but they would lose the familiar Add Printer wizard.