[Solution]: Map printers with logon scripts in Windows 7 & Vista without UAC prompt

[SYNACK]

After a short argument with Vista about mapping printers on a certain station and some research I found a solution to allow you to map printers via VBS logon scripts without UAC getting in the way. It turns out that there is a group policy setting for Vista SP1 that suppresses the warnings and just allows the printer to map silently as it should. You will need 2008 server or RSAT installed on a Vista SP1 client to set it up.

 

User Configuration -> Policies -> Administrative Templates -> Control Panel -> Printers : Point and Print Restrictions

Setting: Enabled

 

In its Config Tab:

Do not specify any servers to restrict Point and Print to so it will continue to work for any server without specifying every one

 

Security Prompts:

When Installing drivers for a new connection:

-Do not show warning or elevation prompt

-Show warning and elevation prompt

 

When updating drivers for an existing connection:

-Do not show warning or elevation prompt

-Show warning and elevation prompt

-Show warning only

 

EDIT: Since Windows 7 and Vista service pack 2 a new policy has been implemented as below which also needs to be set to work with these newer clients. You need to be using Windows 7 RSAT or have updated the ADMX files in your domain central store to see these options.

 

Computer Configuration -> Policies -> Administrative Templates -> Printers : Point and Print Restrictions

Setting: Enabled

 

In its Config Tab:

Do not specify any servers to restrict Point and Print to so it will continue to work for any server without specifying every one

 

Security Prompts:

When Installing drivers for a new connection:

-Do not show warning or elevation prompt

-Show warning and elevation prompt

 

When updating drivers for an existing connection:

-Do not show warning or elevation prompt

-Show warning and elevation prompt

-Show warning only

 

Problems solved, simple solution too. As it happens someone else had actually posted this solution here earlier but I had not noticed it and only found it when looking for any duplicate posts of the same information. The first mention of this method on this site is here.

Edited August 19, 2011 by ZeroHour

[EvLPhenom]

Huge thanks for this. Been trying to fix this issue for the last day...

[speckytecky]

Megga thanks Synac - this one has been plaguing me for yonks as well.

[Michael]

It's not just scripts when these settings should be enabled, but deploying via GPO too.

 

The printer will deploy without these settings enabled, however on many occasions the full driver isn't installed, only a basic driver (if Vista or 7 has one). Otherwise you're forced to open Devices and Printers, right click the printer and select 'Install driver'.

[mthomas08]

Sorry to bring this one to the top, I am guessing if no driver exists this wont install at all? Have made the GP settings change with the print script and I am getting "Install Driver" option appear and of course click install driver and access denied.

 

Is this the norm?

[SYNACK]

Your server needs to have the right drivers available so you need 64bit drivers on the server too if it is 32bit and clients are 64.

[mthomas08]

Strange, our printer guy is saying both drivers are on the server. We previously had to browse for the driver but this time we just click install. Print management was supposed to be eas and solve everything !

[SYNACK]

Strange, our printer guy is saying both drivers are on the server. We previously had to browse for the driver but this time we just click install. Print management was supposed to be eas and solve everything !

Can you install it manually through the gui without it prompting for a driver this should show if it can pull the driver off the server.

[mthomas08]

Nope, your right.

 

I guess the guy hasnt done his job right, I guess its our fault for going small local company!

[SYNACK]

Nope, your right.

 

I guess the guy hasnt done his job right, I guess its our fault for going small local company!

Its about the skill level not the size, you can fit way more dropkicks in a large company than a small one.

[colesy]

This is an old thread, but I am hoping someone is able to help. We updated a bunch of our printers and kept the same IP, just updated the drivers. When a user logs in they don't get the printers via the login script because it surprsesses the prompt to install the new drivers. When you run the script manually, or map the print queue manually you get the prompt to install drivers. I don't know if this prompt is the same as the UAC prompt this thread addresses or not.

 

I did apply these gpos a few weeks ago and we are still seeing the same thing. Can anyone confirm if the install driver prompt is the same as the UAM prompt? Either way, does any one have anything I can do to troubleshoot this? What the techs are doing in the meantime is running the script manually to get the prompt and installing the drivers. Once the drivers are installed, the printers map fine.

 

Thanks.

[mac_shinobi]

Wasn't there a GPO to allow standard users to install non digitally signed drivers ?

[colesy]

Most of these users are local admins, and experience the same thing. It's something about mapping the printers at login when the drivers have been updated. It blocks the prompt to install the updated drivers. But when you run the script manually once the user is logged it, it pops up.. Ideally, it would just download and install the updated drivers automatically with no user input on login.

[DMcCoy]

You need signed AND packaged drivers for Vista/7/8 clients to install printer drivers without the UAC prompts. If you are desperate you can also try to run it as a startup script to have the system install the drivers (worked on xp, not actually tried 7, always had the packaged drivers!).

[colesy]

This is the prompt we get.

 

 

Shouldn't this point and print gpo stop this prompt from coming up?

[ass17]

I have wrote a program to map printers. You call it in script with the printers as command line arguments.

 

I will try to post the windows 7 she'll it calls later if I can find the code.

[Arthur]

@colesy. You may want to try the method described here to install your printers. It works for me.

[colesy]

Thanks guys.

@Arthur The problem with using GPO for us is we have a lot of staff that move from school to school, and they have their own laptops. We have scripts for each school, and the users run a masterlogin script which detects their AD Site and compares it to their home school/location which is stored in AD. If they match then it runs their home schools script. If they don't match, it runs their home schools script , and then script for the school that they are at. It's worked really well until the drivers were updated.

 

So a GPO really only works for mapping printers at their home school, not great for when they travel.

[wroberts]

Thanks guys.

@Arthur The problem with using GPO for us is we have a lot of staff that move from school to school, and they have their own laptops. We have scripts for each school, and the users run a masterlogin script which detects their AD Site and compares it to their home school/location which is stored in AD. If they match then it runs their home schools script. If they don't match, it runs their home schools script , and then script for the school that they are at. It's worked really well until the drivers were updated.

 

So a GPO really only works for mapping printers at their home school, not great for when they travel.

 

I have a script at work that will help with this and also a gpo that prevents the prompt from coming up! I will upload tomorrow for you to look at !

[colesy]

@wroberts Any luck finding that script/gpo?

[wroberts]

@wroberts Any luck finding that script/gpo?

 

I did this via the GPO for deployed printers ! and this worked spot on.

[colesy]

I'm confused, you replied to my message saying:

 

I have a script at work that will help with this and also a gpo that prevents the prompt from coming up! I will upload tomorrow for you to look at !

 

Now you are saying you just used the method the OP posted? Or did you forget to post something in your last message?

[Davit2005]

If you want to assign a printer on a computer OU you can create a Policy and set the Policy Loopback settings in the Computer Configuration section to Merge apply the policy with the settings at the beginning of the thread and then this should apply the printer to the computers in the OU no matter who logs on. If you set the Printer to Remove when no longer applied it would then remove the printer from the machine if it were moved to a different OU and should prevent printers from following users around if using Roaming profiles.

 

Make sure you allow non-administrators the ability to install printer drivers via the device GUID via policy and this will save the necessity for admins to log on for drivers to install.

[colesy]

Thanks Davit2005. We still use scripts for printer installs. GPO doesn't give us the flexibility we need for staff travelling to multiple locations with their laptop.