During testing on Windows 11, we found that regular, non-administrative users can add a local TCP/IP printer through Settings. The printer appears to be installed at the computer level: other users can see it, and they can also remove it. This is specifically about creating the printer queue, not installing a printer driver. We previously expected adding, changing, or deleting a local TCP/IP queue to require administrator privileges. Is this long-standing Windows behavior, or did it change in newer Windows versions? Could a policy difference between our former on-premises Active Directory environment and our current Entra/Intune setup explain it?
4 Answers
Some older environments appeared to prevent this because the printer drivers or port configuration required administrator rights. That can make it seem as though Windows always required elevation, even if the queue-creation permission itself did not. Check whether users have unusual permissions on printer-related registry keys or membership in groups such as Print Operators, and compare the effective policies on the old and new devices.
We have seen the same behavior in an Entra- and Intune-managed environment. Users can add TCP/IP queues themselves, which often leads to duplicate printers and inconsistent driver behavior. If that is not acceptable, it needs to be blocked with an explicit device or printer installation policy rather than relying only on driver restrictions. Test the exact policy on a current Windows build, because the wording and scope of the printer policies have changed over time.
This has likely been possible for quite a while, especially when Windows can use a driver that is already installed, such as a universal or class driver. Installing a new driver is a separate operation and may still require elevation. Many environments noticed this more after the PrintNightmare-related changes and the move toward universal drivers, because users could create queues without needing a driver installation.
The Settings workflow can allow standard users to add a port and assign an already-installed driver. Whether the queue is per-user or computer-wide can depend on the exact workflow and Windows configuration. Group Policy, device-installation policies, printer security permissions, and local group membership can all affect the result. The policy that prevents users from installing printer drivers does not necessarily prevent them from creating a queue with an existing driver.
In our testing, users can add a real printer by entering its IP address or hostname, not just select an automatically discovered device. They still get a UAC prompt when attempting to share it.
That matches what we have seen: users can add the printer when the required driver is already present, but installing or changing the driver is still restricted.