During testing on Windows 11, we found that ordinary non-administrator users can add a local TCP/IP printer through Settings. This refers only to creating the printer queue—not installing a printer driver. The queue appears to be available to other users on the computer, and those users can also delete it. I remember local TCP/IP queues previously being computer-wide objects that required administrator rights to create, modify, or remove. Is this long-standing Windows behavior, or did it change in a newer Windows release? Could the difference be related to moving from on-premises Active Directory and Group Policy to Entra ID and Intune, or to a policy that was not carried over?
5 Answers
PrintNightmare-related policies are often mentioned in this context, but they primarily address driver installation and shared-printer connections. They should not automatically be treated as an explanation for manually creating a local TCP/IP queue. Confirm exactly which workflow is being used and whether the queue is machine-wide or user-specific.
If the queue really is visible to every user and other standard users can remove it, verify its scope and security permissions. A printer created for the current user is different from a machine-level queue. You can compare the behavior across Windows builds and inspect the effective printer, device-installation, and registry policies to determine whether this is an intentional Windows change or an environment-specific permission issue.
Several administrators report seeing the same behavior in Entra/Intune-managed Windows 11 environments. Users can add multiple TCP/IP queues themselves, even when the organization expects them to submit a request. That suggests this is not necessarily caused by a missed migration setting, although policy and local permissions can change the result.
The behavior is not universally consistent. Some environments require local administrator rights to create a new printer port or change printer properties, while others allow adding a queue when the port and driver already exist. Group membership, printer-related Group Policy, registry permissions, and the Windows build can all affect this. It is worth checking the effective policies and permissions on the affected machines rather than assuming the Entra/Intune migration alone caused it.
The policy that prevents standard users from installing printer drivers may not block creation of a queue that uses an already-installed driver. Driver installation and printer-queue creation should be tested separately.
This may depend on whether the required driver is already installed. Windows can let a standard user create a queue and assign an existing driver, while installing a new driver or changing protected printer settings still requires elevation. Universal or class drivers made this more common because users can add the queue without installing a separate vendor driver.
The important distinction is whether they are choosing the manual option to add a printer by IP address or hostname, or simply selecting a discovered device that uses WSD or the Microsoft IPP Class Driver. Those paths may create different kinds of queues.