We manage Windows printer settings through Intune. The policy limiting printer-driver installation to administrators is disabled, package point-and-print is enabled, and the approved-server list includes both the fully qualified and short names of all our print servers. The setting that prevents users from installing printer drivers when connecting to shared printers is also disabled.
Despite this, standard users still receive a UAC prompt for administrator credentials when they try to add a shared printer. This used to work, so I'm wondering whether a newer Windows security change—possibly related to PrintNightmare—now requires additional policy settings or Type 4 drivers. None of our printers currently have Type 4 drivers. Is there another Intune or Group Policy setting we're missing, or should we package and deploy the drivers separately?
4 Answers
There are additional point-and-print policy options that control whether users see warning or elevation prompts when installing drivers from approved servers. They’re easy to overlook, although the exact settings available in Intune’s Settings Catalog may not match the traditional Group Policy names.
If policy changes still don’t work, deploy the printer driver as a Win32 application or pre-stage it on the devices, then connect users to the shared queues afterward. That avoids asking standard users to install a restricted Type 3 driver interactively.
You can also check the device-installation policies that allow drivers matching specific device setup classes. The printer and PNP printer class GUIDs commonly used are {4658ee7e-f050-11d1-b6bd-00c04fa372a7} and {4d36e979-e325-11ce-bfc1-08002be10318}. These may need to be enabled along with the approved print-server settings.
The PrintNightmare-era changes made point-and-print much stricter. In practice, non-admin users generally cannot install most Type 3 printer drivers without elevation, even when the older point-and-print policies appear to allow it. Type 4 drivers are less affected, but many printer vendors still do not provide them.
That explains what we’re seeing. Since none of our printers have Type 4 drivers, packaging the drivers and deploying them separately may be the most reliable approach.
I added those settings, but the prompt remained. I’ll verify that the policy actually refreshed and applied before ruling them out.