How are you handling home printer installs without admin rights?

This sounds like a conflict between the security setting and a supported business need. Document how many people are affected and what work they cannot do, then ask the security team to approve a supported option or reconsider the setting. A workaround that quietly bypasses the control is likely to create a bigger support and security problem.

First see whether you can avoid the full printer setup package. For models that support driverless printing, try adding the printer through Windows settings using its network address or discovery. If that works, users may not need the vendor’s helper app at all.

For the rest, package only trusted drivers and install them through your device management process, then add the printer separately. Windows has pnputil for staging driver packages, but test each model and your current driver-install restrictions before relying on it. Consumer printers vary a lot, so this is much more manageable with a defined list of supported models.

Supporting every printer people happen to buy is a rough service commitment. I’d set a small supported list, check whether a universal or class driver covers those models, and make the limitations clear. If someone has an unusual device that needs its own installer, handle it as an exception rather than trying to make every vendor package work for everyone.

If users really do need to run vendor installers, consider audited, time-limited elevation rather than standing local admin rights. A just-in-time privilege tool can let support approve a specific install, with access removed afterward. That still needs a policy decision, but it gives you a controlled process instead of sharing admin credentials or granting broad permanent access.