Key Takeaways
- This policy controls whether users can install print drivers on the system.
- Determines whether users who aren’t administrators can install print drivers.
- By enabling this, only users with administrative rights can install print drivers.
- This policy helps to improve device security.
- It prevents unauthorised driver installations.
Hey, let’s discuss about how to enable or disable print driver installation settings using Intune. By default, non-admin users cannot install print drivers in Windows due to insufficient privileges. If you enable or do not configure it, this setting will limit the installation to administrators of this system; otherwise, this won’t limit the installation of print drivers.
Table of Contents
Table of Contents
What are the Advantages of Enabling this Policy?
By enabling this policy, only users with administrative rights can install or update print drivers. This helps us in many ways, like:
1. Improves device security.
2. Reduce malware risks.
3. Restricts untrusted servers.
How to Enable or Disable Print Driver Installation Settings using Intune
This policy allows only administrators to install drivers, which helps to minimise the risk of malware. This improves security considerations. This determines whether users who aren’t administrators can install print drivers on computers.
- Policy to Turn Off Downloading of Print Drivers Over HTTP using Intune
- Enable Disable Device Control Printing Restrictions Policy using Intune
- How to Enable Windows Protected Print to Eliminate Print Vulnerabilities using Intune
How to Create a Policy
First, sign in to the Microsoft Intune Admin Center. Go to the devices and select configuration. Then click on the create down arrow, and after that, click on new policy. To create a policy, you must specify the profile type and platform. From this window, you can select:
| Platform | Profile Type |
|---|---|
| Windows 10 and later | Settings catalog |
Basics Tab for Name and Description
On the basics tab, give an appropriate name and description, so that it is easy to identify later. In the name box, give the policy name (Print Driver Installation) and description (limits print driver installation to administrators). Then click Next to continue.
Configuration Settings in Print Driver Installation Policy
On the configuration settings tab, after clicking on the add settings, you can search for the name of the policy from the settings picker. In the search bar, enter the policy name and select the category as Administrative Templates\Printers and the settings name as “limits print driver installation to administrators”.
Disable Print Driver Installation Policy
After closing the settings picker, you will see the policy on the configuration settings page. This policy contains two settings: either enable or disable it. By default, users who aren’t Administrators can’t install print drivers on this computer. If you disable this setting, the system won’t limit the installation of print drivers to this computer. If you continue with the disabled option, click Next to continue.
Enabling Print Driver Installation Policy
By enabling this policy, the system will limit the installation of print drivers to administrators of this computer. You can allow the print driver installation policy by toggling the switch from left to right. After this, click Next to continue.
Purpose of Scope Tags
A scope tag in Intune is used to control visibility and access to Intune resources based on administrative roles. Scope tags are not mandatory. You can add the scope tag using the select scope tags button. Click Next to continue.
Assignments Tab to Add Group
On the assignments tab, you can select which users or devices get this policy. Under Include Groups, click Add Groups. From the list, select the group that you want to target (HTMD – Test Policy). Then click the Next button to continue.
Review + Create
At the review + create step, you can review each tab to avoid misconfiguration or policy failure. After reviewing the details and making any necessary changes by clicking Previous. We click Create to finish, and a notification confirms that the “Print Driver Installation created successfully”.
Monitoring the Status of the Policy
You can check a policy’s status in the Intune portal. Generally, it takes 8 hours for policies to be created. By using the manual sync option, you can reduce the configuration delay in the company portal app on the device, then check the status again. Navigate to Devices > Configuration. Click on the specific policy to see its details.
Client-Side Verification
To confirm if a policy has been applied, use the Event Viewer on the client device. Go to Applications and Services Logs > Microsoft >Windows >Device Management > Enterprise Diagnostic Provider > Admin. From the list of policies, use the Filter Current Log option and search for Intune event 814.
MDM PolicyManager: Set policy string, Policy: (RestrictDriverInstallationToAdministrators), Area:(Printers), EnrollmentID requesting merge: (EB427D85-802F-46D9-A3E2-D5B414587F63), CurrentUser: (Device), String: (<disabled/>), Enrollment Type: (0x6), Scope: (0x0).
Windows Configuration Service Provider (CSP)
The Policy Configuration Service Provider (CSP) is a feature used by organisations to manage and control settings on Windows 10 and 11 devices. It explains what each policy does, what settings or values can be used, and how it connects to older Group Policy settings (Group Policy Mapping details).
Description Framework Properties:
The following list shows the description framework properties of the Offline Files Feature policy.
- Format – chr (String)
- Access Type – Add, Delete, Get, Replace
| Name | Value |
|---|---|
| Name | Restrict Driver Installation To Administrators |
| Friendly Name | Limits print driver installation to Administrators |
| Location | Computer Configuration |
| Path | Printers |
| Registry Key Name | Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint |
| Registry Value Name | Restrict Driver Installation To Administrators |
| ADMX File Name | Printing.admx |
How to Remove an Assigned Group from this Policy
If you need to remove a group from a policy assignment for security updates. Open the policy from the configuration tab and click on the edit button. Then, click on the Remove button. Click Review + Save after making the changes.
For detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.
How to Delete this Policy from Intune Portal
If you want to delete this policy for any reason, you can do it easily. First, search for the policy name in the configuration section. When you find the policy name, click the 3-dot menu next to it and tap the Delete option.
For detailed information, you can refer to our previous post – Learn How to Delete or Remove App Assignment from Intune using by Step-by-Step Guide.
Need Further Assistance or Have Technical Questions?
Join the LinkedIn Page and Telegram group to get the latest step-by-step guides and news updates. Join our Meetup Page to participate in User group meetings. Also, Join the WhatsApp Community and WhatsApp Channel to get the latest news on Microsoft Technologies. We are there on Reddit as well.
Author
Anoop C Nair has been Microsoft MVP from 2015 onwards for 10 consecutive years! He is a Workplace Solution Architect with more than 22+ years of experience in Workplace technologies. He is also a Blogger, Speaker, and Local User Group Community leader. His primary focus is on Device Management technologies like SCCM and Intune. He writes about technologies like Intune, SCCM, Windows, Cloud PC, Windows, Entra, Microsoft Security, Career, etc.