power users need printer drivers

I assume you double checked that your policies work (the effective settings within the Local Group Policy).

If you have a security issue here on either the file system or within the registry I suggest working with the two sysinternals tools file monitor and registry monitor.
(visit www.sysinternals.com and download these great tools).

Run one tool after the other (uses a lot resources!), try to install your printer, stop the monitoring process and search the results for access denied messages.
I know it records a huge amount of data but the inquiry is worth it.

Let me know your results ...

Power users do not exist as a domain security group. If you wanted to achieve something like this you woud need to create a domain group, and pace them in the local power users group on every computer, then simply add people to that group and they can install printers. Power users can install programs and printers but ony on local computers.

does anyone have a script for adding domain groups to local groups to help him achieve this?

add domain users to the power users group on individual workstations.

ok I will clarify a little more. My local power users cannot load printer drivers. I even have that disabled in my security template along with allow users to load unload drivers.

I've run into the same issue on XP. According to KB article 326473, power users can only install printers (with the rights you described) through the add printer wizard. No plug and play. Also, they cannot install any other devices even if they have load driver rights. It has to do with the workstation ACL: only administrators can make permanent changes. I haven't found the solution yet, and I'm not sure if it's applicable to 2000.

the bottom line in xp and 2000 is that local admins can only install software.... MS leaves it up to domain level restrictions for you to restrict your users.... I give all my users local admin rights and then set up GPOs at the domain level to set up security,,, that way i set security in one place,, the DC,,, not by going to each of my 1000 workstations.

Ok, maybe I am not clear, for get I said anything about domains, yes I knew about adding domain users to power users locally....if they cant install them as power users to begin with How in the hell is adding domain users to the power users group going to fix it. Like I said before right now the computers are not hooked to a domain. I figure the registry was messed with and there probably is an option that doesnt show up in security templates, becuase I did a fresh install and applied my template and powersusers could install printers. I will award points to the one who knows where in the registry printer restrictions maybe that dont show up on security templates.

if you read my post,, i didnt say add them to power users,,, i said you have to add them to local admin group.... you HAVE to be in local admin group to install some software

I believe you can do this from your desk with rundll32 printui.dll,PrintUIEntry /o /n\\machine\printer

http://techsupt.winbatch.com/TS/T000001031F17.html

Maybe you mentioned it somewhere and I read over it .... where is the printer physically located? Do your users have permissions to connect to that printer/computer? Maybe you ought to authenticate first ...

ok I want everyone to forget I said anything about domains. LOCAL PRINTER, LOCAL USER,  I suspect its a reg key that isnt edited in security templates. I did remedy the problem with a fresh install using my usual security templates and power users can install local printers....but on the affected ones i can put any template i want and they still cant install printers.

did you check with ww.sysinternal.com's tool regmon? You should be able to  isolate the registry keys with that one.

when you say affected ones what do you mean?? what is different on these machines from the other ones.