Solved

Allow "Non Admin" Domain Users to Install Shared Printers on Windows 7 without Prompting for Administrative Credentials

Posted on 2013-12-19
12
5,978 Views
Last Modified: 2013-12-25
Hello,

I would like to allow "Non Admin" Domain users to install shared printers on Windows 7 without prompting for administrative credentials.  I have looked at multiple posts on the subject here at EE, but I am still having trouble.  We currently have Windows Server 2008 Domain controllers (not 2008 R2) and the clients have Windows 7 Professional.

I have attached a screenshot below of the GPO settings I currently have set in the OU.  I am not sure what I am missing.  The non admin clients are still prompted for admin credentials when trying to connect to a shared printer.  *Note some of these shared printers are on Windows XP desktops.  

Windows GPO Settings for Printing
Any help would be greatly appreciated, thanks,


Randy
0
Comment
Question by:rgutwein
  • 6
  • 5
12 Comments
 
LVL 1

Expert Comment

by:Rapska1ion
Comment Utility
Remote users permissions on you print server could also affect this. The GPO settings look fine, what are your print server local permissions?
0
 
LVL 5

Author Comment

by:rgutwein
Comment Utility
Hi Rapska1ion, I have the remote desktop settings turned on, and all of the local policies are set to the default.  Is there a particular one I should look for in the local polices?


Randy
0
 
LVL 1

Expert Comment

by:Rapska1ion
Comment Utility
Probably stray away from policies for now. Check your local groups and make sure domain users have permissions to remotely connect (but not login of course)
0
 

Assisted Solution

by:Callum-
Callum- earned 250 total points
Comment Utility
Have you tried running the Group Policy Modelling Wizard?

You may have a policy that is over-riding the settings you posted. Hopefully, the above wizard should point out which one that is.
0
 
LVL 5

Author Comment

by:rgutwein
Comment Utility
Hi Everyone,

I checked the Group Policy Modeling Wizard and I do not see any of the Group Policies being filtered out.

The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

I also checked the Local Remote Users group on the PC sharing the printer and manually added the account trying to connect to that shared printer and I get the same result.

I am able to install the shared printer on a Windows XP machine with no issue, it is just the Windows 7 ones want me to enter in the admin credentials.
0
 
LVL 5

Author Comment

by:rgutwein
Comment Utility
Hi Guys,

Just a follow up, it seems that the GPO settings are correct to some degree.  I did a test where I had a Windows 7 desktop share a printer where the default drivers were already installed (HP 910).  I then had the other Windows 7 desktop with a standard (Non admin user) try to connect to it and it installed without issue.

Now when I try to connect that Windows 7 desktop to the shared printer on a Windows XP machine (with a Dell1130 printer) it looks like it wants to download the drivers from that XP desktop for the printer.  When it completes, then it prompts me for that admin password.  Is there another Group Policy that I am missing that will allow this?

Randy
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 1

Expert Comment

by:Rapska1ion
Comment Utility
Check your UAC settings on the client. Either bring those settings down or you can try adding domain users to the clients power users group.
0
 
LVL 5

Author Comment

by:rgutwein
Comment Utility
Thank you Rapska1ion, I turned the UAC to "Never notify (Disable UAC)" but I am still getting prompted to include the admin credentials :(
0
 
LVL 1

Assisted Solution

by:Rapska1ion
Rapska1ion earned 250 total points
Comment Utility
Disappointing! There may be an issue with hosting a shared printer from XP to 7 in regards of authorization. You might have to find a work around. I wool do some research for you because now I am curious.
0
 
LVL 5

Accepted Solution

by:
rgutwein earned 0 total points
Comment Utility
Ok, I finally got this to work!  After doing an exhaustive amount of research, I stumbled up on this:

There are TWO "Point and Print Restrictions" settings
•      Computer Configuration/Policies/Administrative Templates/Printers/Point and Print Restrictions
•      User Configuration/Policies/Administrative Templates/Control Panel/Printers/Point and Print Restrictions

Of these two, the one under Computer Configuration seems to be the important one (Especially for Windows 7 computers). But guess what? The original Server 2008 doesn't include this setting in the list -- you need Server 2008 R2 for this setting to show up.

Now, I only had Window 2008 Domain controllers, and I did not want to mess around with them too much with importing the various settings, so I decided to create a backup domain controller (which is a Windows 2008 R2 server).  Once I got that up and running, I decided to give that "Computer Configuration/Policies/Administrative Templates/Printers/Point and Print Restrictions" a go.  After I did that, everything worked!  I guess Windows 7 machines need that setting, and were ignoring the other ones.  I know creating the backup dc was overkill, and I am sure there are simpler ways to do this, but I wanted to post my settings if anyone else is having this issue.  Thank you for all your help!

Working Windows GPO Settings for Printing

Randy
0
 
LVL 1

Expert Comment

by:Rapska1ion
Comment Utility
Thanks for posting that Randy. Good luck!
0
 
LVL 5

Author Closing Comment

by:rgutwein
Comment Utility
I posted the solution and awarded point to all those who helped me get to this point.  Thank you so much, I really appreciate it.


Randy
0

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
Email signature management is something that is often overlooked in many organizations or is simply not implemented effectively. Let's take a look at what methods are available for managing this important piece of corporate branding.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now