User account control pop up on windows 8.1 laptops - GPO setting in Group policy

Hi there,
I am running windows domain with few server 2008 ent and one server 2012 R2 ent.
I have made a new image 8.1 ent.
I have not made my domain users(students) as member of any local groups on the laptops yet.   I log in as a student and want to add a printer, the 'user account control setting' asking for domain credentials pops up.  I can understand my student group is not part of any local groups yet but for a simple user (a student) the user account control should at least let the student add the printer.  Which GPO setting can over come this behavior or do I have to add my student group to local power group to skip this behavior?
-I would like to avoid making my student group as member of local power users, this way they will have more freedom of installing malware/apps
-what is the best way to tackle this issue I simply want my students unable to install malware or any program but can install local/domain printers without any user account pop up.  GPO settings where/how
Need help
amanzoorNetwork infrastructure AdminAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


Windows security sees device installations as a risk. this has always been that way.
"the user account control should at least let the student add the printer" - it would let him install any printer if the driver was already in the system. Power users are no longer usable, they have been deprecated since vista. You would need to deploy the printers using GPOs or loosen something called "point and print restrictrictions" (please google the term, you'll quickly find howtos.
amanzoorNetwork infrastructure AdminAuthor Commented:
I followed for my default policy:

The Annoying User account control pops up right in the middle of install of driver.  Need help.
You don't need to mess with uac. The ms link you found has it all. You followed that? Then you will see it described a way to deploy printers to computers, that's what we do and no uac prompts stop us.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
amanzoorNetwork infrastructure AdminAuthor Commented:
For me here is what worked: 1st
Allow non administrators............

I was following 1st on the OU of the machines.  For some reason it did't work, I have to make another GPO right onto the domain(near default GPO), after this I had windows cannot install printer, access denied, which were removed by following step 2.
amanzoorNetwork infrastructure AdminAuthor Commented:
Hi Mcknife,
Just found out that on our domain clients running 8.1, The store cannot be opened, infact any app clicked says 'will not 'this app cannot open, Turn on UAC'.......I will open a new question
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.