I am running windows domain with few server 2008 ent and one server 2012 R2 ent.
I have made a new image 8.1 ent.
I have not made my domain users(students) as member of any local groups on the laptops yet. I log in as a student and want to add a printer, the 'user account control setting' asking for domain credentials pops up. I can understand my student group is not part of any local groups yet but for a simple user (a student) the user account control should at least let the student add the printer. Which GPO setting can over come this behavior or do I have to add my student group to local power group to skip this behavior?
-I would like to avoid making my student group as member of local power users, this way they will have more freedom of installing malware/apps
-what is the best way to tackle this issue I simply want my students unable to install malware or any program but can install local/domain printers without any user account pop up. GPO settings where/how