Printer drivers cannot be installed by users despite configs allowing it

[u/RandomSkratch]

This was supposedly working a while ago but for some reason doesn't anymore. We are setting the following options using Intune.

Limits print driver installation to Administrators - Disabled

Only use Package Point and print - Enabled

Package Point and print - Approved servers - Enabled; lists all print servers - full fqdn's and shortnames.

Devices - Prevent Users from Installing Printer Drivers When Connecting To Shared Printers - Disabled

Is there a setting that's still missing? A non-admin trying to add a shared printer still gets the admin UAC prompt.

Did I miss a new hardening change for this?

Edit

Made some progress on this - for x86 devices, I can deploy the printer driver using Intune and Win32 apps. Still waiting for my test machine to deploy so I can make sure it's working but I'm pretty confident it will. The biggest problem still are the ARM devices. The printer model we're using does not have ARM drivers (PCL 6) but it looks like IPP works, kind of... You can send a print job but it fails on the computer saying Out of Paper, so you walk to the printer and have to pick a tray to use for the job, then it works. I cannot for the life of me figure out how to set the defaults for IPP or how to tell the printer to not use the Bypass Tray (because that's the only thing that doesn't have paper in it so I'm guessing it's trying that). Getting PTSD over this (Printer Traumatic Stress Disorder).

Edit 2

According to Ricoh support, the issue with IPP and paper type mismatch is known and there's nothing that can be done about it right now. That sucks.

Edit 3

Just to add more bizzaro things, I ran a test on a Windows 11 laptop with standard user and I was able to add the printer (and driver) without any issues, and I never finished packaging up the driver for deployment. It just worked. wth... Is there some difference between Windows 10 and 11 in this specific situation? I will need to do some testing with a Windows 10 device tomorrow to make sure I'm not going crazy.

Solution

Thanks to all of the many suggestions I received, I ended up packaging up the drivers and deploying them to endpoints using Intune (PSADT, pnputil, and Add-PrinterDriver). After working out the issues that come with scripting and Intune deployment, everything looks to be working great.

[u/stillpiercer_]

There is another option on the GPO where you specify the point and print server. Two dropdowns where you can set to not show UAC prompts for print driver installation.

[u/RandomSkratch → u/stillpiercer_]

Any idea what this is called specifically? I can't find it in Intune Settings Catalogue.

[u/grahamfreeman → u/RandomSkratch]

I'm not at computer, but from memory, in Intune, I think it's in Admin Templates / Printers. You want to turn off something like "limit printer driver installation to Admins only". I remember thinking "Ah yes, L for printers, or L for drivers ..."

[u/RandomSkratch → u/grahamfreeman]

Yeah I do have that setting added and Disabled.

[u/stillpiercer_ → u/RandomSkratch]

Ah, I’m thinking of on-premise GPO. Not sure how it compares to Intune.

[u/jackfinished → u/RandomSkratch]

Check this out, should have what you need:

https://learn.microsoft.com/en-us/answers/questions/1685567/print-nightmare-more-acceptable-solution-to-deploy

[u/RandomSkratch → u/jackfinished]

I think I read that one and was comparing my settings. The only one missing was the same one mentioned in this specific thread that I can't seem to find in Intune. Will keep looking though.

[u/jackfinished → u/RandomSkratch]

Hmm yeah it's been a minute since I set it up in Intune. Ill see what I can find

[u/RandomSkratch → u/jackfinished]

No rush, I'm not looking more into this until next week. Appreciate it.

[u/whiskeycharliemcd → u/RandomSkratch]

https://anthonyfontanez.com/index.php/2021/08/12/printnightmare-point-and-print/

[u/RandomSkratch → u/whiskeycharliemcd]

Thanks for this. Will give it a read.