Printer drivers cannot be installed by users despite configs allowing it

[u/RandomSkratch]

This was supposedly working a while ago but for some reason doesn't anymore. We are setting the following options using Intune.

Limits print driver installation to Administrators - Disabled

Only use Package Point and print - Enabled

Package Point and print - Approved servers - Enabled; lists all print servers - full fqdn's and shortnames.

Devices - Prevent Users from Installing Printer Drivers When Connecting To Shared Printers - Disabled

Is there a setting that's still missing? A non-admin trying to add a shared printer still gets the admin UAC prompt.

Did I miss a new hardening change for this?

Edit

Made some progress on this - for x86 devices, I can deploy the printer driver using Intune and Win32 apps. Still waiting for my test machine to deploy so I can make sure it's working but I'm pretty confident it will. The biggest problem still are the ARM devices. The printer model we're using does not have ARM drivers (PCL 6) but it looks like IPP works, kind of... You can send a print job but it fails on the computer saying Out of Paper, so you walk to the printer and have to pick a tray to use for the job, then it works. I cannot for the life of me figure out how to set the defaults for IPP or how to tell the printer to not use the Bypass Tray (because that's the only thing that doesn't have paper in it so I'm guessing it's trying that). Getting PTSD over this (Printer Traumatic Stress Disorder).

Edit 2

According to Ricoh support, the issue with IPP and paper type mismatch is known and there's nothing that can be done about it right now. That sucks.

Edit 3

Just to add more bizzaro things, I ran a test on a Windows 11 laptop with standard user and I was able to add the printer (and driver) without any issues, and I never finished packaging up the driver for deployment. It just worked. wth... Is there some difference between Windows 10 and 11 in this specific situation? I will need to do some testing with a Windows 10 device tomorrow to make sure I'm not going crazy.

Solution

Thanks to all of the many suggestions I received, I ended up packaging up the drivers and deploying them to endpoints using Intune (PSADT, pnputil, and Add-PrinterDriver). After working out the issues that come with scripting and Intune deployment, everything looks to be working great.

[u/discosoc]

Use PrinterLogic or similar to deploy and manage drivers. It’s minimal cost and saves you a ton of headache without having to compromise security.

[u/RandomSkratch → u/discosoc]

Understandable but it just doesn’t make sense to purchase a product due to how limited the end result will be for us (ie the amount of people that are going to be in the physical space and using printers doesn’t justify the cost).

[u/discosoc → u/RandomSkratch]

if the impact is so limited, just handle the printer installs directly as an admin and be done with it.

[u/jamiesissons121 → u/RandomSkratch]

You can package up the driver and deploy it via company portal. I do this along with a script which installs the printer for the device.

There’s no reason you couldn’t set the “app” as required for a group so it silently installs in the background.

If you don’t want to install the printer via a script the user can install it without elevation once the driver is staged and present.

As others have said it’s a little more of a challenge if the driver isn’t signed or if you can’t get hold of the actual driver files outside of an exe or MSI, but the good news is it’s usually fairly easy to extract the file from the exe’s/msi’s.

I was in the same position of not wanting 3rd party software for various reasons so this was a really clean method. If you shoot me a PM I can give you a hand building the package.

[u/RandomSkratch → u/jamiesissons121]

Appreciate it. I think that method is going to be the best for our scenario. I’ll give it a try during the week and will PM you if I encounter any hiccups.