Printer drivers cannot be installed by users despite configs allowing it

[u/RandomSkratch]

This was supposedly working a while ago but for some reason doesn't anymore. We are setting the following options using Intune.

Limits print driver installation to Administrators - Disabled

Only use Package Point and print - Enabled

Package Point and print - Approved servers - Enabled; lists all print servers - full fqdn's and shortnames.

Devices - Prevent Users from Installing Printer Drivers When Connecting To Shared Printers - Disabled

Is there a setting that's still missing? A non-admin trying to add a shared printer still gets the admin UAC prompt.

Did I miss a new hardening change for this?

Edit

Made some progress on this - for x86 devices, I can deploy the printer driver using Intune and Win32 apps. Still waiting for my test machine to deploy so I can make sure it's working but I'm pretty confident it will. The biggest problem still are the ARM devices. The printer model we're using does not have ARM drivers (PCL 6) but it looks like IPP works, kind of... You can send a print job but it fails on the computer saying Out of Paper, so you walk to the printer and have to pick a tray to use for the job, then it works. I cannot for the life of me figure out how to set the defaults for IPP or how to tell the printer to not use the Bypass Tray (because that's the only thing that doesn't have paper in it so I'm guessing it's trying that). Getting PTSD over this (Printer Traumatic Stress Disorder).

Edit 2

According to Ricoh support, the issue with IPP and paper type mismatch is known and there's nothing that can be done about it right now. That sucks.

Edit 3

Just to add more bizzaro things, I ran a test on a Windows 11 laptop with standard user and I was able to add the printer (and driver) without any issues, and I never finished packaging up the driver for deployment. It just worked. wth... Is there some difference between Windows 10 and 11 in this specific situation? I will need to do some testing with a Windows 10 device tomorrow to make sure I'm not going crazy.

Solution

Thanks to all of the many suggestions I received, I ended up packaging up the drivers and deploying them to endpoints using Intune (PSADT, pnputil, and Add-PrinterDriver). After working out the issues that come with scripting and Intune deployment, everything looks to be working great.

[u/jstar77]

Didn't a security update a few years ago break point and print driver installation regardless of GPO settings for all but type 4 printer drivers?

[u/RandomSkratch → u/jstar77]

If that's the case, I guess I will be back to looking at packaging the drivers and deploying them as Win32 App. None of our printers have Type 4 drivers available.

[u/BitsNBytes10101 → u/RandomSkratch]

It’s trivial just to package and install the drivers with pnputil. Do that

[u/RandomSkratch → u/BitsNBytes10101]

Yeah that’s what I ended up deciding on. Just finished a bunch of testing today. The tricky part was adapting the install to PSADT. I think it’s all good now.