Allowing users to install printers

Overview

Traditionally, installing printers on both Windows and Macs requires administrative credentials. In some cases, departments may want to allow users to install printers without administrator privileges.

Allowing regular user accounts to install or remove printers can eliminate some of the ticket work of managing printers by allowing users to install their own local printers (especially at home), remove old printers no longer available, or install printers from a print server, all without the assistance of IT.

Windows solutions

On Windows computers, regular user accounts can actually add printers as long as the drivers for the printer are already installed. There are 2 settings that need to be changed.

• Disable "Point and Print Restrictions" via GPO or Local Security Policy (Administrative Templates/Printers)
• Enable "Allow non-administrators to install drivers for these device setup classes" on the following classes:(Administrative Templates/System/Driver Installation)
  • {4d36e979-e325-11ce-bfc1-08002be10318}
  • {4658ee7e-f050-11d1-b6bd-00c04fa372a7}

Disabling "Point and Print Restrictions" allows users to install printers from print servers. Alternatively, instead of disabling point and print restrictions, you can enable it and specific specific print servers, although users would then still need administrative privileges to install printers from other print servers.

Allowing users to install drivers for the above device classes enables them to install local printers.

Mac solutions

On OS X based computers, the simplest solution is adding everyone to the lpadmin group. This enables regular user accounts to add, remove and modify printers.

This can be done with the following command in terminal:

/usr/sbin/dseditgroup -o edit -n /Local/Default -u administrator -p -a everyone -t group lpadmin

Make sure to substitute the name of the local administrator account above it is named something other than administrator. This also allows users to unpause printers themselves in case of a paper jam.

If your IT group uses a local administrator account called "administrator" you can use the public Landesk package named "OIT - Allow All Mac Users to control printers PUBLIC"