Recent (2021-08-10) KB5005033 Windows update actually brings this issue back to life by forcing admins only to install printer drivers (and thus, not allowing printer distribution via User Configuration GPO), quote:
...Updates the default installation privilege requirement so that you must be an administrator to install drivers when using Point and Print...
Suddenly, our users get these popups (only on computers having KB5005033 update installed):
To make it (deploying shared printers in Windows domain via User Configuration GPO) work again...
There are some prerequisities first in
Computer Configuration - Policies - Administrative Templates - Printers (we used to have these enabled a long time ago already):
Point and Print Restrictions:
- must be
Do not show warning or elevation promptmust be set for both
When installing drivers for a new connectionand
When updating drivers for an existing connection. The
Enter fully qualified server names separated by semicolonsmust be filled with proper nameservers (e.g. myPrintserver.mydomain.com;myOtherprintServer.mydomain.com)
Package Point and print - Approved servers:
- contains list of same servers as above
The actual workaround* for KB5005033 issue:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministratorsis set to
0on affected machines - can be done easily via GPO, too:
* This is a workaround, not a fix, because it makes your printservers vulnerable again (which is what KB5005033 tries to "fix" in the first place) - but we do need to print, right... ?
Anybody knows how to fix this properly? (without making printesrvers vulnerable)
Thanks a lot.