In setting up a print server (Microsoft Windows Server 2008 R2) I found that a Domain User is able to create a standard TCP/IP port when adding a "local" printer, the local printer being on the network but connected to using the IP address of the printer.

I thought that a user had to be in the domain administrators group to add a standard TCP/IP port. Has this changed? Is there a policy setting that can be modified?

I want domain users to print to my network printers via my print server. I don't want them printing directly to my network printers.

Client machines are Windows 7.

  • 3
    If the printer involves installing drivers, the user has to have "load and unload device drivers" in order to install the drivers. They do not have to be domain admins. – Katherine Villyard Feb 21 '14 at 20:45

Typically, the way this is handled is by having a GPO or GPP install printers from the print server for the user, and then creating a GPO that prevents users from installing printers.

Alternately, you could have your printers on a different VLAN from your clients, and block access to that VLAN from the client VLAN at the switch, so the only way for the clients to access the printers is by going through the print server (which would have access to the printer VLAN, naturally).

  • The two solutions to prevent local printing I've come across include your separate VLAN and "white-listing" the print server on each network printer. I was counting on non-administrators not having the ability to create a standard TCP/IP port. I thought this was the way it used to work. – kleefaj Feb 21 '14 at 20:55
  • Nope. As of Windows XP at least, only "Power User" is required to create a TCP/IP printer port. Loading the drivers requires admin or granting "Load and unload device drivers." If they install the printer software, they have to be admins. – Katherine Villyard Feb 21 '14 at 21:04

What HopelessN00b said.

Speaking as someone who's had the opposite problem--"How do we let non-admins install printers?"--no, you do not have to be a domain admin to install a printer.

As of Windows XP at least, and perhaps before, Power Users were able to create TCP/IP printer ports. They could not, however, install drivers unless they were local administrators or were granted "Load and Unload Device Drivers" through domain or local security policy (under User Rights Assignment).

They cannot install the software that comes with their printer unless they are local (not domain) administrators.

You should use HopelessN00b's GPO solution.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.