5

I've implemented the following Group Policy settings to allow non-admins to install printer drivers and to enable / disable their wifi:

User Configuration -> Administrative Templates -> Network -> Network Connections -> Ability to Enable/Disable a LAN connection

and

Computer Configuration -> Policies -> Administrative Templates -> System -> Driver Installation -> Allow non-administrators to install drivers for these device setup classes

In both scenarios I still get a UAC prompt, but this can then be filled in with the non-admin user's credentials - so the setting does work, but we get an unexpected UAC prompt and it is not intuitive that the user needs to enter their user credentials in the box that says 'Enter an administrator password...'

Is this expected behaviour? Is there a way of supressing these UAC prompts?

(I'm aware of the setting for suppressing UAC prompts for point and print, I'm not concerned with point and print at the moment)

Improve this question

2 Answers 2

Reset to default
3

In addition to the other settings mentioned, make sure the bottom Prompts are set in your Group Policy Object for standard users to install local printers without UAC prompts triggering.

User Configuration > Policies > Administrative Templates >Control Panel/Printers > Point and Print Restrictions

Security Prompts:

When installing drivers for a new connection: Do not show warning or elevation prompt

When updating drivers for an existing connection: Do not show warning or elevation prompt

For users to be able to add their own print drivers you will have to use a GPO to edit the Driver Installation policy for your domain. It is located here:

Computer Configuration\Policies\Administrative Templates\System\Driver Installation

The setting is called "Allow non-administrators to install drivers for these devices setup classes". Our Group Policy setting has the comment "Allows Windows 7 Standard users to install local print drivers" You will need to add the device class GUID of printers you allow standard users to install.

The GUIDs can be found here: http://msdn.microsoft.com/en-us/library/ff553426(v=vs.85).aspx

We have the following classes enabled

Printers, Bus-specific class drivers:

Class = PNPPrinters ClassGuid = {4658ee7e-f050-11d1-b6bd-00c04fa372a7}

ClassGUID = {4d36e977-e325-11ce-bfc1-08002be10318} for Printers in general and

ClassGUID = {48721b56-6795-11d2-b1a8-0080c72e74a2} for IEEE devices

enter image description here

Improve this answer
5
  • "I'm aware of the setting for suppressing UAC prompts for point and print, I'm not concerned with point and print at the moment)" I know about the point and print settings, they don't affect local printer installations. Thanks for participating.
    – BlueCompute
    Dec 16, 2015 at 10:27
  • I apologize for the information not being correct. In our environment, standard users on our Windows 7 Pro computers receive no UAC prompt for local printer and scanner installs (the few we have) and we have the Point and Print settings I answered above. I was looking through our Group Policy settings and found a setting that is configured and it is not Point and Print.
    – Art.Vandelay05
    Dec 16, 2015 at 14:23
  • Please see edit above in my answer. Again, I apologize for giving incorrect information. The edit gives the correct information for standard "non-admin" users to install local printers on domain joined computers without UAC prompt.
    – Art.Vandelay05
    Dec 16, 2015 at 14:35
  • Thanks, I did try the 'device classes' setting, but I'll check which GUIDs I used and do some more testing. Thanks!
    – BlueCompute
    Dec 17, 2015 at 9:56
  • You are welcome! Yeah, let me know how it works.
    – Art.Vandelay05
    Dec 17, 2015 at 14:32
0

As for Printers, I haven't used (and wasn't aware of) the GPO setting you refer to. In the environment I manage, I configured the setting Computer Configuration\Administrative Templates\Printers\Point and Print Restrictions.

The first section of the description reads:

This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain

I enabled the policy setting, added the FQDN of the print server(s) in the first field and configured both security prompts to "Do not show warning or elevation prompt".

Changing network settings, including enabling/disabling WiFi, on a Windows box can't be done as an ordinary user, if I'm not mistaken. Usually there's a hardware or soft switch for that. If that's not an option to you, you will probably need to add the users to the local "Network Configuration Operators" group.

Improve this answer
1
  • I'm aware of the point and print section, I'm not concerned with shared printers, but local installs. When I add the users to the Network Configuration Operators group I still get a UAC prompt, but you can enter the user's credentials and they're accepted. I'm trying to find out whether this is expected.
    – BlueCompute
    Nov 4, 2014 at 22:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .