NT Gatekeeper: Restricting Printer-Driver Installation

[Editor's Note: Do you have a security-related question about Windows NT? Send it to [email protected], and you might see the answer in this column!]

I discovered that by default, anyone who can log on to a Windows NT 4.0 machine can install printer drivers. Can I restrict this right to Administrators (on servers and domain controllers—DCs) and Powers Users (on workstations)?

To restrict all NT 4.0 printer-driver installation to Administrators (on servers and DCs) and Power Users (on workstations), you can set the addprintdrivers registry value (of type REG_DWORD) to 1. You can find this value in the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPrintProvidersLanMan Print Servicesservers registry subkey. If no printers are installed, you must create the registry subkey before you add the addprintdrivers value.