Access Denied: Restricting Users' Ability to Install Printer Drivers

[Editor's Note: Do you have a security-related question about Windows 2000? Send it to [email protected], and you might see the answer in this column!]

All my users have Windows 2000 Professional workstations. I've removed all users from the local Administrators group and would like to remove them from Power Users while still letting them install printer drivers locally. How can I let users install printer drivers if they aren't local Administrators or members of Power Users?

Users who belong to the local Users group can install printer drivers by default—you don't need to do anything special. To restrict this ability to Administrators and Power Users, you can tweak the registry. Navigate to the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlPrintProvidersLanMan PrintServicesServers registry subkey, then set AddPrinterDrivers to 1. The default value of 0 lets users install printer drivers.

An easier way to control this option is to use Group Policy. In any Group Policy Object (GPO), go to Computer Configuration, Windows Settings, Security Settings, Local Policies, Security Options, then disable the Prevent users from installing printer drivers policy.