Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Point and Print Restrictions

This computer policy controls Point and Print connections to shared network printers that use non-package-aware print drivers.

since 0.9.8.11

Purpose

Show registry keys (6)
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\Restricted
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\TrustedServers
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\ServerList
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\InForest
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\UpdatePromptSettings

This computer policy controls Point and Print connections to shared network printers that use non-package-aware print drivers. It can restrict the print servers from which driver components may be obtained and determine which security prompts appear when a driver is installed for a new connection or updated for an existing connection.

Restricted, TrustedServers, InForest, NoWarningNoElevationOnInstall, and UpdatePromptSettings are REG_DWORD values. ServerList is a REG_SZ string.

Restricted represents the policy state. A value of 1 enables the restrictions; 0 disables them. When the policy is enabled, the other values provide its individual options:

  • TrustedServers = 1 limits Point and Print to the print servers named in ServerList. ServerList contains the permitted fully qualified server names, separated by semicolons.
  • InForest = 1 restricts connections to computers in the client's own Active Directory forest. This option applies only to Windows Server 2003 and Windows XP SP1 or later service packs of those releases.
  • NoWarningNoElevationOnInstall controls the security prompt when a driver is installed for a new connection. 0 displays a warning and requires elevation; 1 suppresses both.
  • UpdatePromptSettings controls prompting when the driver for an existing connection is updated. 0 displays a warning and requires elevation, 1 displays a warning only, and 2 suppresses both the warning and elevation prompt.

The server list does not itself provide a print driver. If the client has no compatible local driver and the required driver cannot be obtained from a server permitted by the policy, Windows does not create the printer connection.

Notes

Additional effects

This policy operates independently of the Package Point and Print policies. When a package-based connection fails, a client can attempt a non-package Point and Print connection. This policy governs that non-package connection; separate policies control connections that use package-aware drivers.

Microsoft's policy description limits this setting to clients that are not Print Administrators and to domain-joined computers. Because this is the Computer Configuration variant, its settings apply at the computer level.

Security

Print drivers are processed with extensive system privileges. Restricting their source to explicitly named, administratively controlled print servers therefore reduces opportunities to obtain driver components from arbitrary servers. Listing a server in ServerList, however, does not technically validate the server's trustworthiness or the drivers it supplies.

Suppressing warnings or elevation permits less supervised driver installation or updating. Microsoft specifically identifies nonzero values for NoWarningNoElevationOnInstall or UpdatePromptSettings as an insecure configuration on systems with the security updates for CVE-2021-34527.

Beginning with Windows updates released on August 10, 2021, non-administrators require administrator privilege by default to install or update a print driver through Point and Print. The separate RestrictDriverInstallationToAdministrators value controls this behavior. When that value is 1 or absent, it overrides the prompt choices in this policy. Consequently, the values documented here do not by themselves allow non-administrators to install drivers without elevation on current, appropriately updated systems.

Possible side effects

A restrictive or incomplete ServerList can prevent new printer connections when the required driver is not already available locally. Enabling warning and elevation prompts can also prevent users without administrative credentials from completing a new connection or a required driver update.

Notes

This policy does not disable Point and Print itself. It limits eligible servers and controls the security prompts associated with driver installation and updating.

InForest is a compatibility option for older Windows releases and does not provide an additional forest restriction on current Windows clients.

Microsoft documentation

Microsoft Learn: Printers Policy CSP – PointAndPrintRestrictions

Microsoft Support: KB5005010 – Restricting installation of new printer drivers

Microsoft Support: KB5005652 – Manage new Point and Print default driver installation behavior

See also