Limits print driver installation to Administrators
This `REG_DWORD` value controls whether non-administrators can install or update print drivers through Point and Print.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators
This REG_DWORD value controls whether non-administrators can install or update print drivers through Point and Print.
A value of 1 requires administrator privileges whenever Point and Print must install a print driver supplied by a remote computer or print server on the local computer. On Windows systems with updates released August 10, 2021 or later, the same protected behavior applies when the value is absent.
A value of 0 removes this general administrator-only restriction. Non-administrators may then be able to install or update signed and unsigned print drivers supplied through Point and Print. Other Point and Print policies can still restrict or prevent those installations.
Notes
Additional effects
A value of 1 overrides Point and Print Restrictions policy settings to the extent that those settings would otherwise permit a non-administrator to install a driver.
A value of 0 does not override the other Point and Print policy settings. Restrictions on approved print servers and requirements for warning or elevation prompts can therefore remain effective.
Security
Print driver installation is a security-sensitive operation. With the value set to 0, a non-administrator may be able to install a signed or unsigned driver supplied by a print server. A malicious or compromised server could use this capability to deliver a modified driver.
Microsoft introduced the administrator requirement by default in connection with CVE-2021-34481. Microsoft states that no combination of additional Point and Print mitigations provides protection equivalent to RestrictDriverInstallationToAdministrators = 1.
Possible side effects
When a new printer connection requires a driver to be installed, or an existing driver must be updated, a non-administrator may be prompted for administrative credentials. Without elevation, Windows cannot complete the connection or update the required driver.
This can affect automated deployment of shared printers when the necessary driver is not already present on the client.
Notes
The value applies to the computer as a whole. Creating or changing it does not require a restart.
Windows updates released August 10, 2021 or later use the behavior represented by 1 as the default. The updates do not create the registry value or modify an existing value.
Microsoft documentation
Microsoft Learn: Printers Policy CSP – RestrictDriverInstallationToAdministrators
Microsoft Support: KB5005652—Manage new Point and Print default driver installation behavior