Allow users to install local printers

[ncolsgk]

I apologize for the double-post but Im in need on an answer.

I would like to allow users of my domain to install local printers. If I add them to the Power Users group, wont that give them the ability to install applications? Im trying to prevent that for obvious security reasons. Can I just grant them the "load and unload device drivers right" without adding them to the Power users group?

To install or modify a local printer, a user must either be a member of the Administrators group or a member of the Power Users group.

If the user is a member of the Power Users group, they must be granted the Load and unload device drivers right:

Default Domain group policy at Computer Configuration / Windows Settings / Security Settings / Local Policies / User Rights Assignment

or

Local Security Policy at Security Settings / Local Policies / User Rights Assignment.

 

[TechSoEasyMVP]

Generally in a Small Business Server network, users are members of the local administrators group because of the way SBS deploys distributed applications.

If you've removed the user from that group then I'd suggest you put them back and then if you are worried about installing applications you should enforce that by using Software Restriction Policies:

http://support.microsoft.com/kb/324036

Jeffrey B. Kane
TechSoEasy

http://www.techsoeasy.com

Blog:

http://techsoeasy.spaces.live.com