Group Policy Windows Server 2003

[Hammertime]

Hi there,

I've recently migrated our OU to server 2003 and now have most users connected to the domain so I can adminster the PC's using GP. I've configured it so far that users can install network printers and delete them however they can't install local printers, the option is graded out. Using GP editor i've gone into User Config>Admin Templates>Control Panel>Printers and disabled both options for the prevention of adding and deleting printers however still can't add local printers. I've also allowed Windows Installer to be used by users with elevated permissions.

What else needs to be enabled/disabled to allow users to install local printers?

 

[thedel]

If a domain level policy is not enforced, then the local policy of each individual machine takes over. Installing a local printer is such a function, so what is configured in terms of local user rights on the workstation?

 

[Hammertime]

The GP on the local PC's is no different from the GP of a newly installed XP/2000 computer, I assumed that no changes need to be made as everything could be administrated through GP of the OU?

 

[tfg13]

Hammertime,
Have you checked to see what you have as far as the computer settings? Computer config->Windows Settings->Security settings->Local Policies->Security Options->Devices: Prevent users from installing printer drivers

Check that. Hopefully it is set at not configured, or at least have domain users, or users in there. If the settings are correct, have you backed off the policy and then tested to see if a user can add a local printer?

 

[Hammertime]

The local setting on the PC was set to 'Enabled' to prevent users from installing printer devices which I now now 'Disabled'. GP wise on the OU the prevention of installing printing devices was set to disabled to which now I have set as Not Defined. However, when I log in as a user on the domain I still cannot install local printers.

 

[tfg13]

What do you have for your local system? Testing on one box will help you isolate whether the problem is located on the local system, or if it is within your OU Group Policy

 

[Hammertime]

I'm using XP Pro, I understand how GP works however what I really need to know is what options to enable/disable to allow the installation of local printers and software when users log on.

I'm getting round the problem at the moment by adding users to their workstations as local Admins through the domain (Domain\username) however this is not practical for long term use!

Can anyone help please?