Allowing users to install local printers

[dcaine]

Hello All,

I have 50 laptop users who occasionally need to install a local printer while on the road. Currently all machines are locked down so that no new hardware can be installed. Is there a way through GP or even an ADM to allow users to install just a local printer without opening the floodgates for other devices (MP3 players, etc..). I've tried various KB articles from MS like 331055 but I have not had much luck.

Thanks in advance

[AdamV]

What's the OS?
You should be able to do this by making them Power Users rather than regular users, but this does expose some risks.
Technically this allows them to install drivers, which are executable code, and you don't control the code, so a malformed driver could be used as an exploit </theoretical attack>

[dcaine]

They are a mix of 2000 and XP, all soon to be XP. I don't want to make them Power users becasue that opens a whole mess of other securty issues.

[AdamV]

I know, but that's the "answer in the book".
You will need to do some hunting through the local policy > user rights assignment and find the right settings to enable driver installation. If I get time I'll take a look into this.

[dcaine]

I know this has to have come up in somebody's environment. Can anyone else offer any suggestions?

[Trammel]

Yes, I ran across it my self. We ended up making our laptop users power users so they could install LOCAL printers. You will definatley have to do some digging in order to loosen them up. You can also try running the compatwsf.ini on the machine which basicaly makes users almost as powerfull as the power users group. Yet there not in the power users group.
As for printer drivers go, it's computer configuration>windows settings>local policies>security option>devices: Prevent users from installing printer drivers