Administrators can configure a trusted path that Windows will search for the needed printer driver instead of loading it from the network print server. Even with this setting enabled, unprivileged users may still install network printer drivers if the computer can find the driver on the “trusted path”. Well it does make sense in the context of Terminal Services and I think that’s what this policy is really all about read on.Īnyway, if this setting is enabled, only Administrators (and according to some documentation, Power Users) are allowed to install printer drivers for network printers on another Windows server. This setting has effect on users ability to install printer drivers in the context of adding a local printer. But in Windows’ twisted view of the world, a network printer to which you directly connect (without going through a print server) is a “local” printer – you just use a “Standard TCP/IP Port” instead of a LPT, COM or USB port. The right terminology would be to have called it a shared printer in my opinion, instead of network printer.
This is not to be confused with a standalone network printer to which you connect directly with via TCP/IP. This setting apparently only applies to installing printer drivers in the context of adding a network printer. If enabled this is limited to Administrators, Power Users, or Server Operators.
The idea of this setting is to protect against users loading untrusted, potentially unstable or malicious printer drivers which in most versions of Windows run in Kernel mode. WinSecWiki > Security Settings > Local Policies > Security Options > Devices > Prevent users from installing printer driversĭevices: Prevent users from installing printer drivers
0 kommentar(er)
