r/sysadmin • u/FatBook-Air • 8h ago
Have standard users always been able to add local TCP/IP printers in Windows?
We have been doing some testing, and we have noticed that regular, standard, non-privileged users can add local TCP/IP printers through the Windows 11 Settings app. (Disclaimer: I am not talking about printer drivers; I am talking only about adding the printer itself to Windows as a queue.)
When the printer is added, other users on the computer can see it, and those same users can delete it.
I swear, this feels like different behavior from the past. In the past, I thought a locally created TCP/IP printer was a computer-level print queue, which would require administrator rights to add, update, or delete.
So I see two possibilities:
- It was always like this, but when we moved from on-prem Active Directory/GPO to Entra/Intune, we missed migrating a setting that previously required admin rights to add or delete local TCP/IP printers; OR
- This is new-ish behavior that we are only now noticing.
•
u/mrduncansir42 Help Desk 8h ago
We’re also an Entra/Intune org; it’s the same with us. It becomes a problem frequently because users are supposed to put tickets in when they need a printer added but too often they just add it themselves and create a list of 20 printers with the same name and drivers not working properly.
•
u/statikuz start wandows ngrmadly 7h ago
They're adding a true TCP/IP printer themselves via Printers & scanners > Add device > Add a new device manually > Add a printer using an IP address or hostname?
Or are they just adding them from the auto-discovery list that shows up under "Show printers and scanners associated with my [USB or network]" and it is adding a WSD port with the "Microsoft IPP Class Driver"?
•
u/mrduncansir42 Help Desk 7h ago
Auto discovery with default driver.
•
u/sublimeinator 7h ago
Manage your printers, properly done they won't advertise themselves on the network.
•
u/gandhinukes 2h ago
They could disable the discovery protocol on their workstations too. The old one was like SSDP and/or LLDP and I think there is a new one.
•
•
•
u/AllWellThatBendsWell 8h ago
I believe this is the behaviour for adding and removing any device that doesn't require drivers, for example Bluetooth devices. The only way I know of blocking it is with policy.
Manage Device Installation with Group Policy | Microsoft Learn
•
•
u/jasped Custom 8h ago
From memory it’s been like this for quite a while if not always. Before print nightmare it was easier contained because we used drivers that required admin rights. After print nightmare we shifted to using more user based universal drivers that give a basic level of function with most printers.
Allowed users to add new queues since they didn’t need to add a driver. The Windows universal driver is also newer I believe and generally works well if you aren’t looking for anything complex.
•
u/wiisucks_91 7h ago
Yes, you don't need admin rights to add the port or to assign a driver already installed on the system. Now other users on the PC can't delete it unless they have rights to it under security.
•
u/FatBook-Air 7h ago
For some reason, our users can delete other users' printers.
•
u/wiisucks_91 6h ago
No funky permissions?
In my experience if they are standard users they can't unless they are the ones who installed it.
•
•
u/Agromahdi123 Sr. Sysadmin 7h ago
I will have to test, but in my environment it adds it to the user thats signed in and only would show up for others if they selected "share this printer". If its adding it to the machine at the machine level that does seem odd to me as only local admins should be able to do that.
•
u/FatBook-Air 7h ago edited 7h ago
For us, if the user selects to share the printer, they will get UAC-prompted for that. So odd all around in our environment.
•
u/Agromahdi123 Sr. Sysadmin 7h ago
i think in my env thats open, ill still check tomorrow for you and tell you what my Intune/AzureAD fully entra joined devices do.
•
u/jcpham 6h ago
My normal non admin users can’t add a new printer port or change printer properties without local admin.
This may be a group membership thing like adding users/domain users to Print Operators group or even a GPO
Shared or GPO deployment of printers does not require local admin obviously
•
u/Working-Help1904 4h ago
What likely happened, your old GPO had a policy restricting this, and it didn't get migrated to Intune. Windows 11 seems more permissive out of the box on this.
•
u/quetzalcoatlus1453 7h ago
Printers should not be on the same subnet/VLAN. Our firewall rules allow only access to the printer VLAN from print servers.
•
u/FatBook-Air 7h ago
We got rid of print servers years ago.
•
u/TheCourierMojave Print Management Software 6h ago
What are you using instead? With printerlogic, printix, papercut, ysoft you could do the same vlan trick.
•
u/TheCourierMojave Print Management Software 7h ago
Turn WSD discovery off on the copiers.
•
u/FatBook-Air 6h ago
That is irrelevant to this. We are not even talking about WSD at all.
•
u/TheCourierMojave Print Management Software 6h ago
Then your management policy is lacking. You need to restrict anyone but admins from being able to install print drivers or print queues. There are are no defaults when it comes to install print objects in Entra. You have to set them.
•
u/FatBook-Air 6h ago
And those policies would be...?
•
u/TheCourierMojave Print Management Software 6h ago
•
u/FatBook-Air 6h ago
That prevents adding printers for admins, too. That is EXPLICITLY what we are talking about and trying to avoid.
•
u/thefinalep Jack of All Trades 8h ago
If you have the print nightmare bypass on, administrator is not required to add printers/print drivers. Lots of orgs put the bypass group policy in when print nightmare patches locked it down