Home / server / Questions / 641579
In Process
BlueCompute
Asked: 2014-11-04 02:48:49 +0800 CST

Users still get UAC prompt after allowing printer install and alter LAN connection by GPO?

  • 772

I've implemented the following Group Policy settings to allow non-admins to install printer drivers and to enable / disable their wifi:

User Configuration -> Administrative Templates -> Network -> Network Connections -> Ability to Enable/Disable a LAN connection

and

Computer Configuration -> Policies -> Administrative Templates -> System -> Driver Installation -> Allow non-administrators to install drivers for these device setup classes

In both scenarios I still get a UAC prompt, but this can then be filled in with the non-admin user's credentials - so the setting does work, but we get an unexpected UAC prompt and it is not intuitive that the user needs to enter their user credentials in the box that says 'Enter an administrator password...'

Is this expected behaviour? Is there a way of supressing these UAC prompts?

(I'm aware of the setting for suppressing UAC prompts for point and print, I'm not concerned with point and print at the moment)

active-directory

2 Answers

  1. In addition to the other settings mentioned, make sure the bottom Prompts are set in your Group Policy Object for standard users to install local printers without UAC prompts triggering.

    User Configuration > Policies > Administrative Templates >Control Panel/Printers > Point and Print Restrictions

    Security Prompts:

    When installing drivers for a new connection: Do not show warning or elevation prompt

    When updating drivers for an existing connection: Do not show warning or elevation prompt

    For users to be able to add their own print drivers you will have to use a GPO to edit the Driver Installation policy for your domain. It is located here:

    Computer Configuration\Policies\Administrative Templates\System\Driver Installation

    The setting is called "Allow non-administrators to install drivers for these devices setup classes". Our Group Policy setting has the comment "Allows Windows 7 Standard users to install local print drivers" You will need to add the device class GUID of printers you allow standard users to install.

    The GUIDs can be found here: http://msdn.microsoft.com/en-us/library/ff553426(v=vs.85).aspx

    We have the following classes enabled

    Printers, Bus-specific class drivers:

    Class = PNPPrinters ClassGuid = {4658ee7e-f050-11d1-b6bd-00c04fa372a7}

    ClassGUID = {4d36e977-e325-11ce-bfc1-08002be10318} for Printers in general and

    ClassGUID = {48721b56-6795-11d2-b1a8-0080c72e74a2} for IEEE devices

    enter image description here

    • 3

  2. As for Printers, I haven't used (and wasn't aware of) the GPO setting you refer to. In the environment I manage, I configured the setting Computer Configuration\Administrative Templates\Printers\Point and Print Restrictions.

    The first section of the description reads:

    This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain

    I enabled the policy setting, added the FQDN of the print server(s) in the first field and configured both security prompts to "Do not show warning or elevation prompt".

    Changing network settings, including enabling/disabling WiFi, on a Windows box can't be done as an ordinary user, if I'm not mistaken. Usually there's a hardware or soft switch for that. If that's not an option to you, you will probably need to add the users to the local "Network Configuration Operators" group.

    • 0