Intune: Configure Printers for Non-Administrative Users

Configuring printers for end users or giving them the ability to do it themselves is a normal requirement for organizations. Now if your users are Administrators, then the configuration can be straight forward, but in case of Non-Administrators there are additional steps required as Non-Administrators will not be able to add a driver in the driver store despite being able to install a printer.

In this blog, I will cover the steps that I took to address this requirement using Intune.

The setup involves 2 steps - 

1. Setup registries.

2. Install the driver and configure the printer

Setting up registries –

The registries that need to be configured are actually part of a GPO setting –

Allow non-administrators to install drivers for these device setup classes

It can be found under:

Computer Configuration -> Policies -> Administrative Templates -> System -> Driver Installation

I used a Powershell script to set the values and wrapped it in a Win32 application.

$Path1 = "HKLM:\Software\Policies\Microsoft\Windows\DriverInstall\Restrictions\AllowUserDeviceClasses"

$Path2 = "HKLM:\Software\Policies\Microsoft\Windows\DriverInstall\Restrictions"

$reg1 = "Printer"

$value1 ="{4658ee7e-f050-11d1-b6bd-00c04fa372a7}"

$reg2 = "PNPprinter"

$value2 ="{4d36e979-e325-11ce-bfc1-08002be10318}"

$reg3="AllowUserDeviceClasses"

$value3 = 1

New-ItemProperty -Path $Path1 -Name $reg1 -Value $value1 -PropertyType String | Out-Null

New-ItemProperty -Path $Path1 -Name $reg2 -Value $value2 -PropertyType String | Out-Null

New-ItemProperty -Path $Path2 -Name $reg3 -Value $value3 -PropertyType DWord | Out-Null

Install Driver & configure the Printer-

Method 1

The next part is the installing and adding the configuration of the Printer. I used the method covered 

below to configure Ricoh and Canon Printers, but I see no reason why the same cannot be used for configuring printers by other vendors.

I created the following folder structure with the driver and scripts inside.

 

Install.cmd contains the following –

@echo off

mkdir c:\PrinterDrivers\Ricoh

xcopy *.* /h /c /k /e /r /y c:\PrinterDrivers\Ricoh

icacls c:\PrinterDrivers\Ricoh /grant Everyone:(OI)(CI)F /T

C:\Windows\System32\pnputil.exe /add-driver c:\PrinterDrivers\Ricoh\oemsetup.inf /install

powershell.exe -executionpolicy bypass -command "& '.\Install.ps1' "

Install.ps1 contains the following –

Get-ChildItem C:\PrinterDrivers\Ricoh -Filter *.inf -Recurse | % {pnputil.exe /a $_.FullName}

Add-PrinterDriver -Name "RICOH MP C3004EX PCL 6"

Add-PrinterPort -Name "RicohMP3004ex" -PrinterHostAddress "xx.xx.xx.xx"

Add-Printer -Name "Ricoh MP 3004ex" -DriverName "RICOH MP C3004EX PCL 6" -PortName "RicohMP3004ex"

Set-PrintConfiguration -PrinterName "Ricoh MP 3004ex" -PaperSize A4 -Color $false -DuplexingMode TwoSidedLongEdge

Using the IntuneWinAppUtil.exe, I wrapped the contents to create a Win32 application and added in Intune. For Install command line I used the Install.cmd script and for detection, I used the following –

Method 2

In case the first method doesn't yield any success, then one can use prndrvr.vbs to configure the printers. Microsoft has developed several VBS scripts that allow you to manage printers and print queues, install and uninstall printer drivers, etc.

These scripts are present in all Windows versions (starting from Vista and Windows Server 2008) and are located in the directory C:\Windows\System32\Printing_Admin_Scripts\en-US

I recently used the prndrvr.vbs to configure printers for Kyocera and this is how I set it up -

Download the printer drivers and place them in the following folder structure.

Install.cmd - This will copy the content of the Printerdrivers to a custom location on the remote device. Post which prndrvr.vbs will be called to install the relevant oemsetup.inf driver and then calling the Install.ps1 to apply the configuration of the printer.

@echo off

mkdir c:\PrinterDrivers\KyoceraFS4020DN

xcopy *.* /h /c /k /e /r /y c:\PrinterDrivers\KyoceraFS4020DN

cscript "C:\Windows\System32\Printing_Admin_Scripts\en-US\prndrvr.vbs" -a -m "Kyocera FS-4020DN KX" -i "C:\PrinterDrivers\KyoceraFS4020DN\Printerdrivers\oemsetup.inf"

powershell.exe -executionpolicy bypass -command "& '.\Install.ps1' "

Install.ps1

#Install Printerport with check if the port already exist

$portName = "IP_10.12.xxx.xxx"

$checkPortExists = Get-Printerport -Name $portname -ErrorAction SilentlyContinue

if (-not $checkPortExists) {

Add-PrinterPort -name $portName -PrinterHostAddress "10.12.xxx.xxx"

}

#Install Printer

Add-Printer -Name "Kyocera FS-4020DN KX" -DriverName "Kyocera FS-4020DN KX" -PortName $portName

End Result –

The registry gets created for the Printer.

 The folder structure is created and the content gets copied.

The printer is configured with the values specified. 

References –

Allow non-administrators to install drivers for these device setup classes (admx.help)

System-Defined Device Setup Classes Available to Vendors - Windows drivers | Microsoft Docs

prndrvr | Microsoft Docs