16 KiB
title, description, ms.author, ms.topic, ms.prod, ms.technology, author, ms.localizationpriority, ms.date, ms.reviewer, manager
| title | description | ms.author | ms.topic | ms.prod | ms.technology | author | ms.localizationpriority | ms.date | ms.reviewer | manager |
|---|---|---|---|---|---|---|---|---|---|---|
| Policy CSP - Printers | Use this policy setting to control the client Point and Print behavior, including security prompts for Windows Vista computers. | dansimp | article | w10 | windows | dansimp | medium | 09/27/2019 | dansimp |
Policy CSP - Printers
Printers policies
- Printers/ApprovedUsbPrintDevices
- Printers/ApprovedUsbPrintDevicesUser
- Printers/EnableDeviceControl
- Printers/EnableDeviceControlUser
- Printers/PointAndPrintRestrictions
- Printers/PointAndPrintRestrictions_User
- Printers/PublishPrinters
Tip
These are ADMX-backed policies and require a special SyncML format to enable or disable. For details, see Understanding ADMX-backed policies.
You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to Enabling a policy.
The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see CDATA Sections.
Printers/ApprovedUsbPrintDevices
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy implements the print portion of the Device Control requirements.
These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network.
This policy will contain the comma-separated list of approved USB Vid&Pid combinations that the print spooler will allow to print when Device Control is enabled.
The format of this setting is <vid>/<pid>[,<vid>/<pid>]
Parent deliverable: 26209274 - Device Control: Printer
ADMX Info:
- GP Friendly name: Support for new Device Control Print feature
- GP name: ApprovedUsbPrintDevices
- GP path: Printers
- GP ADMX file name: Printing.admx
Printers/ApprovedUsbPrintDevicesUser
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy implements the print portion of the Device Control requirements.
These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network.
This policy will contain the comma separated list of approved USB Vid&Pid combinations that the print spooler will allow to print when Device Control is enabled.
The format of this setting is <vid>/<pid>[,<vid>/<pid>]
ADMX Info:
- GP Friendly name: Support for new Device Control Print feature
- GP name: ApprovedUsbPrintDevicesUser
- GP path: Printers
- GP ADMX file name: Printing.admx
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy implements the print portion of the Device Control requirements.
These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network.
This policy will control whether the print spooler will attempt to restrict printing as part of Device Control.
The default value of the policy will be Unconfigured.
If the policy value is either Unconfigured or Disabled, the print spooler won't restrict printing.
If the policy value is Enabled, the print spooler will restrict local printing to USB devices in the Approved Device list.
ADMX Info:
- GP Friendly name: Support for new Device Control Print feature
- GP name: EnableDeviceControl
- GP path: Printers
- GP ADMX file name: Printing.admx
Printers/EnableDeviceControlUser
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy implements the print portion of the Device Control requirements.
These requirements include restricting printing to USB connected printers that match a list of approved USB Vid/Pid combinations or to corporate connected printers while either directly connected to the corporate network or when using a VPN connection to the corporate network.
This policy will control whether the print spooler will attempt to restrict printing as part of Device Control.
The default value of the policy will be Unconfigured.
If the policy value is either Unconfigured or Disabled, the print spooler won't restrict printing.
If the policy value is Enabled, the print spooler will restrict local printing to USB devices in the Approved Device list.
ADMX Info:
- GP Friendly name: Support for new Device Control Print feature
- GP name: EnableDeviceControlUser
- GP path: Printers
- GP ADMX file name: Printing.admx
Printers/PointAndPrintRestrictions
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
If you enable this policy setting:
-
Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver isn't available on the client, no connection will be made.
-
You can configure Windows Vista clients so that security warnings and elevated command prompts don't appear when users Point and Print, or when printer connection drivers need to be updated.
If you don't configure this policy setting:
-
Windows Vista client computers can point and print to any server.
-
Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print.
-
Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated.
-
Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.
If you disable this policy setting:
-
Windows Vista client computers can create a printer connection to any server using Point and Print.
-
Windows Vista computers won't show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.
-
Windows Vista computers won't show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.
-
Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.
-
The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
ADMX Info:
- GP Friendly name: Point and Print Restrictions
- GP name: PointAndPrint_Restrictions_Win7
- GP path: Printers
- GP ADMX file name: Printing.admx
Example:
Name: Point and Print Enable Oma-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/PointAndPrintRestrictions
Data type: String Value: <enabled/>
<data id="PointAndPrint_TrustedServers_Chk" value="true"/>
<data id="PointAndPrint_TrustedServers_Edit" value="Printserver1.Contoso.com"/>
<data id="PointAndPrint_TrustedForest_Chk" value="false"/>
<data id="PointAndPrint_NoWarningNoElevationOnInstall_Enum" value="1"/>
<data id="PointAndPrint_NoWarningNoElevationOnUpdate_Enum" value="2"/>
Printers/PointAndPrintRestrictions_User
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- User
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain.
If you enable this policy setting:
-
Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver isn't available on the client, no connection will be made.
-
You can configure Windows Vista clients so that security warnings and elevated command prompts don't appear when users Point and Print, or when printer connection drivers need to be updated.
If you don't configure this policy setting:
-
Windows Vista client computers can point and print to any server.
-
Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print.
-
Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated.
-
Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print.
If you disable this policy setting:
-
Windows Vista client computers can create a printer connection to any server using Point and Print.
-
Windows Vista computers won't show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print.
-
Windows Vista computers won't show a warning or an elevated command prompt when an existing printer connection driver needs to be updated.
-
Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print.
-
The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
ADMX Info:
- GP Friendly name: Point and Print Restrictions
- GP name: PointAndPrint_Restrictions
- GP path: Control Panel/Printers
- GP ADMX file name: Printing.admx
| Edition | Windows 10 | Windows 11 |
|---|---|---|
| Home | No | No |
| Pro | Yes | Yes |
| Business | Yes | Yes |
| Enterprise | Yes | Yes |
| Education | Yes | Yes |
[!div class = "checklist"]
- Device
Determines whether the computer's shared printers can be published in Active Directory.
If you enable this setting or don't configure it, users can use the "List in directory" option in the Printer's Properties' Sharing tab to publish shared printers in Active Directory.
If you disable this setting, this computer's shared printers can't be published in Active Directory, and the "List in directory" option isn't available.
Note: This setting takes priority over the setting "Automatically publish new printers in the Active Directory".
ADMX Info:
- GP Friendly name: Allow printers to be published
- GP name: PublishPrinters
- GP path: Printers
- GP ADMX file name: Printing2.admx