Install printers as a non admin on a laptop

[cyberhh]

One possible solution:

Create a local user account for the laptop user. Call it [username]ad - that way they realize that they are logged in using increased permissions. Give those user ID's Power User rights, this should allow them to add printers to the laptops that are available to their normal profile. Another option would be to have an OU created called "mobile workforce" and add all your laptop users to it, you could then have the group policy ignored for this OU and a new one created for them.

[Weyland]

Thanks for all the inputs to this question. I actually have thought about all the suggestion ranging from different GPO's applied to different Groups or OU's to new userid on the local laptop to making them Power or Admins. However doing any one of those things can cause a security risk to the laptop (intentional or unintentional). Our laptops are in a lockdown state so users cannot install software or anything else for that matter when they are on the Coprorate LAN and we like to maintain that when they are off net also. So for SA's out there who don't want to give admin or power user rights to users to do a simple printer install, read on

The good news. I found a way to do this. Now a "regular" user to the laptop can have permissions to install printers without making them a local admins. Its based upon the well known runas command.

We created an executable with a third party tool called Autoit (version 3)(www.autoitscripts.com) Basically you will need to find out the name of the .cpl file that needs to be opened. In this case we need to run the "add printer" function. One caveat here though. The original source file *.au3, has the password displayed but once you convert it to an .exe, you can't really "reverse" it out to find out what the local admin password is


For those interested, here is the script:

; AutoIt Version: 3.0
; Language: English
; Platform: Win9x / NT - NOTE :this works on XP also
; Author: A.N.Other <[email protected]>
;
; Script Function:
; Template AutoIt script.
;
; ----------------------------------------------------------------------------


; ----------------------------------------------------------------------------
; Set up our defaults
; ----------------------------------------------------------------------------

;AutoItSetOption("MustDeclareVars", 1)
;AutoItSetOption("MouseCoordMode", 0)
;AutoItSetOption("PixelCoordMode", 0)
;AutoItSetOption("RunErrorsFatal", 0)
;AutoItSetOption("TrayIconDebug", 1)
;AutoItSetOption("WinTitleMatchMode", 4)


; ----------------------------------------------------------------------------
; Script Start
; ----------------------------------------------------------------------------
RunAsSet("Administrator", @Computername, "xxxxxxxxx")
Run("C:\Windows\system32\rundll32.exe printui.dll,PrintUIEntry /il", "C:\Windows\system32", @SW_MINIMIZE)


;NOTE here:xxxxxx=password of the local computer administrator

[Weyland]

Oh I forgot. Once you convert the .au3 file to a .exe, all you do is copy the .exe to the laptop somewhere, create a shortcut to it and have the user doubleclick it to launch the Printer wizard

Cheers!

[cyberhh]

The link for AutoIT is: http://www.autoitscript.com/autoit3/index.php