Windows 7 Add Network Printer Access Is Denied Fix

March 10, 2010 — 20 Comments

One of our support clients is just starting to test Windows 7 in their business network and have already come up against a few issues with legacy applications, which we were expecting, but one problem we did not predict was standard users not being able to add network printers from the print server… However we have now resolved this so I thought I would share the solution for anyone else having the same problem.

What we were seeing was that when a local administrator on the Windows 7 machine tried to add a printer that was shared from our printer server there were no problems, but when a non-admin user tried they got an error saying “Cannot connect to printer. Access is denied”. I searched and searched on google but the only thing I could find was relating to Windows Vista and the solution did not work for me. So I started looking at group policies on the Windows 7 machine and found one named Point and Print Restrictions which seemed to do the trick! This policy can be found in the following location:

Computer Configuration ->  Administrative Tempates -> Printers

Note that you must be on a Vista/Win7/2008 machine to be able to see this policy in the group policy editor.

You can either just set this setting to Disabled or you can set it to Enabled and then specify which print servers you want users to be allowed to add printers from (personally I just set it to “any in this forest”). Now do a gpupdate from the Windows 7 computer, reboot, and you should now be able to add network printers when logged in as a regular user.

Hope that helps a few people out, and while you’re here feel free to check out all of my tools for IT Professionals on my website here: http://www.cjwdev.co.uk/Software.html

EDIT: I wrote this blog post a long time ago but it still gets hundreds of hits a week, so I thought I’d add a few more details and other things to look into if the fix mentioned above doesn’t resolve your problem.

When a non-admin user installs a printer, the printer driver needs to be installed and this is usually the reason why the Access Denied error appears (because only admins can install drivers). If a printer that uses that driver has already been installed on that PC then they won’t have a problem, so one workaround is to just log on to the user’s PC as admin and install the printer from the print server as normal so that the driver gets installed, then when the user logs back on and tries to add the printer on their profile it should work fine. The reason the GPO mentioned in the original part of this blog post works is that it basically lets non-admin users install drivers as long as those drivers came from a shared printer installation from one of the print servers in your domain (or whatever you set the GPO options to). I guess another potential solution would be to use a computer based GPO startup script or software deployment tool such as SCCM to push out a script to all of your affected user’s PCs, and have this script install the drivers for the problem printers (because it would be running as Local System it won’t have any problems with installing the drivers).

Also I think if you deploy printers via the Preferences section of a GPO, that takes care of installing the driver with admin permissions (well, running as Local System) even though the printer connection itself gets installed as the logged on user. I can’t find any technical documentation to back this up though…

20 responses to Windows 7 Add Network Printer Access Is Denied Fix

  1. 

    Finally found a working solution!
    Thanks a ton! You’re a genius!

  2. 

    Thank you so much for the help! I’ve googled all day long and tried atleast 5 other “solutions”, but this one really worked! THANKS!

  3. 
    Bill Antolec June 10, 2011 at 04:32

    Similar problem only working in a workgroup – not a domain. Printer installed on one Windows 7 computer and shared on the workgroup. Trying to install from an identical Windows 7 computer in the same workgroup. Admin user has not problem installing or printing. Standard User cannot see the printer and is denied access to the computer!

    Any ideas?

    Thanks, Bill

  4. 

    Don’t you just love it! The solution seems to fit the problem, but …..

    Where do you find “Computer Configuration” to be able to make any changes?

    Can you help, please?

    • 

      in the group policy editor – you need to create a new GPO or edit an existing one that applies to the computers you want this to affect. If you’ve no idea what group policy is or how to create a GPO, I suggest you do a bit of googling 🙂

    • 

      you can accsess group policy editor in Seven By Run and then entering gpedit.msc

  5. 

    gpedit.msc not available on Windows 7 Home Premium. . I don’t know what security issues Microsoft is addressing by disallowing users to connect to XP printers from Win7 without extraordinary and, now, seemingly impossible efforts.

  6. 

    What do you do if you have Windows 7 systems on a WIndows 2003 domain? Is there a Windows 2003 policy that works like Point and Print Restrictions? Thanks!

    • 

      Doesn’t matter if the domain is 2003, all you need is one windows 7 machine with the admin tools (RSAT) installed and then you can use that to edit the GPO (using Group Policy Management Console) to set this setting

  7. 

    I hope you can help me. I’m on a windows 7 machine which runs through our company server. I’ve got all the other printers on our network installed but when I try to install the HP designjet 100Plus, it finds it on the network but says access is denied. I found another workaround where a guy had installed a network printer as a local printer, using the computer & printer name, but that still gave me an access denied error. I modified the group policy as you describe above and tried again and access is still denied. I feel like putting my fist through the very nice 23″ monitor in front of me but I realize that won’t help! Do you have any ideas?

  8. 

    I have same problem with server Win2008 R2 client win7 , I tried GPO to disable / enable the Print & redirect but nothing, but I find a solution it solved just add all clients to the printer server (PC that printer is directly install ).

  9. 

    i have same problem but in a standard user of a work group stand alon PC

  10. 

    Thanks, this article headed me in the right direction. The GPO setting may or may not work depending on your scenario. Combine it with loading the printer driver(s) on the client computer, problem gone.

    • 

      Glad to hear that 🙂 and yeah if you install the print driver on the client computer you don’t even need to touch this GPO setting – this is more of a workaround for people that can’t easily do that on all of their PCs

  11. 

    Same problem, different solution. In my case all of the permissions on the C:\Windows\System32\Spool\Printers and C:\Windows\System32\Spool\Drivers\w32x86 folders were removed. By taking ownership of these folders and resetting permissions I was then able to add new printers… Happy days!

  12. 

    It appears that this can also be deployed using a GPO in case anyone needs to do it that way…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s