“Access denied” when adding a shared printer — Windows policies

Joe B.

Reviewed for technical accuracy

Specialities: Windows Server & Windows 11/10, Group Policy, SMB/Print Spooler, Office/Apps

Windows 11/10 shared printer “Access denied”, error 0x0000011b / 0x00000709 — Point and Print, SMB permissions, RPC privacy

Technician

Hey! We’ll solve the “Access denied” adding a shared printer problem. Tell me: are you connecting to a printer shared from a Windows PC or print server, what’s the exact error code (e.g., 0x0000011b, 0x00000057, 0x00000709), and whether the devices are on a domain or workgroup network. We’ll check Point and Print restrictions, RPC Authentication Level Privacy, and SMB share permissions.

Customer

Windows 11 Pro laptop adding a printer shared from a Windows 10 desktop. Error 0x0000011b or sometimes “Access denied”. Both machines are in a workgroup. The share is like \\DESKTOP\HP_Laser.

Technician

Got it. Since late 2021, Windows tightened print security (aka PrintNightmare hardening). Common causes of 0x0000011b access denied when connecting over SMB are:
• RPC privacy enforcement (RpcAuthnLevelPrivacyEnabled) mismatched between client and server.
• Point and Print restrictions block installing drivers from non-trusted servers.
• The server exposes a Type 3 or old Type 4 driver requiring admin; client blocks it.
• SMB/NTFS permissions or missing credentials on the host (Everyone/Authenticated Users not allowed to print).
• Firewall or services (Print Spooler, Function Discovery, SSDP) not running.
Plan: verify services, set policy to allow connecting to the print server, align RPC privacy, then connect using \\server\share or \\server\print$ with credentials.

Customer

Where do I change those Point and Print and RPC privacy settings on Windows 11?

Technician

Fix 0x0000011b / Access denied via policy (Windows 10/11):
1) Open gpedit.msc → Computer Configuration → Administrative Templates → Printers.
2) Set Configure RPC connection settings → Enabled; choose RPC over named pipes and set Authentication Level = Packet (disables privacy requirement) OR keep Default protocol and set the same on the server. Apply and restart the Print Spooler.
3) Go to Computer Configuration → Administrative Templates → Printers → Point and Print Restrictions → Enabled; set Users can only point and print to these servers and add your server (e.g., DESKTOP or FQDN). Set both prompts to Show warning and elevated prompt: Disabled if you trust the server.
4) Optional registry for non-Pro editions: HKLM\System\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled = 0 (DWORD). Then restart the spooler: services.msc → Print Spooler → Restart.

Customer

Do I need to change anything on the host PC that shares the printer?

Technician

Yes — fix the print server / host:
• Ensure Settings → Bluetooth & devices → Printers & scanners → your printer → Printer properties → Sharing → Share this printer is enabled, share name simple (no spaces).
• In Security tab grant Print to Everyone or Authenticated Users. Keep Manage printer only for admins.
• Install a trusted, package-aware x64 driver (Type 3 or v4) matching the OS. Avoid very old drivers that require admin on clients.
• Match the client’s RPC privacy policy (same gpedit path). If client uses “Packet” level, set the server the same or set registry RpcAuthnLevelPrivacyEnabled=0.
• Confirm services: Print Spooler, Function Discovery Provider Host, Function Discovery Resource Publication, SSDP Discovery, UPnP Device Host. These publish the printer for Network Discovery.

Customer

What if it still says “Access denied” after the policy change?

Technician

Try these quick wins:
• Connect using the server’s IP: \\192.168.X.X\PrinterShare to avoid name resolution issues.
• Clear stale connections: Control Panel → Credential Manager → remove cached entries for the server, then reconnect and enter the host’s local admin/user credentials.
• Temporarily switch to the built-in Microsoft IPP Class Driver by adding via Settings → Add a printer → The printer I want isn’t listed → Add a printer using a TCP/IP address → Type: Web Services / Internet Printing (IPP). If IPP connects, the SMB policy is the blocker.
• On the server, check Windows Defender Firewall → allow File and Printer Sharing and Network Discovery for Private networks.

Customer

We also see 0x00000057 while installing the driver from the share.

Technician

That’s a corrupt or blocked driver cache. On the client:
1) Open Print Management → All Printers and remove failed queues.
2) Print Management → All Drivers → remove the offending model; stop/start Print Spooler.
3) Create policy to Allow non-administrators to install drivers for these devices (if you use device installation restrictions).
4) Reconnect to the share; Windows should pull the package-aware driver successfully.

Customer

Any differences for domain environments with a real print server?

Technician

In a domain, use Group Policy Preferences → Printers or Intune to deploy queues. Trust only authorized servers via Point and Print Restrictions (list FQDNs), sign drivers, and keep the server on Type 4 v4 drivers where possible. For mixed fleets, enable Package Point and Print and align RPC privacy on both server and clients.

Customer

We get “Windows cannot connect to the printer. Operation failed with error 0x00000709”.

Technician

0x00000709 usually means name/permission conflicts. Use the IP address path, ensure the printer name is short (no special chars), and Credential Manager contains correct credentials to the host. If it persists, clean the client’s registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows values Device and UserSelectedDefault (careful), then reconnect.

Customer

Okay, after policy + permissions, it finally connects. Anything else to lock it down?

Technician

Best practices: keep Windows updated, use signed, package-aware drivers, restrict Point and Print to specific servers, and avoid “AllowThisServerException” wildcards. Consider IPP over HTTPS for modern models — it avoids SMB and many policy headaches.

Customer

Perfect — shared printer connects without errors now. Thanks!

Technician

Summary: To fix “Access denied” when adding a shared printer (Windows 11/10) or errors 0x0000011b/0x00000709, align RPC privacy, configure Point and Print to trust your server, use package-aware drivers, and verify SMB permissions & firewall. Need hands-on help? Open the chat.

Quick answer: the accepted fix

Accepted fix when Windows 11/10 shows “Access denied” or 0x0000011b adding a shared printer: set Configure RPC connection settings (Packet / Named pipes), allow trusted servers in Point and Print Restrictions, install package-aware x64 drivers on the host, and verify SMB share & print permissions. Restart the Print Spooler and reconnect via \\server\share.

FAQ

Step-by-step (Windows client)

1. Run gpedit.msc → set Configure RPC connection settings to Enabled → Authentication Level Packet; Protocol RPC over named pipes (or match server).
2. Enable Point and Print Restrictions and list your trusted print server(s); disable elevation prompts for trusted sources.
3. Restart Print Spooler, clear Credential Manager entries for the server.
4. Add the printer via \\server\share or \\IP\share. If blocked, add an IPP queue or direct TCP/IP port.

Step-by-step (Print server / host)

1. Install a signed, package-aware x64 driver; avoid legacy Type 3 without packages.
2. Share the printer and grant Print permissions to Authenticated Users (or specific users/groups).
3. Match the client’s RPC policy; if needed set RpcAuthnLevelPrivacyEnabled=0 (trusted LAN only).
4. Allow File and Printer Sharing in Firewall; start discovery services; verify name resolution or use a static IP.

Sources

• Microsoft Docs — Point and Print Restrictions
• Microsoft Docs — Configure RPC connection settings for Print
• Microsoft — Fix printer connection & printing problems
• Microsoft — Error 0x0000011b when installing network printer

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.