STATUS_ACCESS_DENIED on print server — user rights assignment

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, Printers, Drivers, Networking, Office Equipment

Fix STATUS_ACCESS_DENIED — correct user rights, Point and Print & printer permissions

Technician

Hey! Let’s fix the STATUS_ACCESS_DENIED on the print server. We’ll check user rights assignment (e.g., “Load and unload device drivers”), share & NTFS permissions on the printer, and Point and Print restrictions so Windows 11/10 users can install the driver without admin prompts. Is this a domain print server with Group Policy, and do clients see the error while adding a shared printer connection?

Customer

Yes, AD domain. Users get STATUS_ACCESS_DENIED when connecting to a shared printer on our Windows Server 2019 print server. It started after recent updates. They also can’t install the driver.

Technician

Got it. On Windows 11/10, security hardening for Point and Print means non-admins can be blocked from installing printer drivers. If the server isn’t on the Approved servers list, if the driver is non-packaged (Type 3), or if user rights assignment and permissions are misconfigured, clients hit STATUS_ACCESS_DENIED. We’ll:
• Confirm share/NTFS permissions give Users “Print”.
• Set Point and Print restrictions to allow your server for Windows 11/10 clients.
• Prefer Type 4 packaged drivers or a Universal Print Driver (HP/Brother).
• If needed, adjust the User Rights Assignment “Load and unload device drivers” for a deployment account (not regular users).

Customer

Where exactly do I change the Point and Print settings and user rights? We need a step-by-step. Our goal is to let standard users connect without local admin.

Technician

5-minute fix — resolve shared printer connection error on Windows 11/10:
1) Permissions: On the print server, open Print Management → Printers → <Your Printer> → Properties. On the Sharing tab ensure “Share this printer”. On Security, grant Domain Users = Print. Keep Manage permissions for admins/print operators only.
2) Point and Print restrictions (GPO): Computer Configuration → Admin Templates → Printers → enable Package Point and Print — Approved servers and add your print server FQDN. Set Point and Print Restrictions to “Show warning and elevation prompt = When installing drivers for a new connection: Do not show warning or elevation prompt for approved servers”.
3) Drivers: Use packaged v4 or a Universal Print Driver. Replacing legacy Type 3 drivers avoids blocks.
4) Spooler restart: Services → Print Spooler → Restart. Retest the connection from the client.

Customer

Some queues are older Type 3 drivers. Clients still fail with access denied. Do we need to change user rights assignment?

Technician

User Rights Assignment & hardening notes:
• For driver deployment from the server, use an admin or deployment service account that has “Load and unload device drivers” on the server. Don’t grant this to everyone.
• Keep regular users as Print only. They do not need Manage Printers.
• If you must support legacy Type 3, ensure the driver is Packaged, or migrate to PCL6/PS v4 or a vendor Universal Print Driver to avoid Windows 11 network printer problem prompts.

Customer

We approved the server in GPO, but some laptops offsite still get STATUS_ACCESS_DENIED over VPN. Anything else to check?

Technician

More things that cause STATUS_ACCESS_DENIED:
• Policy not applied: run gpresult /r on a client; make sure the Printers policies are in the applied GPO list.
• Firewall/RPC: allow File & Printer Sharing and Remote Printing rules. Clients need RPC to the server.
• Credentials: remove stale entries in Credential Manager that map to the server.
• Approved servers format: use FQDN (e.g., print01.contoso.local) and ensure DNS over VPN resolves.
• Driver signature: non-signed or tampered packages will be rejected; re-install a signed, packaged driver.

Customer

We’re also seeing access denied when users try to pause or clear jobs. Which permissions control that?

Technician

Printer permissions: On the printer’s Security tab, Print lets users submit and manage their own jobs. To allow helpdesk to pause/cancel others’ jobs, add a Helpdesk group with Manage Documents. Use Manage Printers only for admins (it changes settings and drivers).

Customer

If we move to Universal Print Drivers, do clients still need admin? We want to avoid prompts entirely.

Technician

Driver strategy: Use packaged v4 queues or a signed HP/Brother universal print driver. With Approved servers and packaged drivers, clients can add the shared printer connection without local admin — preventing the access denied shared printer issue for standard users.

Customer

Great. Could you summarize the exact steps so I can apply them in order?

Technician

Summary: Fix STATUS_ACCESS_DENIED by (1) verifying share & NTFS permissions (Users = Print), (2) enabling Point and Print Approved servers GPO and using packaged v4/Universal drivers, (3) keeping powerful User Rights Assignment like “Load and unload device drivers” limited to deployment/admin accounts, (4) restarting the spooler and refreshing GPO on clients. Need help mapping your exact GPOs? Open the chat — I’ll walk you through it live.

Quick answer: the accepted fix

Accepted fix for STATUS_ACCESS_DENIED when connecting to a shared printer: ensure the printer’s share & NTFS permissions grant Users Print; switch to packaged v4/Universal drivers; configure Point and Print — Approved servers GPO for your print server; limit User Rights Assignment (“Load and unload device drivers”) to deployment/admin accounts. Refresh Group Policy and retry.

FAQ

Step-by-step (Windows 11/10)

1. On the server, ensure Sharing is enabled and Security grants Domain Users = Print.
2. In GPMC, configure Package Point and Print — Approved servers with your print server FQDN.
3. Enable Point and Print Restrictions so approved servers install drivers without elevation.
4. Standardize queues on packaged v4/Universal drivers; replace legacy Type 3 where possible.
5. Limit User Rights Assignment such as “Load and unload device drivers” to deployment/admin accounts.

Optional: advanced checks

1. Restart the Print Spooler service on server and clients.
2. Verify firewall allows RPC and File & Printer Sharing; confirm DNS resolves server FQDN.
3. Use gpresult /r to confirm printer GPOs applied to the user/computer.

Sources

• Microsoft — User Rights: Load and unload device drivers
• Microsoft — Point and Print restrictions & approved servers
• Microsoft — Print Management

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.