Windows Server 2022 Point-and-Print prompts — safe policy fix

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Windows 11/10, Printers, Networking, Group Policy, Print Servers

Fix Point-and-Print prompts on Server 2022 — GPO hardening, approved servers list, packaged drivers, PrintNightmare-safe settings

Technician

Hey! We’ll resolve the Windows Server 2022 Point-and-Print prompts blocking printer installs. A few questions: are users installing from a print server (\\print01) or direct IP? What driver type (v3/classic, Type 4 packaged)? And did this start after the PrintNightmare hardening updates where RestrictDriverInstallationToAdministrators is enforced?

Customer

Yes, Server 2022 print server. Since recent updates, non-admins get elevation prompts “do you trust this printer?” and the install fails. Drivers are HP v3 and a few Type 4.

Technician

That lines up with the hardened defaults: RestrictDriverInstallationToAdministrators=1 and stricter Point-and-Print Restrictions. The safe path is:
1) Use packaged, signed drivers (Type 4 or v3 packaged).
2) Enforce “Package Point and Print — Approved servers” (FQDNs only).
3) Keep prompts for untrusted installs, but allow silent install from your approved list. No registry hacks that disable security.

Customer

Where do I configure the approved servers and prompts? We want users to add printers without admin rights, but keep protections.

Technician

Step 1 — GPO: Package Point and Print (Approved servers)
Computer Configuration → Policies → Administrative Templates → Printers → Package Point and Print — Approved servers:
• Enabled, add FQDNs (e.g., print01.contoso.com; multiple on new lines).
• This allows non-admins to install packaged/signed drivers from those servers without extra prompts.

Step 2 — GPO: Point and Print Restrictions
Same node: set to Enabled, choose:
• Users can only point and print to these servers → Enabled and list the same FQDNs.
• When installing drivers for a new connection → Show warning and elevation prompt (keeps protection for non-approved sources).
• When updating drivers → Show warning and elevation prompt.
This is the safe policy set that still meets hardening guidance.

Customer

Some queues still ask for elevation. Could that be because the drivers aren’t packaged?

Technician

Exactly. For the policy to work seamlessly, drivers must be packaged and digitally signed.
• In Print Management → Drivers, the Packaged column should be “True”. If “False”, get the vendor’s packaged version or migrate to Type 4 class drivers where possible.
• Avoid legacy unsigned v3 packages; they always trigger elevation on modern builds of Server 2022/Windows 11.

Customer

We also publish printers via GPO. Do we still need Point-and-Print settings if deployment is automatic?

Technician

Yes, because the client still evaluates trust. Best practice:
• Deploy via GPO (User Config → Preferences → Control Panel Settings → Printers) or via Universal Print/Intune for hybrid AAD.
• Keep the Approved servers list so policy trust matches your print server FQDNs.
• Optionally enable Point and Print Restrictions at Computer level to cover shared/kiosk machines.

Customer

Is it safe to flip RestrictDriverInstallationToAdministrators to 0 in the registry to bypass prompts?

Technician

I wouldn’t. Setting HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators=0 weakens the PrintNightmare mitigations. The safe route is Approved servers + packaged drivers. If you must support a legacy device, stage the driver on the server and migrate to a modern, signed package ASAP.

Customer

After switching to packaged drivers, installs work for most users. Anything else before we roll it out company-wide?

Technician

Final enterprise checks:
• Ensure clients resolve the FQDN you listed (no short names).
• Confirm SMB/print ports aren’t blocked over VPN; prefer Kerberos to avoid “unknown publisher” prompts.
• Audit with Get-PrinterDriver and Get-EventLog for driver install warnings.
• Document a rollback: keep a second GPO with previous settings (still safe) in case a site has legacy gear.

Customer

Great, the prompts are gone for approved servers and security stays intact. Thanks!

Technician

Summary: On Windows Server 2022, fix Point-and-Print prompts by using packaged/signed drivers, enabling Package Point and Print — Approved servers, and setting Point and Print Restrictions to warn/elevate for untrusted sources. No insecure registry bypasses. Need help auditing your fleet or converting drivers to Type 4? Open the chat.

Quick answer: the accepted fix

Accepted fix when Point-and-Print prompts block installs on Windows Server 2022: use packaged, signed drivers; enable Package Point and Print — Approved servers (FQDNs); set Point and Print Restrictions to allow only those servers and show warnings/elevation for others. Avoid disabling RestrictDriverInstallationToAdministrators.

FAQ

Step-by-step (Server 2022)

1. Convert queues to packaged/signed drivers (prefer Type 4).
2. Enable Package Point and Print — Approved servers; add print server FQDNs.
3. Enable Point and Print Restrictions; allow only those servers; keep warning/elevation for others.
4. Test with a standard user on LAN and VPN; review Event Viewer for driver trust entries.

Note for mixed environments (macOS)

1. macOS clients using SMB shares still rely on server-side trust. Keeping packaged drivers on Server 2022 reduces prompts.
2. For cloud-first, consider Universal Print for cross-platform deployment.

Sources

• Microsoft — Point and Print restrictions & hardening
• Microsoft — Print Management & driver packages
• Microsoft — Package Point and Print — Approved servers

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.