VDI per-user printer install fails — non-admin deployment workflow

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, VDI (AVD/Citrix/Horizon), Print Servers, Intune, Group Policy

Per‑user printer install blocked — Type 4 user‑mode drivers, Point and Print Restrictions, Intune & GPO deployment

Technician

Hey! Let’s fix your VDI per‑user printer install. Tell me the platform (Azure Virtual Desktop, Citrix, or VMware Horizon), whether you’re mapping from a print server share (\\server\\queue) or creating a local IPP/TCP printer, and which driver package you use (Type 4 class, Type 3 v3, Universal Print, or IPP Everywhere). We’ll build a non‑admin workflow that survives PrintNightmare hardening.

Customer

Azure Virtual Desktop pooled hosts. Users aren’t admins. Add‑Printer -ConnectionName \\\\PRINT01\\HP-Laser fails with elevation prompts. GPO Point and Print is locked down since PrintNightmare. We need a per‑user install at logon without UAC.

Technician

Under today’s security baselines, Point and Print Restrictions and Package Point and Print require either:
• a Type 4 user‑mode driver already staged on the system; or
• the print server to be listed on Approved servers with elevated prompts suppressed via policy.
Type 3 (v3) kernel drivers usually need admin rights. For per‑user installs in VDI we prefer Type 4 class drivers, signed packages, and user‑context mapping via GPO Preferences or Intune PowerShell.

Customer

How do we stage Type 4 drivers so users can connect without admin rights?

Technician

Stage a user‑mode (Type 4) driver on your AVD image or golden master:
1) Install the vendor’s v4 driver or the Microsoft IPP Class Driver as admin once (during image prep). This drops a driver package into the Windows Driver Store.
2) Verify in Print Management → Drivers that the driver shows Type 4 and Is packaged = True.
3) After that, a non‑admin user can connect to a queue using the staged driver via Add‑Printer -ConnectionName \\\\PRINT01\\HP-Laser (runs in user context) or via Devices & Printers without elevation.

Customer

What GPO settings do we need so Point and Print doesn’t block the install?

Technician

GPO for non‑admin printer installs (Computer or User):
• Computer Configuration → Policies → Admin Templates → Printers → Point and Print Restrictions = Enabled; set Approve specific server names (e.g., PRINT01, PRINT02). Choose Do not show warning or elevation prompt for installs/updates if your risk policy permits.
• Package Point and Print – Approved servers = your print servers. Ensure drivers are Packaged and signed.
• Optionally, Allow Print Spooler to accept client connections and RPC over named pipes per your environment.
For least privilege, combine with Type 4 drivers so the user install happens without admin prompts.

Customer

We deploy via Intune to AVD. Can we map per‑user printers at sign‑in?

Technician

Intune (user‑context) workflow:
• Assign a PowerShell script to users (Run this script using the logged‑on credentials = Yes). Script runs Add‑Printer -ConnectionName \\\\PRINT01\\HP-Laser and verifies with Get‑Printer.
• Pair with a Settings Catalog policy configuring Point and Print Restrictions + Approved servers.
• For location‑based mapping, query AD site, IP range, or WMI printer proximity and add the closest queue.
• If using Universal Print, deploy printers via the UP Printer Provisioning app — it’s natively per‑user with no admin rights.

Customer

Citrix user sessions fail with “driver not found” though we staged drivers. What else blocks per‑user install?

Technician

Common blockers:
• Driver is Type 3 (needs admin). Replace with Type 4 or Class/IPP driver.
• Queue uses an unpackaged or unsigned driver; enable Packaged on the server.
• GPO Device Installation Restrictions deny printer installs for users. Relax for signed/packaged drivers.
• Profile reset in non‑persistent VDI. Save printer connections using FSLogix or recreate at logon with script.

Customer

Can we use IPP Everywhere or Universal Print to avoid server trust prompts?

Technician

Yes. IPP Everywhere with the Microsoft IPP Class Driver or Universal Print uses class/user‑mode components and typically installs in user context without elevation. It’s ideal for non‑admin environments and hybrid VDI where you want to skip server trust prompts.

Customer

How do we persist printers in non‑persistent pools?

Technician

Store connections per user:
• Use FSLogix Profile Containers so HKCU\\Printers\\Connections and ports persist.
• Or re‑create printers at each sign‑in with an Intune or GPO logon script and clean up at sign‑out.

Customer

Can you give a simple non‑admin deployment recipe we can copy?

Technician

Quick recipe: Stage Type 4 driver on the image → GPO/Intune set Point and Print Restrictions with approved servers → User‑context script runs Add‑Printer -ConnectionName \\\\PRINT01\\HP-Laser at logon → Persist via FSLogix or remap each session. Need a custom script and GPO export? Open the chat.

Customer

Perfect. Non‑admin users get printers at sign‑in and updates are silent.

Quick answer: the accepted fix

Accepted fix when VDI per‑user printer install fails: stage a Type 4 packaged driver on the image, configure Point and Print Restrictions with Approved servers, deploy user‑context mapping via Intune/GPO (Add‑Printer), and persist with FSLogix. Prefer IPP Everywhere or Universal Print for true non‑admin installs.

FAQ

Step‑by‑step (Windows 10/11)

1. Stage a Type 4 packaged driver (or IPP Class Driver) on the VDI image.
2. GPO/Intune: configure Point and Print Restrictions + Package Point and Print — Approved servers.
3. Deploy user‑context mapping with Add‑Printer -ConnectionName \\\\SERVER\\QUEUE at logon.
4. Persist via FSLogix profile or remap each session.
5. Test in AVD/Citrix/Horizon and audit event logs (Microsoft-Windows-PrintService/Operational).

macOS notes

1. For Mac VDIs, prefer AirPrint/IPP queues or vendor packages that install in user context.
2. Manage with MDM (Profile Manager/Intune) using per‑user printer payloads.

Sources

• Microsoft — Windows print driver types (v3 vs v4)
• Microsoft — Manage printers in Windows, Point and Print policies
• Microsoft — Universal Print

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.