Control Panel › Printers

Point and Print Restrictions

UserNative Intune settingPointAndPrint_Restrictions

Supported on Supported Windows XP SP1 through Windows Server 2008 RTM

25H2 · 1.0

What it does

This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain. If you enable this policy setting: -Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made. -You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated. If you do not configure this policy setting: -Windows Vista client computers can point and print to any server. -Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print. -Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated. -Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print. If you disable this policy setting: -Windows Vista client computers can create a printer connection to any server using Point and Print. -Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print. -Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated. -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. -The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).

What it writes

Hive: HKEY_CURRENT_USER
Registry key: Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
Value name: Restricted
When enabled: DWORD 1
When disabled: DWORD 0

In Intune

Native Intune setting: Yes — Policy CSP

./User/Vendor/MSFT/Policy/Config/Printers/PointAndPrintRestrictions_UserPrinters on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.15063.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
Users can only point and print to these servers	Checkbox	`TrustedServers`	On (1) or off (0)
Enter fully qualified server names separated by semicolons	Text	`ServerList`	Up to 255 characters
Users can only point and print to machines in their forest	Checkbox	`InForest`	On (1) or off (0)
When installing drivers for a new connection	Drop-down list	`NoWarningNoElevationOnInstall`	Show warning and elevation prompt`0` Show warning only`1`
When updating drivers for an existing connection	Drop-down list	`UpdatePromptSettings`	Show warning and elevation prompt`0` Show warning only`1`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · User · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint]
"InForest"=dword:00000001
"NoWarningNoElevationOnInstall"=dword:00000000
"Restricted"=dword:00000001
"ServerList"=""
"TrustedServers"=dword:00000001
"UpdatePromptSettings"=dword:00000000

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Point and Print Restrictions
# Name: PointAndPrint_Restrictions
# Scope: User
# State: Enabled
# Source: Printing.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'Restricted' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'TrustedServers' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'ServerList' -PropertyType 'String' -Value ''

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'InForest' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'NoWarningNoElevationOnInstall' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -PropertyType 'DWord' -Value 0

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: PointAndPrint_TrustedServers_Chk, PointAndPrint_TrustedServers_Edit, PointAndPrint_TrustedForest_Chk, PointAndPrint_NoWarningNoElevationOnInstall_Enum, PointAndPrint_NoWarningNoElevationOnUpdate_Enum

ADMX profile candidate (OMA-URI)

./User/Vendor/MSFT/Policy/Config/ADMX_Printing/PointAndPrint_Restrictions

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Point and Print Restrictions
# Name: PointAndPrint_Restrictions
# Scope: User
# State: Enabled
# Source: Printing.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'Restricted' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\Restricted') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'TrustedServers' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\TrustedServers') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'ServerList' -Kind 'String' -Expected ''
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\ServerList') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'InForest' -Kind 'DWord' -Expected 1
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\InForest') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'NoWarningNoElevationOnInstall' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint\UpdatePromptSettings') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Point and Print Restrictions
# Name: PointAndPrint_Restrictions
# Scope: User
# State: Enabled
# Source: Printing.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'Restricted' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'TrustedServers' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'ServerList' -PropertyType 'String' -Value ''

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'InForest' -PropertyType 'DWord' -Value 1

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'NoWarningNoElevationOnInstall' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -PropertyType 'DWord' -Value 0

History 5 retained releases

24H2 · 1.030 Sep 2024
- Translations changed; choose a language above to compare its wording.
22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

3 later releases left it unchanged.

Template

Internal name: PointAndPrint_Restrictions
Namespace: Microsoft.Policies.Printing
Template file: Printing.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="User" displayName="$(string.PointAndPrint_Restrictions)" explainText="$(string.PointAndPrint_Restrictions_Help)" key="Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" name="PointAndPrint_Restrictions" presentation="$(presentation.PointAndPrint_Restrictions)" valueName="Restricted" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Printing:CplPrinters" />
      <supportedOn ref="Microsoft.Policies.Printing:SUPPORTED_XPSP1_through_Server_2008_RTM" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
      <elements>
        <boolean id="PointAndPrint_TrustedServers_Chk" valueName="TrustedServers">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <text id="PointAndPrint_TrustedServers_Edit" valueName="ServerList" />
        <boolean id="PointAndPrint_TrustedForest_Chk" valueName="InForest">
          <trueValue>
            <decimal value="1" />
          </trueValue>
          <falseValue>
            <decimal value="0" />
          </falseValue>
        </boolean>
        <enum id="PointAndPrint_NoWarningNoElevationOnInstall_Enum" valueName="NoWarningNoElevationOnInstall">
          <item displayName="$(string.WarnAndElevateOnUpdate)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.WarningNoElevationOnUpdate)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
        <enum id="PointAndPrint_NoWarningNoElevationOnUpdate_Enum" valueName="UpdatePromptSettings">
          <item displayName="$(string.WarnAndElevateOnUpdate)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.WarningNoElevationOnUpdate)">
            <value>
              <decimal value="1" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="PointAndPrint_Restrictions" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <checkBox refId="PointAndPrint_TrustedServers_Chk">Users can only point and print to these servers:</checkBox>
        <textBox refId="PointAndPrint_TrustedServers_Edit">
          <label>Enter fully qualified server names separated by semicolons</label>
        </textBox>
        <checkBox refId="PointAndPrint_TrustedForest_Chk">Users can only point and print to machines in their forest</checkBox>
        <text />
        <text>Security Prompts:</text>
        <dropdownList noSort="true" refId="PointAndPrint_NoWarningNoElevationOnInstall_Enum">When installing drivers for a new connection:</dropdownList>
        <dropdownList noSort="true" refId="PointAndPrint_NoWarningNoElevationOnUpdate_Enum">When updating drivers for an existing connection:</dropdownList>
        <text>This setting only applies to:</text>
        <text>Windows Vista and later</text>
      </presentation>

Supported platforms and category

Microsoft.Policies.Printing:category:CplPrinters
<category displayName="$(string.CplPrinters)" explainText="$(string.CplPrinters_Help)" name="CplPrinters" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:ControlPanel" />
    </category>
Microsoft.Policies.Printing:definition:SUPPORTED_XPSP1_through_Server_2008_RTM
<definition displayName="$(string.SUPPORTED_XPSP1_through_Server_2008_RTM)" name="SUPPORTED_XPSP1_through_Server_2008_RTM" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="1" ref="unresolved(products):MicrosoftWindowsXP" />
          
          <reference ref="unresolved(products):MicrosoftWindowsServer2003" />
          
          <reference ref="unresolved(products):MicrosoftWindowsVista" />
          
          <reference ref="unresolved(products):WindowsServer2008_RTM" />
          
        </or>
      </definition>
Microsoft.Policies.Printing:unresolved:unresolved(products):MicrosoftWindowsServer2003
<unresolved reference="unresolved(products):MicrosoftWindowsServer2003" />
Microsoft.Policies.Printing:unresolved:unresolved(products):MicrosoftWindowsVista
<unresolved reference="unresolved(products):MicrosoftWindowsVista" />
Microsoft.Policies.Printing:unresolved:unresolved(products):MicrosoftWindowsXP
<unresolved reference="unresolved(products):MicrosoftWindowsXP" />
Microsoft.Policies.Printing:unresolved:unresolved(products):WindowsServer2008_RTM
<unresolved reference="unresolved(products):WindowsServer2008_RTM" />
Microsoft.Policies.Windows:category:ControlPanel
<category displayName="$(string.ControlPanel)" explainText="$(string.ControlPanel_Help)" name="ControlPanel" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Printing:category:CplPrinters
<category displayName="$(string.CplPrinters)" explainText="$(string.CplPrinters_Help)" name="CplPrinters" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:ControlPanel" />
    </category>
<strings><string id="Microsoft.Policies.Printing:CplPrinters">Printers</string><string id="Microsoft.Policies.Printing:CplPrinters_Help">Manages network printer configuration and publishing options.</string></strings>
Microsoft.Policies.Printing:definition:SUPPORTED_XPSP1_through_Server_2008_RTM
<definition displayName="$(string.SUPPORTED_XPSP1_through_Server_2008_RTM)" name="SUPPORTED_XPSP1_through_Server_2008_RTM" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <or>
          <range minVersionIndex="1" ref="unresolved(products):MicrosoftWindowsXP" />
          
          <reference ref="unresolved(products):MicrosoftWindowsServer2003" />
          
          <reference ref="unresolved(products):MicrosoftWindowsVista" />
          
          <reference ref="unresolved(products):WindowsServer2008_RTM" />
          
        </or>
      </definition>
<strings><string id="Microsoft.Policies.Printing:SUPPORTED_XPSP1_through_Server_2008_RTM">Supported Windows XP SP1 through Windows Server 2008 RTM</string></strings>
Microsoft.Policies.Windows:category:ControlPanel
<category displayName="$(string.ControlPanel)" explainText="$(string.ControlPanel_Help)" name="ControlPanel" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:ControlPanel">Control Panel</string><string id="Microsoft.Policies.Windows:ControlPanel_Help">Contains settings to allow configuration of Control Panel, including the items that it does or does not display.</string></strings>