Windows 10 Printer Drivers - for each driver installed is there a way of telling whether it was admin-installed or user-installed?

[Kat_21] 1

Window Printer Driver - for each driver installed is there a way of telling whether it was admin-installed or otherwise?

Could this be reg key, file permissions etc?

Essentially I would like to enumerate a list of the printer drivers installed on a device; where the driver is "user-installed", remove it and re-install with admin rights.

All related to the user requiring Admin rights to connect to point and print shares.

Regards,

1 answer

Castorix31 81,831 Reputation points

2021-09-25T17:06:47.54+00:00

As Admin with SE_SECURITY_NAME privilege,
use
EnumPrinterDrivers
then
GetFileSecurity
GetSecurityDescriptorOwner
LookupAccountSid
to get the owner of pDriverPath of DRIVER_INFO_n structure

(tested on Windows 10 1909)
Please sign in to rate this answer.
[Kat_21] 1 Reputation point

2021-09-27T13:51:09.907+00:00

Thanks for that! How would this be achieved using PowerShell; this looks like syntax that might be used in another scripting language..?

Castorix31 81,831 Reputation points

2021-09-27T14:25:26.117+00:00

I tested in C++, as you set the Tag "windows-hardware-wdk", which is rather for C/C++

[Kat_21] 1 Reputation point

2021-09-27T14:34:35.087+00:00

Ah, my bad - have re-tagged appropriately. Thanks though; hadn't realised.

Castorix31 81,831 Reputation points

2021-09-27T15:39:57.86+00:00

I still see the wdk Tag...

In PowerShell, you can do something like (to be reformatted...) =>

get-printerdriver | select Name, Path | ForEach-Object { $_.Name, $_.Path, (Get-Acl $_.Path).Owner}

[Kat_21] 1 Reputation point

2021-09-27T15:52:39.087+00:00

Hi, thanks for quick response.

If the driver is installed as a user (which a "normal / non-admin" user could do prior to Aug 21 C. Update (KB5005031) from Microsoft), the owner is "System".

After KB5005031, Windows is able to tell if the driver is user-installed (i.e. not installed with Admin rights).

I wondered if this was visible via a PowerShell script at all.

Whether Admin-installed or User-installed; PRINTER driver *.inf file owner is "System". (From preliminary testing.)

Castorix31 81,831 Reputation points

2021-09-27T16:16:08.883+00:00

Maybe you can compare Access member
For example, for an Epson driver returned by the other command :

(get-acl "C:\WINDOWS\system32\spool\DRIVERS\x64\3\E_IMAILRE.DLL").access | ft
Sign in to comment