Manage Print Driver exclusion list
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Path in the GPO console
Computer Configuration\Administrative Templates\Printers Description
This policy setting controls the print driver exclusion list. The exclusion list allows an administrator to curate a list of printer drivers that are not allowed to be installed on the system. This checks outranks the signature check and allows drivers that have a valid signature level for the Print Driver signature validation policy to be excluded. Entries in the exclusion list consist of a SHA256 hash (or SHA1 hash for Win7) of the INF file and/or main driver DLL file of the driver and the name of the file. If you disable or do not configure this policy setting, the registry key and values associated with this policy setting will be deleted, if currently set to a value.
Registry
HKLM
Software\Policies\Microsoft\Windows NT\Printers\Driver MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/Printers/ManageDriverExclusionList Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Manage Print Driver exclusion list
; State: Enabled
; Supported on: At least Windows Server 2012, Windows 8 or Windows RT
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\Driver\ExclusionList]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Manage Print Driver exclusion list
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers\Driver\ExclusionList'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/ManageDriverExclusionList
Data type: String
Value:
<enabled/>
<!-- Driver_ExclusionListEntry: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Manage Print Driver exclusion list
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows NT\Printers\Driver\ExclusionList: List values: enter one value per line in the builder UI.
# No testable registry values are available for this state.
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Manage Print Driver exclusion list
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers\Driver\ExclusionList'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Manage Print Driver exclusion list
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Manage Print Driver exclusion list
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows NT\Printers\Driver\ExclusionList: List values: enter one value per line in the builder UI.
# No testable registry values are available for this state.
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Manage Print Driver exclusion list
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers\Driver\ExclusionList'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.