Point and Print Restrictions
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
Path in the GPO console
User Configuration\Administrative Templates\Control Panel\Printers Description
This policy setting controls the client Point and Print behavior, including the security prompts for Windows Vista computers. The policy setting applies only to non-Print Administrator clients, and only to computers that are members of a domain. If you enable this policy setting: -Windows XP and later clients will only download print driver components from a list of explicitly named servers. If a compatible print driver is available on the client, a printer connection will be made. If a compatible print driver is not available on the client, no connection will be made. -You can configure Windows Vista clients so that security warnings and elevated command prompts do not appear when users Point and Print, or when printer connection drivers need to be updated. If you do not configure this policy setting: -Windows Vista client computers can point and print to any server. -Windows Vista computers will show a warning and an elevated command prompt when users create a printer connection to any server using Point and Print. -Windows Vista computers will show a warning and an elevated command prompt when an existing printer connection driver needs to be updated. -Windows Server 2003 and Windows XP client computers can create a printer connection to any server in their forest using Point and Print. If you disable this policy setting: -Windows Vista client computers can create a printer connection to any server using Point and Print. -Windows Vista computers will not show a warning or an elevated command prompt when users create a printer connection to any server using Point and Print. -Windows Vista computers will not show a warning or an elevated command prompt when an existing printer connection driver needs to be updated. -Windows Server 2003 and Windows XP client computers can create a printer connection to any server using Point and Print. -The "Users can only point and print to computers in their forest" setting applies only to Windows Server 2003 and Windows XP SP1 (and later service packs).
Registry
Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint Value name: Restricted
Enabled: Restricted = 1
Disabled: Restricted = 0
MDM / Intune (CSP)
./User/Vendor/MSFT/Policy/Config/Printers/PointAndPrintRestrictions_User Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Point and Print Restrictions
; State: Enabled
; Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint]
"Restricted"=dword:00000001
"TrustedServers"=dword:00000000
"ServerList"=""
"InForest"=dword:00000000
"NoWarningNoElevationOnInstall"=dword:00000000
"UpdatePromptSettings"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Point and Print Restrictions
# State: Enabled
# Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Restricted' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'TrustedServers' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'ServerList' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'InForest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWarningNoElevationOnInstall' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'UpdatePromptSettings' -Value 0 -Type DWordIntune XML
OMA-URI: ./User/Vendor/MSFT/Policy/Config/Printers/PointAndPrintRestrictions_User
Data type: String
Value:
<enabled/>
<data id="PointAndPrint_TrustedServers_Chk" value="0"/>
<data id="PointAndPrint_TrustedServers_Edit" value=""/>
<data id="PointAndPrint_TrustedForest_Chk" value="0"/>
<data id="PointAndPrint_NoWarningNoElevationOnInstall_Enum" value="0"/>
<data id="PointAndPrint_NoWarningNoElevationOnUpdate_Enum" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Point and Print Restrictions
# State: Enabled
# Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'Restricted' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'TrustedServers' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'ServerList' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'InForest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'NoWarningNoElevationOnInstall' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Point and Print Restrictions
# State: Enabled
# Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Restricted' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'TrustedServers' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'ServerList' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'InForest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWarningNoElevationOnInstall' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'UpdatePromptSettings' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Point and Print Restrictions
# State: Enabled
# Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Point and Print Restrictions
# State: Enabled
# Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'Restricted' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'TrustedServers' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'ServerList' -Expected '' -Kind String)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'InForest' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'NoWarningNoElevationOnInstall' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Point and Print Restrictions
# State: Enabled
# Supported on: Supported Windows XP SP1 through Windows Server 2008 RTM
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Restricted' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'TrustedServers' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'ServerList' -Value '' -Type String
Set-ItemProperty -Path $path -Name 'InForest' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWarningNoElevationOnInstall' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'UpdatePromptSettings' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.