Printer Sharing Permission Denied for Standard Users – Fix

Why This Happens

When you share a printer from one Windows machine, standard users get Access Denied when they try to print. The reason is Windows locks down the printer's security descriptor for non-admin accounts. This is by design – Microsoft assumes only admins manage printers. But if you run a home office or small lab where standard users need to print, you have to override this.

I've seen this on Windows 10 22H2 and Windows 11 23H2. It happens when you share a USB printer (like an HP LaserJet or Brother DCP) from a desktop and then connect from a laptop using a standard user account.

The 30-Second Fix: Add the User to the Printer's Security Tab

This is the fastest test. It works 60% of the time.

1. On the host machine (the one sharing the printer), open Devices and Printers.
2. Right-click your shared printer → Printer Properties.
3. Go to the Security tab. (If you don't see it, your printer driver is ancient – update it first.)
4. Click Add → type the standard user's Windows username (domain\user or PCname\user).
5. Check Print permission → Allow.
6. Click OK, then test printing from the client.

The reason step 3 works is that Windows prints through a spooler service that checks security descriptors. Without explicit Allow for Print, the spooler denies the job. If you still get an error, keep going.

The 5-Minute Fix: Registry Permission Fix for the Printer Driver

Sometimes the issue isn't the printer share itself – it's the driver files. Standard users can't access them. This is a documented bug on Windows 10 20H2 through 11 23H2.

1. Open Registry Editor as Administrator.
2. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\YourPrinterName

   (Replace YourPrinterName with the exact name shown in Devices and Printers.)
3. Right-click the key → Permissions.
4. Click Add → type Users (or Everyone if it's a small network) → check Full Control → OK.
5. Close Registry Editor, restart the Print Spooler service (net stop spooler then net start spooler).
6. Test again from the standard user's machine.

What's actually happening here is that the printer driver DLL files get loaded into the spooler process. If Users don't have read access to the registry key, the spooler can't load the driver for that user. This fix hands that access.

The 15+ Minute Fix: Group Policy to Bypass Print Driver Restrictions

If neither of the above works, Windows is actively blocking standard users from even seeing the driver. You need Group Policy to force it open.

For Windows 10/11 Pro or Enterprise:

1. Press Win + R, type gpedit.msc.
2. Go to:

   Computer Configuration → Administrative Templates → Printers

3. Find Point and Print Restrictions – double-click it.
4. Set it to Enabled.
5. Under Options, choose:
   • Users can only point and print to these servers: – leave blank
   • When installing drivers for a new connection: – Do not show warning or elevation prompt
   • When updating drivers for an existing connection: – Do not show warning or elevation prompt
6. Click OK, close Group Policy.
7. Run gpupdate /force in Command Prompt (Admin).
8. On the client machine, remove the printer and add it fresh via \\hostname\printername.

For Windows 10/11 Home:

Home edition doesn't have gpedit.msc. But you can still tweak the registry directly:

1. Open Registry Editor as Admin.
2. Go to:

   HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint

   (Create the key if it doesn't exist.)
3. Create a DWORD (32-bit) named RestrictDriverInstallationToAdministrators – set value to 0.
4. Create another DWORD named NoWarningNoElevationOnInstall – set value to 1.
5. Restart the Print Spooler service, then re-add the printer from the client.

The reason Group Policy fix works is it tells Windows: don't block standard users from installing or updating printer drivers. By default, Windows requires admin rights to install a driver. This policy flips that behavior. Without it, even if you set permissions on the printer, the driver installation step fails silently.

One More Thing – Check the Print Server's SPN

If you're on a domain and still hitting permission errors, the print server's Service Principal Name (SPN) might be missing or duplicated. Check with setspn -L hostname. If the HOST/ or print/ SPNs are wrong, the Kerberos authentication fails and Windows falls back to NTLM, which can mess with permissions. This is rare but real – I've seen it on Server 2019 with Brother printers.

Fix: run setspn -A HOST/hostname hostname from an admin command prompt on a domain controller.

When to Give Up

If none of this works after an hour, the problem might be the printer driver itself. Some cheap USB-only printers (think $30 Lexmarks) don't support network sharing properly. Swap to a network-ready printer or use a print server appliance like a Raspberry Pi running CUPS.

Short version: start with the Security tab. Then registry. Then Group Policy. Skip straight to Group Policy if you see the error when the client tries to install the driver.