In tip 202, we allowed a Print Operator to add a Printer Port.

The default permissions on key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers

allows Everyone to add a Print Driver.

You can restrict this to Administrators and Print Operators (or workstation Power Users) by using Regedt32 to Add Value name AddPrinterDrivers as a type REG_DWORD and setting the value to 1. This enables the Spooler to restrict the operation. The default is 0.