In tip 202, we allowed a Print Operator to add a Printer Port.
The default permissions on key
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers
allows Everyone to add a Print Driver.
You can restrict this to Administrators and Print Operators (or workstation Power Users) by using Regedt32 to Add Value name AddPrinterDrivers as a type REG_DWORD and setting the value to 1. This enables the Spooler to restrict the operation. The default is 0.