By default, Windows 7 allows a user to create a local printer in the Printers and Devices dialog (via Add Printer -> Add A Local Printer).
We would like to prevent unprivileged users from doing this. We found that we can pull up Print Server Properties (as Administrator), Security Tab, select INTERACTIVE, and remove the check for "Manage Server". After that, the "Add a Local Printer" has a Shield, meaning it takes elevated privileges to install a local printer. This is exactly how we want it.
How do we implement this modification on 10,000+ machines? There does not seem to be a Group Policy setting to do this, nor any obvious commandline utilities or powershell commands to change this particular permission setting.