How to Deploy Printers to Users/Groups/Computers with GPO?

Let’s look at how to automatically install and connect printers to specific users, computers and groups in an Active Directory domain using Group Policy (GPO). It is very convenient when available (assigned) printers are automatically installed and connected when a user first logs on to a domain computer.

Consider the following configuration: there are 3 departments in the organization. Users of each department must print documents on their own color shared network printer. As an administrator, you have to configure the automatic deployment of network printers for users depending on their department.

Deploying Printers to Users via Group Policy

Create three new security groups in AD (SharedPrinter_Sales, SharedPrinter_IT, SharedPrinter _Managers) and add the department users to them (you can automatically add users to domain groups by following the article “Creating a Dynamic Group in Active Directory”). You can create groups in the Active Directory Users & Computers console or using the New-ADGroup cmdlet:

New-ADGroup "SharedPrinter_Sales" -path 'OU=Groups,OU=Paris,DC=woshub,DC=com' -GroupScope Global –PassThru

1. Run the domain Group Policy editor (GPMC.msc), create a new policy print_AutoConnect and link it to the OU with the users.
   If you have a small number of shared network printers in your domain (up to 30-50), you can configure them using single GPO. If you have a complex domain structure and you are delegate some AD administration tasks to branch administrators, it is better to create several printer deployment policies. For example, one policy for each AD site or OU.
2. Go to the policy-editing mode and expand the User Configuration -> Preferences -> Control Panel Setting -> Printers. Create a new policy item by select New -> Shared Printer;
   If you want to connect a printer by IP address (directly, without a print server), select TCP/IP Printer.
   
3. Specify Update as an action. In the Shared Path field, enter the UNC address of your printer, for example, \\srv-par-print\hpsales (in my case all printers are connected to the centralized print server \\srv-par-print). Here you can specify whether to use this printer as the default printer;
4. Go to the Common tab and specify that the printer must be connected in the current user context (Run in logged-on user’s security context). Also check the Item-level targeting option and click Targeting.
5. Using GPP targeting, you must specify that the policy is to be applied only for SharedPrinter_Sales group members. To do it, go to New Item -> Security Group and enter SharedPrinter_Sales as a group name.
   Please note that this restriction doesn’t prevent a domain user from manually connecting this printer using Windows File Explorer. To restrict access to the printer, you will have to change the printer security permissions on the print server and allow printing only for specific groups.
6. In the same way create the printer connection policies for other user groups;

When using this printer deployment Group Policy, new printers will be connected on user computers only if the corresponding printer driver is installed. However, the problem is that non-admin users don’t have permission to install print drivers. In this case, you need to configure Point and Print Restriction policy.

Configuring Point and Print Restrictions Policy to Install Printers

To correctly connect printers for any users, you will have to configure the Point and Print Restrictions policy, as well as the addresses of the print servers from which users are allowed to install drivers and printers.

If you connect your printers using the User Configuration Policy, go to User Configuration -> Policy -> Administrative Templates -> Control Panel -> Printers -> Printer -> Point and Print Restriction. Enable the policy and configure it as follows:

1. Users can only point and print to these servers – specify the list of print servers users can install drivers from (FQDN names are specified with semicolon as a separator);
2. When installing driver for new connection -> Do not show warning or elevation prompt;
3. When installing driver for existing connection -> Do not show warning or elevation prompt.

Also, enable Package Point and Print – Approved server policy in the GPO section User Configuration -> Policies -> Administrative Templates -> Control Panel -> Printers and set the list of trusted print servers.

After you restart the computer, the assigned shared network printer will be automatically installed and connected at the user logon.