Deploying Printers With Group Policy Preferences

Ok so I know this is an old topic but I need to clarify my position a bit here to best decide how to deploy printers to our organization.
We currently have about 600 printers on a Server 2012 R2 print server and we have 25 buildings. For several years we have deployed printers in GPO the old-fashioned way - user Deployed Printers. There have always been problems with this stemming
from issues with multiple print driver installs on the client computers. That aside, the philosophy works out pretty well. We have NTFS permissions on the print queues that handle who can print to what. GPOs are linked to the staff OUs for each building that
actually deploy the printers. This means that you have to have the GPO for a building and also have to have permission to the printer in order for it to actually install. When a user is removed from a particular building group then at next policy refresh the
printers granted to that group go away. This is good.
Based on the way that preferences work I think that they could solve our problems with occasional failed driver installs, but I can't find a way to reproduce the behavior I described above. If I use create, a user can be deployed a printer but if permission
to that printer is removed then the printer stays behind and they get an access denied error when they attempt to print to it. Same with Update. Replace sort of mimics the desired behavior but deletes and recreates the printer every time policy refreshes.
This wouldn't be a deal-breaker at logon, but it even happens while a user is logged in and policy updates in the background. They could potentially be attempting to print something and the printer will just disappear momentarily.
Is there something else I am missing here that I can configure in order to take advantage of GPP printer deployments in our environment? Thanks!

Hi Matt,
As far as I know, if we choose to use GPP Printer extension to deploy printers, the printers will leave behind even if the policy is out of scope, unless we select the above mentioned option or delete the printers.
>>There have always been problems with this stemming from issues with multiple print driver installs on the client computers.
To tackle this issue, had we disabled the following policy setting?
Computer Configuration\Policies\Administrative Templates\Printers : Point and Print Restrictions
If not, we can disable this setting, which will disable driver installation warning messages and elevation prompts on computers.
Regarding this policy setting, the following article can be referred to for more information.
Control Printer Driver Installation Security
http://technet.microsoft.com/en-us/library/cc753269.aspx
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here
Best regards,
Frank Shen
Frank,
Sorry for the delay, I recently had another issue take precedence over this one so didn't have much time to mull this over or test.
We currently have policy set to enable Point and Print restrictions, but allow driver installation from our print server. This should effectively be the same as what you have recommended.
I believe our driver installation issues have more to do with the large number of different printer models and sometimes the sheer number of printers that can be installed for each user. These are things that we have culturally always been there and probably
won't change. What happens is that when a printer deployment fails no other printers will be installed after that one. The reason is that starting with Windows 7 the printer deployment policy will only be re-evaluated if changes to the policy are detected.
So if a user is deployed 50 printers and one in the middle of the deployments fails, everything after that alphabetically fails and it doesn't retry until the GPO changes.
So far from my limited testing GPP printers gets around this since each printer is essentially a separate object and installation of one does not seem to affect the others. However, I don't like the idea that there is no way to replicate the behavior we
currently have which is to remove printers when the GPO is no longer applied. I may convince the powers that be that we need to change our philosophy about this and train our users to remove printers after they have changed buildings or positions, but for
now I think we will stick with traditional printer GPOs rather than using GPP.
Thanks for your help!

Similar Messages

Deploying Files with Group Policy - Help Needed

Hi,
I am trying to use group policy to deploy files and folders to our server estate. The policy I have created first creates a folder on each server's C drive and then coppies a set of files to this folder from a network share. The folder creation works fine
but the files copy fails. In the Application logs on the servers it displays the following error:
The computer 'ILMT' preference item in the 'GPO - Servers_Production_ALL {CC026B58-FA3B-4399-AA00-AE8E844B2B47}' Group Policy object did not apply because it failed with error code '0x80070005 Access is denied.' This error was suppressed.
Can anyone advise what exactly does not have access here? I don't know what I need to enable to get this to work.
Can anyone help?
Many thanks
James

The copy is on a file server share. presumably if I just give everybody read access to the share that would suffice?
No it won't.
"Sharing" requires several actions:
a) create the folder
b) share the folder
c) grant NTFS permissions on the folder
I think you've neglected action (c).
For your scenario, you need to grant the "server computers" read permissions to the folder.
You can add individual computer accounts, or a group, or "domain computers".
(In a similar way, you could grant access to a user, a group, or "domain users")
[if you need everybody (users) *AND* everything (computers), you could grant permissions to "authenticated users" since that principal includes *BOTH* users and also computers]
Note that "domain computers" and "authenticated users" include all types of domain member computers, i.e. servers, workstations, etc.
Also, note that granting a "computer account" access to a folder or share, does *NOT* mean that a user account on that computer can access the remote share, i.e. permission is granted to the computer account, and a logged-in user account on
that computer does not inherit any kind of access to the remote share by virtue of being logged in.
This means that the computer can access the share but the user cannot access the share. Because the computer account is an identity/principal of it's own accord.
[None of which really has anything to do with Group Policy at all - it's how Windows does file sharing and ACLs... ;)
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Vista logon stuck with Group Policy Preferences

After testing some Group Policy Preferences, my Vista SP1 laptop was stuck logging on , it showed (welcome) and then stopped the logon process.
To be sure i did a fresh Vista reinstall but i still couldn't logon to the domain, the GPO Event log showed that it was looping (endless) trough the GPO's, without showing any obvious errors. I removed all the settings from the Preferences GPO, i stayed with GPOP Drive and Printers mappings and they work fine.
After adding these 3 settings it hung again:
Regional Settings
Abort rest of group on error: No
Process in user context: Yes
Remove (if not applied): No
Preference (apply once): No
Filtered directly: No
Filtered by ancestor: No
Disabled directly: No
Disabled by ancestor: No
Internet Settings
Abort rest of group on error: No
Process in user context: No
Remove (if not applied): No
Preference (apply once): No
Filtered directly: No
Filtered by ancestor: No
Disabled directly: No
Disabled by ancestor: NO
Start Menu
Abort rest of group on error: No
Process in user context: Yes
Remove (if not applied): No
Preference (apply once): No
Filtered directly: No
Filtered by ancestor: No
Disabled directly: No
Disabled by ancestor: No
Is this normal behavior, and has someone else seen this unwanted "feature"!?? Or did i make a mistake..

Hi tnx for your reply
Florian Frommherz wrote:
So did it actually stop? The blue circle did it stop turning around? How long did you wait for it to complete? Are there only Preferences or policies in place as well?
The blue circle is turning arround, it seems looping, after 20 seconds it stops for half a second and starts a new 20 second loop stops for half a second etc etc. In the GPO Vista event log i can find this loop. (checking link speed, finding applying GPO's....... and starting over again)
I waited for more then an hour, a normal logon takes 30 seconds for the Welcome screen.
Florian Frommherz wrote:
So - you mean to say that it behaves the same way? It just stops processing the policies?
It doesn't stop, it seems to loop...
Florian Frommherz wrote:
I guess not. Could you create a new, seperate policy will all the Preference settings that let the machine "get stuck" and apply it to a test machine so that those Preferences in question are the only ones applied? Maybe you can track down which Preference causes the machine to choke.
I did, i seperated the GPO Parts, i know that the Drive and Printer mappings from the GPOP are working fine.
It's in one of those 3 GPO settings (IE, regional, start menu). Even if i disable those specific GPOP parts the logon still gets stuck, after removing / disabling the complete GPO logon runs normal.
I also think during logoff the GPOP are also conflicting since it's also stuck during logoff.
Other Domain accounts are able to logon and off fine!
Could this be caused by the, running a GPOP in User context???
My Vista version is Enterprise, i didn't check on other Vista versions.

Cannot Copy File with Group Policy Preferences

Hi,
I am trying to use a Group Policy Preference to copy a simple text file from a network share to a folder at the root of 'C:\' on the clients. It is not happening. I created the preference in the computer section of the GPO. It is set to create, as the file
does not already exist on the client, with the archive bit on.
Source: \\server.domain.com\folder\fileshare\file.txt
Destination: C:\folder
GPResult shows the clients are getting the GPO, but it seems as if that one setting and another is not being applied. I have no idea why this isn't working when other parts of the GPO are being applied. I read
the documentation on the Technet page, but I must have missed something.
Any ideas why this might not be working?
Thanks
Jason Watkins MCSE, MCSA, MCDBA, CCNA

> Computers" has read access. Listing the actual file name in the
> destination is something I would have never though to do.
...unless the path ends with an "\", it IS a file name, so if you had
"C:\Folder" as the target, check your C:\ drive for a file called
"Folder" :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Deploying printers without Group Policy

A little background first, I work for a company with 10+ sites while only 2 sites actually are in a domain. Everyday I am getting work orders for adding a ip printers to every machine because they want to print to any printer within their location. I
understand the print services within windows server 2008 and how I can deploy them easily through group policy. The problem is the majority do not have the domain infrastructure to do this.
Which leads me to my question of, how and what would be the most painless way of deploying printers to all computers in particular subnets between sites? Create a batch file to add the printers and run it on the each workstation? Create a network share for
printers? or it is possible to force adding a new printer over the network without a group policy. Thank you all in advance

script will be an option...
http://www.computerperformance.co.uk/powershell/powershell_printers.htm
http://support.risualblogs.com/blog/2012/02/14/using-powershell-to-create-printers/
Best,
Howtodo

Unable to replace existing default progam setting with group policy preference

I have a bunch of Windows 8.1 machines on a 2003 domain that we're managing using a 2012 server as a domain controller. I have an OU that contains all the machines and a GPO I've linked to the OU. In the policy, under User Configuration -> Preferences
-> Control Panel Settings -> Folder Options I've created various file type associations and set them to "replace" and have checked "Set as default". In the same policy I've also enabled loopback in merge mode, in order to have
the same associations apply independently of the logged in user.
After I do a gpupdate /force on a client machine, the file types that previously had no programs associated with them receive default program associations as defined in the GPO, however the file types that had existing associations are not getting their
associations replaced. The same is also true if I try to change the default program via GPO for one of the file types that initially had their first program association set via the same GPO. The only result is that the new program association appears as a
choice in the "open with" context menu, while the old default association remains intact. I generated a report using modeling on the server and it shows the GPO as "applied" with no errors.
Any pointers as to what could be wrong and how one would go about fixing this? Thanks in advance.

You mentioned that you implemented loopback merge mode. It's possible some of the settings being included in the merge are interfering with your new file associations. Have you checked to see if there are any conflicting file
associations in other GPOs that may be applying? If so, you may want to experiment with loopback
replace mode.
Also check to see if any file associations are being set in the computer configuration settings, since you are attempting to set associations in the user configuration. In a merge scenario the computer policy is processed after the user policy, and
has precedence if any of the settings conflict.

Group policy Preferences server 2008 and windows 7

Hi I have been struggling with an issue with group policy preferences for a while now with regard to pushing out printers to windows 7 (32/64 bit) Machines. I have two DC servers one is 2008 and the other is 2008 r2. I have setup the group policies on the
2008 server as it is the only one i am allowed to access regularly to do this.
Basically here is my problem. I have created multiple GPO's to send out printers from out print server to classrooms across the school district I work for, I have a mix of xp and windows 7 machines. I have the server setup with both 32 and 64bit drivers
for all printers on that server, we have a mix of oki and hp and ricoh. I know all the connections work and the drivers work well, however when I push them out using the group policy, the windows 7 machines don't install the printers. The xp machines do this
perfectly well when I install the client side extensions patch, but they just will not pull down on the 7 machines unless i install the printer first manually, then delete it and then run gpupdate. In that instance it will work, but obviously i don't want
to have to go round thousands of computers doing this manually.
Just as a side note, each classroom has its own user account and its own printer.
If anyone has any advice as to how i can go about resolving this issue i would greatly appreciate it, this has been a problem i have been researching and trying to fix since January.......

Hi,
>>The xp machines do this perfectly well when I install the client side extensions patch, but they just will not pull down on the 7 machines unless i install the
printer first manually, then delete it and then run gpupdate.
Before going further, we can run command
gpresult/h gpreport.html with admin privileges to collect group policy result on the troubled Windows 7 clients to check the issue. Besides, we can also check event logs in Event Viewer to see if some related error events were logged.
Besides, I want to confirm if we have disabled
Point and Print Restrictions under both User Configuration and Computer Configuration. To have a consistent experience, it’s recommended that we disable the policy setting in both locations if we are dealing with mixed-level clients.
Regarding this point, the following article can be referred to for more information.
Point and Print Restrictions policies are ignored in Windows Vista SP2, Windows Server 2008 SP2, and later Windows operating systems
http://support.microsoft.com/kb/2307161/en-us
Best regards,
Frank Shen

Can I import a list of services into Group Policy Preferences \ Control Panel Settings \ Services?

Hello,
We want to control server services with Group Policy Preferences via the Group Policy Preferences \ Control Panel Settings \ Services. By starting from scratch, I don want to manually add each Service here. Can I import a list of Services
here, then go back and config the properties?
I appreciate the help.
Thanks for your help! SdeDot

> with settings, however I don't see a way to import that list.
Usually, there's no need for that. Most people only configure services
that aren't already configured the way they should be after an OOBE
install...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Does using Group Policy Preferences to deploy printers require the print driver to be pre-installed?

I'm trying to prepare our school system for Windows 7 (we currently use XP). I would like to use the new Group Policy Preferences method of deploying printers. I pushed out the XP client side extensions through WSUS. In my test environment, I added the shared printer in group policy preferences. My XP machine had the printers show up automatically, but my Windows 7 machine did not. I realized that I had previously connected a printer of the same type to my XP machine before and the drivers were already installed. To test this theory, I manually connected the shared printers to the Windows 7 machine, deleted them, then logged off and back on. Now the printers are showing up from group policy. My question is does using group policy preferences to deploy printers require the print driver to be pre-installed? If not, then what am I doing wrong? If so, is there a way to work around this? Thanks for your help.
EDIT: To clarify, I am using the share method in GPP. This is the error message I get in the event log:
The user 'PRINTERNAME' preference item in the 'win7 printer test {946461A1-27F8-406F-A0B3-0A1A05AF34F6}' Group Policy object did not apply because it failed with error code '0x80070bcb The specified printer driver was not found on the system and needs to be downloaded.' This error was suppressed.

This link have a description of resolution:
http://technet.microsoft.com/en-us/library/cc725938.aspx
Open the GPMC.
Open the GPO where the printer connections are deployed, and navigate to Computer Configuration, Policies, Administrative Templates, Control
Panel, and thenPrinters.
Note
The Point and Print Restrictions setting can also be found under User Configuration\Policies\Administrative Templates\Control Panel\Printers.
This policy is ignored by Windows 7 and Windows Server 2008 R2, but is enforced by earlier editions of Windows including Windows XP with SP1, Windows Server 2003 with SP1, and Windows Server 2008. We recommend that you change
this policy setting in both locations so that all down-level clients have a consistent experience.
Right-click Point and Print Restrictions, and then click Properties.
Click Enabled.
Clear the following check boxes:
Users can only point and print to these servers
Users can only point and print to machines in their forest
In the When installing drivers for a new connection box, select Do not show warning or elevation prompt.
Scroll down, and in the When updating drivers for an existing connection box, select Show warning only.
Click OK.

Extreme slow login on Server 2008 R2 TS at Group Policy Preferences - Printers

I see references to this problem everywhere, going back to 2010. However I'm not finding any real answers.
I have Group Policy Preferences installing printers to Terminal Server Users. I have one policy that applies to 4 terminal servers. One of them is a 2008 R2, the others are 2003 x64. Only for the 2008 R2 server, after all of the printers
show (in event viewer) as successfully loaded, there is a long hang. I have many printers applied to me, and that results in my load time being the longest of all at about 3 minutes. I am an administrator on the machine. Others have the exact
same problem, just a bit less pronounced depending on the number of printers.
The policy preference is set to UPDATE, so it's not loading the driver... again, the printer is already successfully applied.
I've tried setting UAC to "Never" on the server. No effect. I've played with the Point and Print policy at both computer and user level, finally just setting both to disabled, but prior to that setting them to Enabled with the "do
not show warning" on both settings. No effect (which makes sense since that is for non-admins and I am having this problem as an admin).
My logging pasted below shows this same thing in all cases.
Is there an answer to this that I am just not finding?
2013-12-06 09:11:44.133 [pid=0x388,tid=0xca0] Filters passed.
2013-12-06 09:11:44.133 [pid=0x388,tid=0xca0] Adding child elements to RSOP.
2013-12-06 09:11:44.133 [pid=0x388,tid=0xca0] Set user security context.
2013-12-06 09:11:44.289 [pid=0x388,tid=0xca0] Set system security context.
2013-12-06 09:14:13.873 [pid=0x388,tid=0xca0] Set user security context.
2013-12-06 09:14:13.909 [pid=0x388,tid=0xca0] Set system security context.
2013-12-06 09:14:13.909 [pid=0x388,tid=0xca0] Properties handled.
2013-12-06 09:14:13.909 [pid=0x388,tid=0xca0] RunOnce value created [SUCCEEDED(S_FALSE)]

Hi,
Based on your description, I want to confirm whether we have used Item-level Targeting of GPP for printer deploying.
GP Preferences settings that use Item- Level Targeting (ILT) are not inherently harmful. However, certain kinds of Item Level Targeting queries can
take more time to run.
Regarding this issue, the following article can be referred to for more information and the hotfix in the article can be downloaded to fix the issue.
You experience a long domain logon time in Windows Vista, Windows 7, Windows Server 2008 or Windows Server 2008 R2 after you deploy Group Policy preferences
to the computer
http://support.microsoft.com/kb/2561285/en-us
In addition, regarding group policy and logon impact, the following article can be referred to for more information.
Group Policy and Logon Impact
http://blogs.technet.com/b/grouppolicy/archive/2013/05/23/group-policy-and-logon-impact.aspx
Best regards,
Frank Shen

Windows 2008 R2 - Group Policy Preference - folder option "Open with" Access denied

Similar to this post:
social.technet.microsoft.com/Forums/en-US/d42a81bc-96de-4af3-bc41-079e88e6ea4a
We have Citrix terminal servers running Windows 2008 R2 and attempting to force PDF files to open with Acrobat versus PDF editing software we have installed for a small subset of users. So I created a Group Policy Preference and added a OpenWith item
to the Folder Options to use Acrobat as the default and linked it to a Users OU. However, if I run gpresult the OpenWith setting fails with error code 0x80070005. You can change it to not run in the user's security context which eliminates the
error but then it won't actually do anything.
The problem seems to be that when a user sets another program as their default via Windows Explorer the permissions on HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice get changed so that the user is specifically
denied the ability to set that key. Remove the special permissions added and the group policy succeeds and changes it back to the default ... until the user changes it back (intentionally or otherwise) and the permissions are changed again.
Any ideas here?

> Any ideas here?
We use GPP Registry to achieve this goal, so we do not run into that
issue (we unchecked "run in users context", so privs are not an issue)
But I agree, this really should work as intended...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

How to edit Printer Connections in GPO created through Print Management's "Deploy with Group Policy"

Hi there,
I have used the right-click "Deploy with Group Policy" in Print Management on Windows Server 2012 to deploy a printer connection to a GPO.
When you look at the GPO Settings, the Printer Connection is visible under User Configuration -> Policies -> Windows Settings -> Printer Connections -> Path: \ \ printserver\PrinterName.
However, I cannot edit or delete that Printer Connection Path, which would be necessary if I had to rename or delete the printer referenced. If you Edit the GPO, "Printer Connections" is not available under Windows
Settings, only Scripts, Security Settings, Folder Redirection, and Policy-based QoS.
Is there a way to edit the GPO's Printer Connections that are created with "Deploy with Group Policy"?
Thanks for your help.

Hi,
How do you want to edit the printer connection? Do you want to edit the path of printer connection?
Based on my test, we can’t edit the printer connection directly in GPO. We can edit the path of printer connection in printer management.
For detail steps, we can refer to the method Miles Zhang provided in the following link:
Where is "Printer Connections set"?
https://social.technet.microsoft.com/Forums/windowsserver/en-US/77e2b4be-7372-4cb2-9d21-bca83f472fc3/where-is-printer-connections-set?forum=winserverGP
Best Regards,
Erin

Group policy preference for creating printers setting the wrong printer as default

Hi
We have a a group policy preference applied to users. At the moment we create a shared printer and set it as default for all users in a specific OU. Now we need to add another shared printer. I have updated the policy and set it to create
the new shared printer and have set item level targeting to the same OU as the first printer. I want to keep the existing printer as the default, however when the policy runs, the new printer is created fine but it is set as the default
printer. Is this because it has been added last ? There doesn't seem to be a way of changing the order that the printers are applied.
Both printers are Shared printers and are set to Create
The existing printer (printer A) is set as the default printer. It is targeted at the London OU.
The new printer (printer B) has NOT been set as default. It is targeted at the London OU.
No other options have been set.
When the policy is applied both printers are added but printer B is being set as the default.
Any help would be appreciated.
Thanks
G

Hi G,
>>however when the policy runs, the new printer is created fine but it is set as the default printer. Is this because it has been added last ? There doesn't seem to be a way of changing the order that the printers are applied.
Before going further, what's the operating systems of our clients? Here, I need to double confirm that the checkbox of
Set this printer as the default printer... is not selected in the new GPP Printer item. Besides, we can change the orders of the printer items. To do this, select the printer item, right click, click All Tasks, and choose Move Up or Move
Down to change the order.
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Replace Mapped Drives with UNC Paths via Group Policy Preferences

We are currently using Group Policy Preferences to map network drives to drive letters for our users. Given the risk of ransomware, etc. these days we want to provide users with a UNC link rather than a mapped drive letter. Can anyone tell me
the best way to do this?
Thanks,
Joe

> We are currently using Group Policy Preferences to map network drives to
> drive letters for our users. Given the risk of ransomware, etc. these
> days we want to provide users with a UNC link rather than a mapped drive
> letter. Can anyone tell me the best way to do this?
Create shortcuts :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Deploy reader 10.1.3 with group policy

I would like to install 10.1.3 with group policy. I can download the .exe file but extracting it to be an .msi is a struggle. These are Enterprise Windows 7 machines that already have adobe reader 10.1.1 on them. Please help. Thanks.

Moving this discussion to the Adobe Reader forum.

Deploying Printers With Group Policy Preferences

Similar Messages

Maybe you are looking for