This is the 98th article in the Spotlight on IT series. If you'd be interested in writing an article on the subject of backup, security, storage, virtualization, mobile, networking, wireless, DNS, MSPs or printers for the series PM Eric to get started.
Printers. You don’t like them, and I don’t really like them either. But, we’re stuck with them, so the least we can do is make things easier on ourselves. I’ve dealt with several print servers over the years, and have learned that in a Windows environment, the single best thing you can do for yourself is deploy your printers with Group Policy Preferences. Time and again it’s proven quick and reliable, and I haven’t dealt with logon scripts in years.
Even though they’ve existed for years now, I’m constantly amazed how unaware Active Directory administrators are of Group Policy Preferences. At least once a week, I’m seeing posts about logon scripts for mapped drives not working, or how to control printers. Even if they are aware of them, the admins think Group Policy Preferences won’t work at all with Windows XP and/or Server 2003. Let me get this out of the way — that’s false. Client side extensions for the XP and Vista clients and the Remote Server Administration Tools on a Vista or 7 workstation is all you need. And, while this article is focused on printers, the possibilities of GPP go way beyond that.
Now, let’s be fair — Group Policy Preferences can’t solve all your printer problems. The first step to living pain-free with printers is to start with a decent printer. I don’t mean go spend thousands on a printer, but I’ve found the price does play a role. Specifically, if it came free with a desktop, it’s probably not the best choice. In fact, until recently our color printer was just that, and it was the only one I consistently had trouble with.
The print server is important too; for that, I prefer Server 2008 R2. You want to get the latest drivers, and it may take a bit of effort to sort out which one is best – be sure to test it before the deployment. While you’re at it, don’t forget to include drivers for 32-bit and 64-bit. In my experience, it’s simple to include both on the server. I admit I may be missing something, but I’ve wondered for some time how that’s a consistent problem area. The other solution is one I recently accomplished as well — just get rid of all the 32-bit installations.
So after all that, here we are: a Windows Server, a network printer, and a brand new share, waiting to be… well, shared. Traditionally, that meant digging up the logon script that was probably created for Windows 98, removing an old entry, and setting up the new printer. However, it’s 2012. Throw the script out and open your Group Policy Management Editor. Preferences can apply to users or computers, and many of the options are the same for both. I prefer to apply printer and network shares to users; you can determine the best method for your setup. At any rate, create or edit a GPO, and go to User/Computer Configuration – Preferences – Control Panel Settings – Printers. In the big empty white space on the right, right-click and choose new.
The first screen is pretty self-explanatory. I would suggest setting the Action at the top to “Update,” and on the Common tab, check “Run in logged-on user’s security context.” Then enter the path to the printer, and you’re finished. Seriously, you’re done. The printer will now be mapped for anyone the GPO is applied to, and you’ve only spent thirty seconds on it.
Of course, the situation isn’t always that straightforward. Let’s say the printer is in your finance department, with security set to only allow the finance group to print to it. We certainly don’t want this printer being mapped to everyone. Open the printer preference item again, but go to the Common tab, enable “Item-level targeting,” and click the “Targeting” button. Here, your options are almost unlimited. You can target by almost anything option you can think of, including the operating system, computer name, time of day, and plenty of other options. The only item I’ve needed for printers has been Security Group. In this example, since it’s a finance printer restricted to a finance group, you simply specify that the user must be a member of the finance group. And just like the original mapping, that’s it; only finance people will receive this printer.
Once you’ve said OK to everything, back in the Printers area, take a look at the top. See the green arrows at the end of the toolbar? Those let you rearrange the order, so you can control the order in which items process. This may not be a big deal, but consider this: You can create an action set to “Delete” and tell it to delete all shares. Move this action up the list to number one, and now your policy is removing all mapped printers before applying your new shares, perfect for cleaning up.
Just like that, you’re done again.
When I was asked to do this article, I was hesitant because there’s really nothing to my printers — users just see them, and that’s it. However, boring is a good thing for IT, because it means things are working. Hopefully anyone that has not yet looked at Group Policy Preferences for their environment will take the time to look at them. And remember, even though this has been focused on printers, it really should be an example of how simple Group Policy Preferences can make a lot of things.
Are you using Group Policy Preferences for your printers? What other ways are you using GPP to make your job easier?