Yes you can do this. I use Security Groups and Item-Level targeting that apply to the computers and not to users. Users are moving (or graduating) and the computers for the most part are stationary.
What you want to do is in active directory you want to create an OU called something like Printer Groups
Create a Security Group under Printer Groups for each classroom. Then you want to add each student computer in that classroom to that Security Group. Since you will have different needs for the students and tutors you will have to duplicate your efforts.
Example:
Printer Groups
|_ Student Classroom 1
|_ Computer 1
|_ Computer 2
|_ Student Classroom 2
|_ Computer 1
|_ Computer 2
|_ Tutor Classroom 1
|_ Computer 1
|_ Tutor Computers
|_ Tutor 1
|_ Tutor 2
|_ Tutor 3
|_ Tutor 4
|_ Tutor 5
The reason I use security groups as opposed to OU's is that you aren't required to change your entire OU structure to accommodate this.
Now you will want to create (or add to) a GPO. For simplicity because this will eventually become, to me, an arduous task I created a printers GPO that only has anything to do with printers and this specific task.
Creating the GPO
Navigate to User Configuration -> Preferences -> Control Panel Settings -> Printers
First create a New Shared Printer (Right click, New, Shared Printer). Use these settings:
Actions Delete
Delete all shared printer connections
What this will do is delete all printers on the machine so if you you replace one or whatever then this will delete ghost entries. This needs to be the first entry and needs to be order #1. You'll see what I mean once you get in to this.
NOTE This can slow down processing time because it will have to re-add the printer every time so logging in could take longer than anticipated. If you choose not to use this step, see further down on deleting out of service printers.
Add your printers
I do Shared Printer since I have a print server and you should probably do the same.
Use the following settings for the students:
General Tab:
Action: Update
Share Path: \\printserver\printer1
Set this printer as the default printer... Checked.
Common Tab:
Item-level targeting Checked
Click targeting
New Item -> Security Group
Click the elipses (...)
Type in"Student Classroom 1" and Check Names, then OK.
Select the radio button for Computer in group then click OK.
First one is done. Then you will continue to do this for all of the student computers.
Removing printers that are out of service in the future
Navigate to the printer in the OU. Change the Action to Delete.
Tutors
So my logic for the tutors is the machines are stationary but teachers move around if I'm reading that correctly.
Here is what I'm reading:
- All tutors get the same printers
- The room printer is the default for that particular room
- The tutors only need the following printers: PRINTER-RM1 (default), PRINTER-STAFFRM, COPIER-COLOUR1, COPIER-COLOUR2, COPIER-BW1
So here goes based on that criteria.
Add each of these printers (COPIER-COLOUR1, COPIER-COLOUR2, etc) to the OU same as the student printers but DO NOT check the "Set this printer as the default printer". For the Item-Level targeting you will want to set the Security Group as the Tutor Computers group. This will add each of these printers to the tutor computers regardless of the room.
Then for each PRINTER-RM# computer you will want to follow the same steps as the Student printers listed above and set this as default.
Additional Side Notes
To aide in management I try to keep all of the printers grouped together. For my specific policies I have the same printer listed twice. So if you wind up having 3 different printers in a class room for students, keep them grouped together via the order.
Some additional settings may be required in the GPO for this to function. This is what I have. I have seen people suggest disabling Point and Print but I believe it applies more to terminal services.
Computer Configuration -> Admin Templates -> Printers
Extend Point and Print connections to search Windows Update ...Enabled
Point and Print Restrictions... Enabled
Users can only point and print to these servers:
I list only my print servers here.
Security Prompts... Do now show warning or elevation prompt on both settings.
I cant remember if this is required but it's in my policy for one reason or another and since it's a specific policy for printers it must be in there for one reason or another.
Computer Configuration -> Admin Templates -> System -> Group Policy
I enabled User Group Policy Looback Processing mode and set Mode to Merge.
