Yes you can do this. I use
Security Groups and Item-Level targeting that apply to the computers and not to users. Users are moving (or graduating) and the computers for the most part are stationary.
What you want to do is in active directory you want to create an OU called something like
Security Group under
Printer Groups for each classroom. Then you want to add each student computer in that classroom to that
Security Group. Since you will have different needs for the students and tutors you will have to duplicate your efforts.
|_ Student Classroom 1
|_ Computer 1
|_ Computer 2
|_ Student Classroom 2
|_ Computer 1
|_ Computer 2
|_ Tutor Classroom 1
|_ Computer 1
|_ Tutor Computers
|_ Tutor 1
|_ Tutor 2
|_ Tutor 3
|_ Tutor 4
|_ Tutor 5
The reason I use security groups as opposed to OU's is that you aren't required to change your entire OU structure to accommodate this.
Now you will want to create (or add to) a GPO. For simplicity because this will eventually become, to me, an arduous task I created a printers GPO that only has anything to do with printers and this specific task.
Creating the GPO
User Configuration -> Preferences -> Control Panel Settings -> Printers
First create a
New Shared Printer (Right click, New, Shared Printer). Use these settings:
Delete all shared printer connections
What this will do is delete all printers on the machine so if you you replace one or whatever then this will delete ghost entries. This needs to be the first entry and needs to be order #1. You'll see what I mean once you get in to this.
NOTE This can slow down processing time because it will have to re-add the printer every time so logging in could take longer than anticipated. If you choose not to use this step, see further down on deleting out of service printers.
Add your printers
Shared Printer since I have a print server and you should probably do the same.
Use the following settings for the students:
Share Path: \\printserver\printer1
Set this printer as the default printer... Checked.
Item-level targeting Checked
New Item -> Security Group
Click the elipses (...)
"Student Classroom 1" and
Check Names, then
Select the radio button for
Computer in group then click
First one is done. Then you will continue to do this for all of the student computers.
Removing printers that are out of service in the future
Navigate to the printer in the OU. Change the
So my logic for the tutors is the machines are stationary but teachers move around if I'm reading that correctly.
Here is what I'm reading:
- All tutors get the same printers
- The room printer is the default for that particular room
- The tutors only need the following printers: PRINTER-RM1 (default), PRINTER-STAFFRM, COPIER-COLOUR1, COPIER-COLOUR2, COPIER-BW1
So here goes based on that criteria.
Add each of these printers (COPIER-COLOUR1, COPIER-COLOUR2, etc) to the OU same as the student printers but DO NOT check the "Set this printer as the default printer". For the
Item-Level targeting you will want to set the
Security Group as the
Tutor Computers group. This will add each of these printers to the tutor computers regardless of the room.
Then for each PRINTER-RM# computer you will want to follow the same steps as the Student printers listed above and set this as default.
Additional Side Notes
To aide in management I try to keep all of the printers grouped together. For my specific policies I have the same printer listed twice. So if you wind up having 3 different printers in a class room for students, keep them grouped together via the order.
Some additional settings may be required in the GPO for this to function. This is what I have. I have seen people suggest disabling
Point and Print but I believe it applies more to terminal services.
Computer Configuration -> Admin Templates -> Printers
Extend Point and Print connections to search Windows Update ...Enabled
Point and Print Restrictions... Enabled
Users can only point and print to these servers:
I list only my print servers here.
Security Prompts... Do now show warning or elevation prompt on both settings.
I cant remember if this is required but it's in my policy for one reason or another and since it's a specific policy for printers it must be in there for one reason or another.
Computer Configuration -> Admin Templates -> System -> Group Policy
User Group Policy Looback Processing mode and set