5

Trying to build a new Group Policy structure on a secondary school site.

Technical context:

  • Windows environment
  • 2008 R2 domain
  • Windows 7 on all machines
  • 3 print servers

Logical context:

  • Most teaching rooms, all computer suites and most admin offices/areas have a Ricoh laser jet printer
  • Students move in and out of classrooms/computer suites all day according to their timetables
  • Teaching staff have a classroom base with a tutor desktop machine, but will also move around (less often than students)
  • Admin (and some management teaching staff) have desktop machines

What I'm hoping to achieve with group policy, or a combination of group policy and manually adding printers to machines, is the following:

  • All members of staff have access to our shared Photocopiers and Staff Room printer
  • Users logging on to tutor and office machines have their nearest printer (usually in the room) as the default printer
  • When a student logs on to a computer in a computer suite, that room's printer is their default printer
  • Other printers don't appear in the Devices and Printers control panel unless manually added

Two quick examples:

  • Teacher logs in to TUTOR01 machine in room 1. Opens Printers and has option of PRINTER-RM1 (default), PRINTER-STAFFRM, COPIER-COLOUR1, COPIER-COLOUR2, COPIER-BW1
  • Students logs in to COMPSUITE3-14 in room 3. Opens Printers and has only one available, PRINTER-RM3 (default)

In short, what I'd like to know is: is this kind of dynamic adding/removing of printers possible in group policy?

Thank you

  • 2
    Yes, it's possible. If you've created OUs to store your computer objects by-room or lab, you can easily use User Preferences (with loopback processing merged) to assign per-user printers on specific computer objects. I'll try to understand your goals better before posting an answer. – jscott Oct 21 '15 at 13:05
8

Yes you can do this. I use Security Groups and Item-Level targeting that apply to the computers and not to users. Users are moving (or graduating) and the computers for the most part are stationary.

What you want to do is in active directory you want to create an OU called something like Printer Groups

Create a Security Group under Printer Groups for each classroom. Then you want to add each student computer in that classroom to that Security Group. Since you will have different needs for the students and tutors you will have to duplicate your efforts.

Example:

Printer Groups 
    |_ Student Classroom 1             
         |_ Computer 1
         |_ Computer 2

    |_ Student Classroom 2 
         |_ Computer 1
         |_ Computer 2      

    |_ Tutor Classroom 1 
         |_ Computer 1

    |_ Tutor Computers
         |_ Tutor  1
         |_ Tutor  2
         |_ Tutor  3
         |_ Tutor  4
         |_ Tutor  5

The reason I use security groups as opposed to OU's is that you aren't required to change your entire OU structure to accommodate this.


Now you will want to create (or add to) a GPO. For simplicity because this will eventually become, to me, an arduous task I created a printers GPO that only has anything to do with printers and this specific task.

Creating the GPO

Navigate to User Configuration -> Preferences -> Control Panel Settings -> Printers

First create a New Shared Printer (Right click, New, Shared Printer). Use these settings:

Actions Delete
Delete all shared printer connections

What this will do is delete all printers on the machine so if you you replace one or whatever then this will delete ghost entries. This needs to be the first entry and needs to be order #1. You'll see what I mean once you get in to this.

NOTE This can slow down processing time because it will have to re-add the printer every time so logging in could take longer than anticipated. If you choose not to use this step, see further down on deleting out of service printers.


Add your printers

I do Shared Printer since I have a print server and you should probably do the same.

Use the following settings for the students:

General Tab:
Action: Update
Share Path: \\printserver\printer1
Set this printer as the default printer... Checked.

Common Tab:
Item-level targeting Checked
Click targeting

New Item -> Security Group

Click the elipses (...)

Type in"Student Classroom 1" and Check Names, then OK.

Select the radio button for Computer in group then click OK.

First one is done. Then you will continue to do this for all of the student computers.


Removing printers that are out of service in the future

Navigate to the printer in the OU. Change the Action to Delete.


Tutors

So my logic for the tutors is the machines are stationary but teachers move around if I'm reading that correctly.

Here is what I'm reading:

  1. All tutors get the same printers
  2. The room printer is the default for that particular room
  3. The tutors only need the following printers: PRINTER-RM1 (default), PRINTER-STAFFRM, COPIER-COLOUR1, COPIER-COLOUR2, COPIER-BW1

So here goes based on that criteria.

Add each of these printers (COPIER-COLOUR1, COPIER-COLOUR2, etc) to the OU same as the student printers but DO NOT check the "Set this printer as the default printer". For the Item-Level targeting you will want to set the Security Group as the Tutor Computers group. This will add each of these printers to the tutor computers regardless of the room.

Then for each PRINTER-RM# computer you will want to follow the same steps as the Student printers listed above and set this as default.


Additional Side Notes

To aide in management I try to keep all of the printers grouped together. For my specific policies I have the same printer listed twice. So if you wind up having 3 different printers in a class room for students, keep them grouped together via the order.


Some additional settings may be required in the GPO for this to function. This is what I have. I have seen people suggest disabling Point and Print but I believe it applies more to terminal services.

Computer Configuration -> Admin Templates -> Printers

Extend Point and Print connections to search Windows Update ...Enabled
Point and Print Restrictions... Enabled
Users can only point and print to these servers:
  I list only my print servers here.
Security Prompts... Do now show warning or elevation prompt on both settings.


I cant remember if this is required but it's in my policy for one reason or another and since it's a specific policy for printers it must be in there for one reason or another.

Computer Configuration -> Admin Templates -> System -> Group Policy

I enabled User Group Policy Looback Processing mode and set Mode to Merge.

  • Loving the answer Travis, please keep working on it! – dunc Oct 21 '15 at 13:19
  • I believe that does it @dunc – Travis Oct 21 '15 at 13:28
  • 1
    The Loopback Procecssing is required to apply User Configuration upon in-scope Computer Objects. As you note, you're using (rightly) User Configuration -> Preferences... In order for this to apply to out-of-scope user objects, you need loopback. – jscott Oct 21 '15 at 14:27
  • Thanks @jscott that's kind of what I figured but couldn't remember for sure. – Travis Oct 22 '15 at 12:53
  • @dunc I wanted to add that this functionality breaks if you begin using remote desktop connections or RemoteApps. This won't work for that since it's going off computer names and not users. Just something to think about if in the future you think you may go to something like that. Just figured this out the hard way. – Travis Jan 28 '16 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.