Nazaudy, a spark in your curious mind

How to install printers via GPO

Yes, this guide will show you How to install printers via GPO in Active Directory and also in inTune, let's go!

  1. Install Printer
  2. Create Security Group
  3. Create the GPO
  4. Edit GPO - Computer settings
  5. Edit GPO - User settings

1.- Install Printer

The first thing to do is obviously install the printer on your Print Server. For this example, the printer that are installing is called "HP MFP E877", and while you are at the printer server, please have a look at the printer driver that you are using, in this case the driver is "HP Universal Printing PCL 6"

How to install printers via GPO

Still on your print server, visit Device Manager >> Printers >> visit the Details of the printer driver, select the "Class Guid" property of the driver and choose to copy the value, then maybe paste it on a notepad file, we'll need the Class Gui later to authorise the installation of this driver for non-admin users

Printer Driver Class Guid

 

2.- Create Security Group

Before starting with the GPO create a security group where you will add the computers that you want to this printer installed into. Because this group is going to contain computers and it will be linked to a GPO, I called the group: "GPO.Computer.HP MFP E877" This step is not really necessary is your want to apply this to an OU where you know the computers you want will be all there

It is important that you name your groups in GPO following a naming convention that makes sense to anybody approaching your infrastructure

 

3.- Create the GPO

Visit your Forest Root Domain Controller (FRDC) and create a GPO specifically for this printer, and set it up as follows:

User: add all authenticated users, so they all get the policy applied

Computer: link the Workstations OU where the clients computers are located, but add as a security filter the group that we previously created, so that you can control and manage the specific computers where this GPO as a whole will be applied

 

Printer GPO

 

4.- Edit GPO - Computer Settings

Edit the GPO, and in the computer settings navigate to Computer Configuration >> Policies >> Administrative Templates >> System >> Driver Installation and set the option "Allow non-administrators to install drivers for these devices setup classes" as Enable, adding the Class Guid that you previously copied in step 1 into the "Show..." field

Driver Installation Class GUID

 

 

5.- Edit GPO - User settings

In the section of the User, visit User Configuration >> Preferences >> Control Panel Settings >> Printers and add the shared printer with the "Update" action

GPO shared printer

 

 

Test 

Run "gpupdate /force" and then "gpresult /r" or mmc >> RsOP to see the results of this GPO in action

 

 

References

https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872

 

Comments powered by CComment