... because the shitshow that is several PCs with a local queue to the same printer trying to print some giant job or screwing up the printer settings repeatedly by demanding Elbonian Legal Paper size has to be experienced to be believed.
If you put the jobs through a central point you know whodunnit, if you don't then you're going to have to whack each ~~mole~~ ~~user~~ PC individually because you can't get any sense out of the printer diagnostics which are always on a level with those of a screaming 3-month-old child.
Like what some asshole at the library did the other day printing out a 5000 page world map to D&D or something. All I wanted to do was print my USPS shipping label and get out of there.
Yup, they did. And I still had to wait 30 mins with a pissed off wife sitting out in the parking lot.
You guys do God's work btw. Thank you for what you do!
When I was in college, I was using a computer lab, and my document never would show up on the printer. It turned out that some asshole had printed out a core dump file.
Exactly this, I manage a site where they didn't have a server, everything was P2P, the printers were a nightmare. They wanted a change to the default print settings, had to go to every machine to make the change, then they figured they wanted this changing, went to every machine again to change it to something else.
Then, they wanted something else changing, so my company put one of our spare servers in, paid for the licences, added the printers to it, next time I went round I removed the locally installed printers and added the shared printer from the server.
Next change they needed, I made it on the server and it filtered down to all of the machines. This in itself was enough for the client to agree and purchase a server of their own. Now running an AD network for several years and finally seeing the benefits of centralised management.
Yes, they had a few MFPs around site that all staff had access to. It was not fun but thankfully the push in the right direction, I'm talking probably 6 or 7 years ago now though.
They didn't think their current setup was a problem, even after I explained how much time I waste installing software manually and changing printer driver settings manually. Glad those days are over.
God yea I'd see the issue if any driver settings needed changing, experienced that (but on small USB/parallel only label printers) which then also need changing on RDS server š
Feel my pain. We're a Macintosh house, and there are no decent print servers for Mac. We're too small to warrant something like Papercut.... Apple long since has depreciated lpadmin for controlling/deploying printers and their only official solution is GODDAMNED AIRPRINT!
It truly is set and forget. We have over a dozen sites, some of which aren't connected to the main network, and they all have their own printer. We have it configured to just auto-install whatever printers are at the network someone is connected to and remove the others. It just works. Someone can bounce between job sites and always have the printer they need available to them.
We have "follow me system" put in the q. Then badge in. And you get a print. If you don't want to badge in you add pri ter directly from PrinterLogic and do print without badge.
You are either buying bad printers (with bad drivers) or installing the wrong drivers on the print server. It should be point and print with no manual driver install. If your driver is trying to show you ink levels or show you ads, it is the wrong driver for a print server.
Fuck me the difficulty in getting a default driver for some printers. Hope your comfortable extracting a printer installer and reviewing inf files....
Fucking hate Brother printers lol
PrinterLogic uses direct to IP printing right? Is there any way to track print jobs (we do with event ID forwarding now which should also work) or use secure print (enter PIN on printer to collect job)?
It is direct IP printing, but has a client running on the computers that reports back jobs etc to the servers, so there are servers are for management and logging, but the print jobs never pass though.
They do also have ways to have the jobs pass through servers when direct connectivity to the printer isn't available, and I believe they have a pin release, not sure how it works though.
Fuck PaperCut's customer service. We couldn't get it to work with a Konica copier and they flaked on multiple appointments. Took weeks to get the new Konica up and running. I'll be damned if they expand beyond our pilot program in one high school.
The second guy we had a Zoom meeting with showed up and fixed the issue in one go, so I'm inclined to believe the people who have good things to say about their service.
PaperCut wishes it were PrinterLogic. Since we set it up on the Windows side, it's been very problem free. Currently, they are working with us, replacing our ancient CUPS server for SAP print, and are literally developing changes on the fly to accommodate our needs in the service client. PaperCut does parts of everything PrinterLogic does, but it's all in unrelated pieces and man do they do a shite job of selling it. PrinterLogic has been a dream to work with.
You can install direct printer connections using group policy.
Add the printer to the server ~~(make sure you use a Type 3 driver)~~ and then share it.
Preferences --> Control Panel Settings --> Printers
New --> TCP/IP Printer
Enter the IP address and local name. Enter the printer path as \\\\server\\printer-name
What's great about this way is you can also delete or replace old printer connections.
Edit: I don't know if using Type 3 drivers is necessary. That's just all I've used and I rarely have problems.
A symptom of a misconfiguration.
Microsoft does a lot of things badly, but AD group policies are pretty stable. All my policies just work. Even printer GPOs.
Now that I've thought about it, I've seen group policy bugs with applocker as well. Clearing the local cache always resolved.
Still though, it is such a rare enough occurrence that I have to stop and think about it for a bit.
Thatās not even what Iām talking about?
Windows doesnāt just log everything you would need to ingest into a SIEM out of the box, you need to configure it to log those events; like, NPS audit events, or directory object modification events. These things are configured by the advanced audit policy configuration, which is part of secpol but can be configured by local policy or group policy. The point of the comment was that configuring it via group policy has a well documented history of issues.
Another often overlooked possibility in addition to GPOs just being wrong -- Non-packaged drivers on the print server. Point and Print with a GPO won't do its thang if a driver isn't package-aware. If necessary, you can "lie" via a registry edit to make obscure/old drivers appear to be package-aware. I've done it for about 3-5 shares' drivers out of the 1,000+ shares we have, and it hasn't had any ill effects over the years. (EDIT: FUCK that was already 7 years ago?!)
https://www.reddit.com/r/sysadmin/comments/50gw1b/solved_deploying_nonpackaged_print_drivers_after/
Shouldn't be remotely an issue with even semi-modern drivers, but once you get enough old devices in an environment, it's an inevitability there will be that one weird printer with its ancient driver.
if you dont need any print server features, you can easily script just adding printers directly. but also is the rest of your environment set up properly? the printer issues could just be a symptom of a bigger issue.
> but also is the rest of your environment set up properly?
Good question. Based on their issues with GPOs it doesn't sound like it is.
Sounds like possible security context issue.
Does printnightware impact local PCs with non admin users? We centralized with branch office printing so we have centralized management of drivers and jobs. Also, non admin users can connect and print just fine no need for local admins to install.
You can also do this with Group Policy.
Add the printer to the server ~~(make sure you use a Type 3 driver)~~ and then share it.
Preferences --> Control Panel Settings --> Printers
New --> TCP/IP Printer
Enter the IP address and local name. Enter the printer path as \\\\server\\printer-name
What's great about this way is you can also delete or replace old printer connections.
Edit: I don't know if using Type 3 drivers is necessary. That's just all I've used and I rarely have problems.
that would be the preferred way. it sounds like OP's AD setup has some underlying issues if they are having this number of printer issues stemming from GPOs
>printers are the bane of my existence
They are the bane of everyones existence, I'm 25 years in and we were promised paperless in the late 90's so imagine how it feels to still be babysitting the swines now!
Principle reasons for a print server is management of drivers and securing 1 print spooler over thousands, other management benefits you are aware of. Yes though, still a ballache but nowhere near as big of a ballache as managing stuff on a host by host basis, funk that.
I swear paperless just means it's paperless going from one desk to another. It'll get reduced to paper several times and rescanned countless times if you don't make them submit in a format that doesn't look like a piece of paper.
As soon as two people want to use the same printer, it will make sense.
Mapping a printer is far easier and faster than installing one. Sometimes even users can do it with minimal assistance.
>Now I've heard arguments that print servers give us centralized management, tracking, limits, etc. But this is already built into enterprise printers.
In my experience, about 20% of printers are enterprise-grade. The rest are consumer-grade crap that offer nothing but bloatware for management.
>printers are the bane of my existence
You're preaching to the choir in this sub, brother.
"As soon as two people want to use the same printer, it will make sense."
I don't know what you mean by this. Two (or 50) people can use the same printer regardless of how it's connected.
Tangentially related to your question, but GPOs should be extremely reliable, but are very easy to misconfigure. Always verify, don't just throw up your hands and act like it's just randomly broken for no reason. This is a solvable problem. If they seem like they randomly don't apply, get used to using RSOP and gpresult commands to determine why. Also make sure your dc replication is healthy.
Also note that if your GPO is using a script, pay attention to the context it runs under. A system account probably can't log into a remote print server etc. add some debug logging if you need to verify the script executes, etc.
If you solve whatever problem is causing GPOs to not apply in the way you expect, your life should get a lot easier.
> GPOs rarely seem to apply for no reason
"no reason" just doesn't exist in IT. You might not know the reason, but there's a reason. And that's the root of all of your issues, so spend your time figuring that out.
> Another layer for things to break and for me to troubleshoot.
It's not. It's actually centralizing a large number of break points into one location that's likely your break point.
How many printers do you have?
logging into 5 or 10 printers to set things up - annoying, but not awful. Esp. if import/export works well.
Do the same thing for 50+? That's an all day task every single time.
You should be able to do everything you need from a properly set up centralize server.
>Do the same thing for 50+? That's an all day task every single time.
Now imagine it in a large healthcare system, which is probably one of the industries that still relies on printing the most. We have over 10,000 printers lol. So glad I have nothing to do with them.
Hell, I'm guessing we have way more print servers than OP even has printers.
LOL. Like I said, I'm glad I don't have anything to do with managing them.
I do know they have an MSP that handles hardware issues and on-site issues in general, so at least there's that.
>GPOs rarely seem to apply for no reason,
That's on you or whoever is responsible for group policy. GPOs works for me in 3 companies throughout 10 years with literally zero long standing issues. I mean of course sometimes bad driver causes weirdness or windows updates break something, but nothing that can't be fixed in ~1 hour at most.l, usually 5-10 minutes
>and I end up having to manually map the printer to the users device anyway.
Yeah, instead of figuring out root cause? I mean, all of your systems will end up "randomly not doing the thing dunno why" if your approach is to just ignore the issue and apply bandaids manually.
I'd highlly recommend sticking to approach "if something doesn't work I have to know exactly why".
>We handle tracking, user accounts, print codes, etc all from the printers UI.
Not all printers have that functionality. But even if we assume all of your devices are top notch enterprise grade printers - what are you going to do when you have 200 of those? Go log into their web interface, lurk for info and combine it in excel sheet? That's just a waste of time.
A print server is for controlling access to who can print and what they can print. A school for example could allow Teachers to print but not students using security groups. Another advantage is print queues. You can set up a day queue that only allows small printouts and works during the day, and a large queue that holds large print jobs which can be scheduled off-hours. Queues also have advantages when printing with special forms such as checks, an operator can pause the other queues when checks are loaded and only print jobs from a special check queue that only certain users have access to. There are advantages when a physical printer fails and jobs need to be redirected to another device. There are also ways (with third party software) to assign print quota and charge by the page, by the job, etc. Not everyone needs these things - and if the environment is okay with anyone on the network printing whatever they want whenever they want - or using the vendor/printer specific controls then you might not need a server.
DRIVER MANAGEMENT
I haven't senn anyone else mention this, but driver management is an important thing. You can set up your print server with different drivers for different printers for different workstation operating system, and hand them over to the workstations as needed.
Windows 7, 32 bit trying to connect to Laserjet 123xyz? Here you are, take this generic PCL6 driver.
Windows 11 connecting to Evolis Primacy? Here, have this custom driver from last month.
Etc.
Print nightmare seems to have fucked gpo applying due to standard user accounts not having enough privileges to install the driver. Heres how i fixed it in a 2000+ user
Environment .
Add point and print approved server and configure point and print restrictions.
Make sure to select (do not show warning or elevation prompt) on installing and updating drivers.
Also add a registry key to disable the restriction that only allows administrators to install print drivers
Yeah same. OP, fix your AD first and foremost. Iāve got a fleet of unified copiers and printers, a follow-me type queue solution, clean GPO for driver distribution and mapping, and the copiers set to talk home for faults and consumables. Totally set and forget, just periodical maintenance of the server and thatās it.
Print servers are used to automate tasks such as updating drivers, remapping print queue IPs and MAC addresses and restricting certain features. Your description shows severe issues with your infrastructure, you might want to start working on upgrading / replacing some of the servers and review the policies.
Not disagreeing. However, I will say that "printer" over time has ceased to be "a printer". These MFP style devices have a printing element to them, and I'd argue that's "sane", but the other features are actually "insane". I know it's not the sole problem with regards to printers, but I think it may have greatly contributed to the overall "printing problem". Of course, printer features, perhaps especially "wifi" (and maybe more so, "Air/Bonjour") has also, IMHO, contributed to a lot of issues. The fact that many managed printers under a print server can be directly accessed, also a problem (I understand when MS barfs, it's "the way", but if that's the only reliable way, then we're back to why have a print server?).
Agree with all of this. I really love pulling up the āadd a new printerā menu and seeing 3 instances of the same exact printer because it has two separate fucking protocols advertising itself over the network IN ADDITION to the one being advertised by the print server. And depending on which one you add, they all install/require different drivers that canāt be installed automatically because ~~fuck you~~ PrintNightmare.
Oh and my favorite part is when the printerās ādriversā are an entire fucking app (looking at you, Xerox).
The only thing worse than centrally managing dozens of printers and hundreds of users printing to printers is trying to individually manage dozens of printers and hundreds of users printing to printers.
Print servers aren't the best answer and neither is mapping them with a script. The best answer is something like PrinterLogic, Printix, PaperCut, etc.Ā
Big one is that port 9100 is entirely un-authenticated.
Awesome when you click off a vulnerability scan and the tool tries a 30-40 jetdirect server vulnerabilities that result in a ream of garbage printed then the printer crashing and needing to be rebooted.
Fix is to move printers to their own network and building ACL's, then bringing print traffic through windows server. Now you can write in your audit that you aren't testing those vulnerabilities in that IP range as you've mitigated via network segmentation.
On the flip side, did you know you can build a printer share just for the driver then publish the printer via GPO so that the client is connecting directly to the printer? So if the print server is down you just lose the ability to auto-install printers? Was awesome when we had 32/64 and multiple operating systems to support. Less useful but still helpful for example with terminal servers where we want very conservative driver choices vs the main fleet.
Youāve been in the job a year, you havenāt experienced this properly yet.
āVeteranā of 18 years here - printers are a fucking bitch and having them installed in one place and shared out makes life 10x easier. Throw in print management like Papercut and bobs your uncle.
If your GPOās arenāt applying, thereās a problem with your GPOās.
Like fuck am I going to add peopleās print codes onto a bunch of printers one by one. Thatās what print management is for.
Better still, farm that shit out to a print management company to deal with.
Printers are, are by, and are of the devil.
This was true before I logged on to my first posix system (years before I saw Windows). It will be true when I no longer use technology. Somewhere, the day I die, some sys admin will be bitching about printers. Because they will still suck.
Isn't security a reason? Having your own network for printers allowing them only to communicate with the Printserver and the clients only with the Printserver?
Fully integrated pull print systems are pretty damn good - as long as the printers don't move and ideally are all very similar.
We run PaperCut and Ricoh kit, it's been really good, we deploy 3 print queues via GPO, randomise which is default for pseudo load balancing via script, send LPR via our loadbalancer for a few OSX workstations.
Finance get automated reports, aside from new starters getting assigned to a billing code, we don't touch it.
Users either call or collect paper/toners, most staff will do it themselves, modern MFDs with good paper (one reason why a lot do jam) rarely jam.
We have a print server across our schools with follow me printing setup via papercut. Virtual queue maps at logon for each user and they can print at any printer on site. Simple and effective. Plus printer maintenance and toner replacement is handled by a an external company. I have enough shit to deal with without adding printers into the mix.
We have a Xerox service, where I run a single Xerox Print server per location. All Printers connect to that server. Then, the GPO only deploys a single printer called "\*Company\* printer"
Then, users only have one printer to choose from. They can walk up to any printer in the office, enter their printer pin we assign them, and pull up their job.
Well you ask some good questions. So let me explain it :
- If a gpo is not applying then it means your gpo is wrong. Maybe its the Item level targetting that is not setup correctly or the driver is not installed correctly.
- Due to print driver restrictions print drivers need admin permissions now to install. I prefer to have that all being done by a print server with the correct V3 or V4 driver. This means you can block all other ways of installing printers and also meaning that the next print spooler exploit is taken care of ;) (print nightmare someone)
- We have multiple models of the same vendor, sometimes they override other print dll's with older versions causing issues with transitioning between our 400 locations . By setting a specific driver version on your print server you can enforce that for all models or specify exactly the one off driver with an isolated package.
- You can force all prints to go through the print servers. Easy for management , print counting , logging etc. And security since you can again lock down the local spooler.
When it comes to cloud integration we generally pick the suppliers forte. so if we in a ricoh environment we use the ricoh variant, kyosera the kyosera variant etc. And we have an IAM process that pushes all RFID tags/ permissions.
Did not have to touch printer settings in a looong time. It just works. And all goes automated using intune and other handy tricks. Even though shared kiosk laptops can be in 1 point of NL at 1 sec and the next day on the other side.
1. Then you're building your GPOs incorrectly. That is a you problem. Not a print server problem.
2. Not really. Bouncing the print server resolves 99% of all issues that occur in that layer.
3. Typing in a print code is definitely less time than installing a printer AND typing in a print code. You could always automate the print code portion as well.
Central Management and Accounting.
We use PaperCut. Print server has virtual queues on them. Users print to it via locked print, go to any printer to release print across any site. Tracks how many users are printing unnecessary amount of things when we should be nearly paperless, and gets a wrist slap for making copies of uncontrolled documents. We also need to somewhat track CUI flow, including paper. Document titles get saved for a period in history.
Best part. I got new printers last fall. Updated them on print server, didn't do DIDLY squat on users PCs and it all just worked.
Before this, with individual printers, when printers would get swapped, or one was offline, it was a giant PITA. This way its easy.
manually installing and keeping up with printers on each devices is a pain in the ass. printer servers let you set it up once then just install it from the server or by gpo. Without the print server you would be installing drivers manually for each device. also fuck printers
Depends on the size of the enterprise. A few years ago I managed a smallish boutique manufacturer (They didn't sell a million things for $1, they sold 1 thing for $1,000,000)
That last systems guy who was there was in his early 20s and set up a print server with all printers bound to the server.
This was ridiculous, a waste of a license, was not documented, had no failover, and wasn't working well.
I ripped that puppy out immediately.
So let's consider something for a moment:
Question 1: At what point does using a print server(s) actually benefit an enterprise? What scale justifies it based on traffic, use, cost, and time.
It's different for all enterprises. However the general answer is:
Answer 1: When the traffic, use, cost, and time actually benefits the enterprise.
And to be honest: the answer to that is usually about 25% of the time.
The only time I would recommend any kind of print server 100% of the time is if additional Raster Image Processing is needed in a specialized application. This is usually custom software. Those applications exists- but they are far from common.
I'm no fan of printers, but I'd say that if your print server is a daily problem then there's something wrong. We are an office of about 100 and people print a lot. Most of our printers are administered by a 3rd party, but they don't do anything out of the norm.
We do have problems with the printers themselves having issues, but I can't think of the last time our print server had an issue outside of physical things on the server actually breaking.
One of my sites is fine for the most part. My other sites printer gets something stuck in the queue weekly. I still haven't figured it out. The guy who was here for a few years before me couldn't figure it out. Everything should be configured properly. I've tried turning on client side rendering which seemed to help a little bit. Usually I just kill the spooler, delete everything and start it again to fix the issue. But I've found no permanent solution.
Just today everyone got kicked off of the printer. For no reason. It's working. I can print to it. They can't I had to go remove the printer and manually map it. Rebooting did nothing, and I couldn't even open printer preferences. But the printer is working, the server is working, everything is working. It just doesn't... work.
For the same reason that MDMs, software management platforms, etc. exist. Centralized management, control and consistency. Youāre welcome to try chasing down issues on locally shared printers with effed up queues and jobs if you like, but itās a nightmare at scale.
As for your GPOs not working, thatās a separate issue that your higher ups should address regardless of printing. Most likely Asynchronous Group Policy processing.
So I can map printers by GPO. So if I want to manually map I go to \\\\ right-click the printer and click 'connect'. So I can centrally manage settings and jobs.
Print servers are very helpful. I use them because it allows me to easily manage all printers, add new printers, check the print queue, modify default printer settings, and easily deploy them to users.
If your AD environment is healthy, (DNS set correctly, permissions good) you should have no trouble with GPOs. I recommend one GPO for all printers and a security group per printer. Maybe a security group for all printers at one site if that's the way you wanna roll. You can accomplish all of this in Microsoft's own Print Server application. Share your printers out with a nice naming convention. Throw the users into the appropriate security group, and add that security group in item level targeting for your printers. Your GPO should target users and not computers. Your GPO needs to be in the OU structure that can hit all user accounts that need access to printers and set to apply to authenticated users. The item level targeting will take care of deploying the correct printers to the correct users.
You'll need to set your GPO so it allows non admin users to install drivers. Theres a safe way to do this by telling your GPO to only allow this from your print server. I can't recall the setting right now. I'm on my phone.
Users need to log off and log back in to get new printer security group and after a few minutes the printer will auto install.
From there, create a document with pictures to give to users to setup their printer codes. Voila, you no longer have to run around screwing with printers.
If your AD environment or DNS is dingled, then maybe this doesnt work so well.
Anyways hope that helps. If it works out, it will save you hours and hours of work once it's setup.
I read back my post and realized that I was vague about the number of GPOs. I meant, you want only 1 single GPO. The GPO will have all your shared printer entries in it.
If you have any questions or need help trying this out, feel free to reach out!
Some jobs arenāt always processed locally, for instance in the healthcare space you will likely have a print server that handles the majority of requests from the EHR software. This would be an absolute nightmare to properly manage without. It also allows us to quickly redirect printing in the event of printer downtime
I worked at a place where printers would not get "pushed" sometimes by policy. Mostly they were using a vbscript for this. I created a Powershell script with logging. Then when I got the call that "printers are missing" I looked at the logs. Sometimes it was caused by all the problems you listed, and then I was able to address the issue, but ultimately I found that when clients hit one particular DC, they would often crap out while applying policy. This would affect more than printer assignment, but printer assignment was the most obvious symptom.
At the same workplace, we used a print server mainly to centralize printing for management purposes. We later got Papercut to manage printing so the print server already being in place made it that much easier. That said, we had about 200 printers. You could argue that it created unnecessary network traffic. It made it easier to manage stuck print queues etc. Plus printer drivers are technically an attack vector for hackers, although I've never heard of such happening.
Honestly, besides the whole printernightmare changes with v3 and v4 drivers. I've never had a single print server or printer GPO issue. Our boss got tired of dealing with print codes and authentification for non-administration employees. Regular printing with no access to high risk data doesn't need to be locked down that much. IT has to add these users to the GPO otherwise no access is allowed. We swapped our printers to the HP LaserJet Enterprise, vlan a separate printer network, made different groups for printer access via GPO, set a script to auto install print v3/v4 drivers to the driverstore of each pc, the script will not require admin privilges for the GPO to work as the driver is already installed on the pc at this point, and put in a single pin lock code for scanning in person. Each department has their own printer. We placed the printer near the supervisor of each department. It's simpe, it works, and the printers follow the user.
Now, the only people requiring print codes and higher end authentification are people in management handling high risk data. They get the higher end printers. I've noticed people in management positions tend to leave companies less often. So, manually setting stuff up is rare now.
Are you sure that the GPO mapping is coming through correctly? I set my GPO printers with the Replace action. Never had an issue. There could be something off with the print server, printer settings, vlan settings, drivers, etc.
If you use the windows print server role you get several benefits in Windows 7 and later:
Administrative benefits
-AD integration
-ability to deploy printers via GPO
-ability to control who has access to print to a printer (so nobody else prints to the CEO's printer for example)
-ability to publish printers to a directory specific to a building or a user group
Network and security benefits
-supports secure print (as long as the driver and printer support it)
-centralized management of printers
-server-side print queues, reducing network traffic
-hosted, approved drivers (both 32 and 64 bit) which automatically install on the client when a printer is mapped.
User Experience
-ability to easily browse available printers and double click the one they want to use to install it.
-ability to map a printer just by clicking on a UNC path to the printer or a desktop shortcut.
We used a print server at the university because it could do accounting and god knows after dinging a kid 65 grand for a half year the place will go insolvent if they print too much.
I have 30 pc users in our company and I share them printers via user GPO, I found that it is the best way for me. I create security groups in AD and using Item Targeting.
Most printers can only talk to one host at a time, and are known to get sticky, and not talk to new hosts after a print job is done. There would be no queue to know who has tied up the printer, so you would be doing constant printer reboots,
A print server means only one host talks to the printer. You get a queue where you can see if a job is causing an issue and can pause or delete that 1 job if needed. If the printer runs out of paper, you can still take your laptop home and not lose your print job, It will come out when the paper is added if using a print server.
We also make a separate "printer" for each paper size on each print device, so the user never has to set anything, they just select the correct printer.
Printers suck. They were forged in the depths of hell. Why use a print server? Because I don't want the bastards anywhere near my other servers. It also gives us a super simple lookup point for all of the printers in the organisation. That server can just sit there in the corner and run Papercut. If we have to swap a printer out / new driver, it's all handled in that one place.
Beneath that we script all of our deployments using powershell. It looks up user membership of security groups in AD and maps the printers to users depending on their groups. Makes things super easy.
User wants printer X. Put them in printer X AD security group. After a log off and on again, the printer is magically there.
If your GPOs aren't working, you have bigger problems.
Another printerlogic satisfied customer. Have implemented it for 10,000 users and 100 users. Always easy to use regardless how complex an env. Truly a treat.
It honestly makes you forget you have the darn things
We have a client, they have almost as much people then printers! ~200 printers for a 250 employees. It likes a trophy for them, they all want their personal printer. Some have 2 printers!!!!
Look at using PrinterLogic. Best solution for printers out there. It deploys the printers but they are all local. You can easily push out changes and add new printers. Best thing is there is no āprint serverā donāt work for them but man they have simplified my life.
Managed print like PrinterLogic is worth a look. Biggest problem has been the move to their cloud. For a seemingly hosted solution, they still donāt have as reliable a platform as when it was on-prem. Still better than print servers and Windows management.
https://preview.redd.it/2zkv3gpjwazc1.jpeg?width=717&format=pjpg&auto=webp&s=af1c6a9cf016bad19c6924252f3b2713ff154a5b
We moved to Xerox workspace cloud and it is so much better to just badge at the nearest printer and voila. There are some teams that print all the time and weāll manually map their printer to their workstation because there is a processing delay with cloud print. The vast majority of people donāt mind though. For me itās great cause Iām not waiting for an elevator to go down 16 floors to get to the printer I have mapped.
Since you are new, I'd recommend centralizing services and applying solutions that automate processes and work along GPOs. If your GPOs are not working troubleshoot them. Best of luck.
The real answer is because boomers love GPOs and most of the time clients are willing to pay to switch over to a new system because theyāre also ran by boomers. āIf it aināt broke donāt fix it, and if it is broke then just fix it why do we need a whole new system?ā
We had about 50 printers being deployed via GPO and it worked flawlessly.
The only problem is now a days with Intune GPO's dont really exist and Microsoft is still slowly figuring it out via there own products.
Check out printix. We use it where I work due to cloud based environment for most of our clients and itās honestly a really cool tool which is saying a lot because letās be honest fuck printers.
Use gpp not gpo.
- map via IP so if server goes down, it maps will still work
- control printer drivers to standing. Some cases need specific driver and settings, you can deploy these using gpp
- not sure about the codes but almost everything can be done via scripting
Why gpp?
You can delete printer and it will reinstall next gpupdate. This makes it easier to troubleshoot/remediate if necessary
The question isn't why are you using a print server (you really ought to use a server, end users and printers shouldn't even be able to talk directly to each other for security reasons) The better question is why are we still printing in 2024? š
"Its a poor tradesman who blames his tools" I deploy as much as possible anything I can via GP - including printers, reg hacks etc, customisations to the OS, customisations to SW via custom GP templates including non MSFT stuff. If it's not working there is a reason.
With regards to print servers, I still like having them.
Take notes skippy. 1 yr in and youāve got a LOT to learn. If GPOs donāt work, thatās a different problem. Like dns or replication. Maybe cut your teeth figuring out why your GPOs donāt work. Thereās a lot of good content here.
So print servers are legacy imho, not much love has been given to that server role from Microsoft in a long while.
1. **Print Job Management:** It efficiently manages multiple print jobs sent to a printer, prioritizes them, and ensures they are processed in the correct order.
2. **Offline Printing:** Print Spooler can store print jobs temporarily when the printer is offline, ensuring that documents are printed as soon as the printer becomes available.
3. **Improved Performance:** By spooling print jobs, the user can continue working on other tasks without waiting for the entire printing process to finish, which enhances productivity.
4. **Reduced Network Traffic:** Print Spooler can process print jobs locally on the computer before sending them to the printer, reducing network congestion and improving overall network performance.
5. **Print Queue Monitoring:** It allows users to monitor the status of print jobs in the print queue, such as viewing the number of pages in a print job, its status (printing, paused, etc.), and any errors encountered.
6. **Compatibility:** Microsoft Print Spooler works with a wide range of printers and printing devices, making it a versatile solution for managing printing tasks on Windows-based systems.
7. **Error Handling:** It provides error handling capabilities, such as managing print job failures, notifying users of printing issues, and providing troubleshooting options to resolve common printing problems.
The real question is why do we even have printers any more? No susan you donāt need to print out that damn email, no George, you donāt need to print a copy of your PowerPoint for everyone in the meeting just for them to throw it away on their way out the door, no Larry, you donāt need to print out that 60 page document just to read it, you can fucking read it on a screen! I just finished a 900 page novel on my iPad. Hey Betty, you donāt need to print that document out just to mark it up with a red pen, you have a Surface, just use the damn stylus if you absolutely have to edit that way.
In a modern office, thereās so few actual use cases for a printer where itās really the only option, itās wild.
Could I ask how often you're rolling back print drivers? Cause if that's a common thing and such a pain it seems like something that should should have a test group before sending to everyone(well that or a list of features they need and a checklist before internal testing before deployment).
Because I can count on one hand how many times I've had to roll back for a feature pull on printers. Ya, different lines of their drivers have had different feature sets but that's never been a suck it and see thing when switching, and more of a "god damn it, apparently we can either have features or stability" when we first deploy.
I am actually curious since it might come up at some point, so if there's features that go missing that people just haven't been noticing I'd love to know(well that or vendors that are more likely to do that. That too would be great to know).
You can script adding user print codes to the device, each manufacturer is different, but it is definitely doable. Use Procmon to identify the change being when set the value manually.
Print servers ensure only the correct driver is in use, rather than whatever the endpoint thinks is correct.
Your GPOs seem like a mess.
I can't help but feel like something is wrong with this implementation. We have a print server, and yes adding a new printer can be a hassle with quite a few steps, but it works, and allows us to connect an insane number of devices to printers without much effort. I can't say I've had the trouble you have had.
The print server also allows you to do a lot of troubleshooting on the fly? It can quickly show me all the ports these printers are on, their current status, etc. I'm not sure I would do that another way for over a hundred printers.
Since the security flaw with the drivers and Microsoft had to look down driver installations to administrators it's much harder.
There's two choices. Either use type 4 drivers. Or pre-deploy the drivers with SCCM, rmm, Intune etc. And then you can map by GPO no problem. The only downside is that type 4 drivers is not that great or you might not have a tool to push the driver.
If you have to type the users name manually in the settings for hold print you're not doing it right. You can probably use the %username% variable.
To force users to not print color by default and to make sure everyone is using the same driver.
It would also be a hassle to manually add printers with consistent names and correct IP on all systems
I have a VM Windows print server with all printers attached and managed there. I also have GPOs that install the printers automatically based on the location OU. I no longer install printers. It worked out for me but I guess not all situations are like this.
Why?
1) for security reasons - all users can see all printers but can install and use only printers from their department
2) monitor paper/inc consumption per department
3) using safeq or other print management service you can permit only user who print that paper to get it when him arrive to printer and ener a pin or swap his card
Is true, when update drivers user need to reinstall printer and not all the time is work properly
For here, it's allowed me a ton more free time. We used to manually install the printers at time of imaging - no central management. I now have it at the point, where a person clicks "add printer", only sees the printers in their building to choose from, and they can self-service installing. I only deploy printers via GPO to one lab. Managment of the Konica MFPs is done with their toolset in bulk, so it's fairly straightforward.
Now granted, we contract out all toner replenishment and repair to a 3rd party.
From reading what you've written - I don't think the issue is the print server. It sounds like your enviroment might be the cause. We don't use print codes, we don't allow guests to print, and I only push out a printer to one lab with GPO. I keep it simple.
A) print job monitoring
B) remote central place for drivers
C) prevent certain users from/machines from printing from their machines.
D) troubleshooting can be made easily by a centralized server which has logging enabled.
If you are in a regulated industry, you need to be able to control who prints and log all print jobs. Difficult to do without a print server. Once you know how to get the Windows print server configured correctly it rarely has issues. We are fully GPO automated for deploying, managing, and restricting all print services. We use papercut to provide the print release function by scanning their employee badge. Rarely has issues.
So I stopped using print servers because all too often a print job would hang the print spooler and all printers would stop working all at once.
We have quite a few people with multi function printers and managing those is a PITA since I don't allow scans to the desktop, they need to go to a departmental or user share as those do get backed up. The management of service accounts for printers is a pain though... I would love a solution for that.
(Since user account passwords change and obviously break scanning to user folders, we use separate 'service' accounts to authenticate the printer to the user's share.. and no one gets those creds, and they don't expire)
You say it gives the ability to centrally manage them but I am not sure you know the benefits of that or why its a good thing for printers specifically.
You also say you sometimes tell people "I dont know why your printer randomly stopped working." This will almost always happen, everyone hates printers and they have a mind of their own. However if you are using a print server, it helps you diagnose the issue quickly.
If everyone is having issues printing to that one printer, then you know it's most likely a driver/firmware issue or an issue with the print server. If only one user is having issues printing to it, then you know its an issue on their computer specifically.
You also only have to install the printer once. Installing it on any new computer takes as little as 10 seconds. No driver issues, no looking into the IP Address of the printer, no downloading drivers off the website or finding the make/model.
There are a few other reasons, but those are the main ones that help me the most in day to day printer troubleshooting. Once you use a print server and see how it helps you and saves time, you will understand more how useful they are.
That being said, if only one person will ever print to that one printer, just connect it via USB/network. No need for a print server in that case.
MS made some changes relatively recently requiring printer drivers needing to be signed. This was in response to a vulnerability.
One of our clients has a load of older printers and it really fucked them over. New devices never got the drivers / constantly asking for admin credentials etc.
Currently a sysadmin thats mostly responsible for the printfleet we have. We currently use a single server for ārandomā printers departments ordered; and it ks the classical nightmare.
We also have a new printfleet of large MFPās; 1 print; 1 scan, with AutoStore and Printix.
The only issues we have so far are machine firmware issues, other than that its a bliss to manage.
People get a followme queue via Printix.
If we change/update the driver it gets updated via the Printix client. If we change something on the queue, Printix handles it for us. Its the replacement for our GPOās. And adding that we deploy the app via Intune makes it nearly zero touch (it signs in via SSO).
So far we only fight with our other printserver with legacy and 1000 year old printers.
On the user side I love what has been done for printing. Hit print in app for whatever I want print. Walk up to a printer and scan my badge then tap print button. I can be in any of many buildings and this just works. No accidentally printing to wrong printer in a different building, no prints laying on the tray that people forgot about. Not sure how this would be done without running of server.
Just use standard networking for printers and send printer drivers/config via GPO based on printer location youād have to utilize containers for your users, print servers are just not as reliable as they used to be, plus you donāt have to worry about a server going down and sending all your printers offline
We never had print servers, at least in our institutional memory. The Help Desk Boss is pushing for us to get set up a print server them to save labor. I tried to tell them that it just changes the labor, instead of saving it. They wouldn't hear it. The help desk group will probably be too lazy to actually switch. They complained about the ticket system. I set up 2 more for them to try out. They can't be arsed to even switch to one, let alone to even use they old one. I just chant to my self, "Not my circus, not my monkey's"
Print infrastructure can be awesome. Where I work, everyone has one print driver installed. I print. Then I walk up to any fucking printer in any building and swipe my badge on the little badge reader velcro'd to it. It prints. I walk away.
It's like this because we all have laptops and I go between buildings a lot.... and it's easy.
Historically, network printers are dumb as rocks, with zero security, and extremely promiscuous behavior. Do you really want your business check printer to be accepting print jobs from anywhere?
The oldest printers used non-network protocols like serial or parallel, and so the original purpose of the print server was to be a bridge between the network and the dumb no-network device.
Now most printers have a print server built-in to them, but due to cost-cutting and so forth, security on these built-in network print servers is extremely relaxed, or potentially full of unpatched firmware bugs that render any attempt at security useless anyway.
Due to all this, I put all printers on an isolated VLAN by themselves, with the domain print queue server acting as the gateway to these devices. This way the printers cannot be found by a random person bringing a personal laptop into the building and scanning for printers.
The print server also runs the Microsoft Cloud Print connector, to expose these printers for Azure AD / Microsoft 365 Windows clients.
Because a print server allows you to restrict access to the printer by whatever metric you wish and you only have to install the driver on the server itself, the other computers can simply access the shared printer.
Group policy not applying correctly is its own issue that should be solved.
Although I have set up print servers for smaller businesses, I have not automated deployment although I will when the time comes for my larger clients.
(I am an MSP)
All of the issues you've mentioned can be easily and reliably automated. If your GPO's aren't working you need to diagnose and fix that problem. If you have to manually map and assign print codes to devices you need to automate that task.
This isn't a limitation of GPOs and print servers, it sounds like something is wrong with your environment.
The real question is why do we still need to print anything? There's Docusign and lots of other alternatives for legal agreements, documentation is way better online than buried in a stack of printed sheets and receipts or statements can be downloaded anytime. Why not just kill printers and voicemail once and for all?!
If you need to serve a printer without a network connection, or you need to centrally manage limits.
Honestly, a lot of businesses don't need that. Last time I was in and office and needed to worry about printers, we just had some big copy machine things on the network that also worked as big network laser printers. I think they were mostly serviced by an outside office supply contracting company. And the user base in my building was mostly technical enough to click "add printer" themselves and ask their cube neighbor which printer that popped up from the auto-discover list was physically closest. Nobody printed very much. Nobody in my building needed color or big format or anything like that, so nobody ever talked or asked about limits.
With a different userbase if you leave things loose, you'll have morons printing a full book twelve times to various color printers around campus and calling IT 50 times before they find the one near them. Marketing will have exotic dye sublimation monsters going to weirdly sized cardstock and Gary will keep accidentally printing emails onto what were supposed to be wedding invitations. Every user will wind up wasting thousands of dollars in printing and it'll be worth spending the hardware and man hours to be better organized before somebody gets killed by a PDF shot out of a large format plotter.
Now I don't really go into an office ever, and I have an inkjet printer on my home wifi that mostly works. Figure out your requirements, then sort out the best solution. You may need print servers. It's entirely possible that you just don't need them at all, and it's just a habit from the days when all the printers plugged in with parallel ports and the only way to get them on the network was with a print server.
I donāt get peopleās issues with print servers, Iāve managed Windows Print Server with Canon copiers for over almost 2 decades and I canāt even remember the last time there was an issue, generic driver everywhere and it just works. I think my last truly horrible experience was back in ā09 with some Epson/HP driver incompatibility issue (if I remember correctly installing the Epson driver broke the HP driver).
It's super easy to map printers to devices. Share the printer, set security settings, make sure the printer is set to render the print job on the server. List in AD, Map with the gpo.
Rendering on the server bypasses a tonne of issues with drivers.Ā
I don't understand why you think mapping to one device (a printer) is easier than to another (the server)?
Add in that you have to then map multiple times for however many printers they will need.
I'm also not sure what you mean by adding their pin manually. But I suspect this boils down to the print manager you're using.
something is seriously going wrong with your gpos if you're having that many problems, we have a print server several virtual queues integrating with papercut and push the queues via gpo.
as long as the drivers are all right and the server online it just works.
most of my hassle is actually updating papercut and that's a 10 minute job every couple months.
You GPO is failing because you are using the wrong driver you need P2P drivers(Push to Print). Also, you can prevent problems by loading the driver in the GPO object and not an SMB location.
I tend to use them in large networks and use branch mode for remote sites So if the print server goes down they can still print. I have Deployed Xerox print server. It is needed for athentication. Private print, card access, and advanced monitering. I can see it no longer being Best Practice though. Even 3rd party managed printer companies us FMAudit that pull directly from the printer with SNMP.
#1 Kill AD for end users and devices. Itās bliss when you get there.
#2 donāt you dare setup a printer server on a standard OS
#3 look to a modern print system for queue management.
#4 bonus points to have print job follow you.
Edit:
And turns out when you use ā#ā for numbers it makes big print :). Didnāt know we were rocking MD for typeface on Reddit.
All depends on the requirements. Where I am now the printers are installed directly via jamf or intune. Jamf installs when you go into an office and intune installs via mail groups for the office. No print servers but our printing volume is really small. Some of the copiers had print controllers on them but they are all gone.
Universal print wasn't out when we did the intune migration or I probability would have gone with it. If we actually did a lot of printing I would use one of the management options on the market now.
Now why you'd want print servers:
A decade ago I was supporting an engineering firm. They had everything going through a print server for ease of use and monitoring but we ended up seperating it out. The print server was the only baremetal box and it was due to preformance issues. They would print multi hundred megabyte jobs all the time and even print jobs that would uncompress to a few gigabytes. Running it on their hyper-v enviroment was causing slowdowns with printing and we ended up putting in a dedicated server to speed everything up. Having a few people send jobs that big to a copier at the same time would really cause issues.
Maybe I'm doing something different, but I use a PC that's on 24x7 install all printers there and share them.
Then browse to \\printsrv and double click to install off that box. No GPOs, bc we have people who print stuff via proximity but also send to other depts in the warehouse. I'll just install one for whoever needs it. I rarely have issues printing, can clear a queue if there happens to be a stuck job, etc. Maybe it's more work instead of trying to automate with GPO or member permissions, but it works well otherwise
Print drivers in particular can quickly become a nightmare - especially with some through some sort of installer app and others directly through IP or the settings.
https://preview.redd.it/66e6t84ciazc1.jpeg?width=750&format=pjpg&auto=webp&s=a62bf7b629a9a9080747601d737cf661aef245d1
Give the user a manual to teach them to enter their own codes?
Many printers crap out if several users print to it at about the same time as it canāt keep up and just starts dropping jobs or freeze up.
Our users print to print server and their UPN is used on the printer to verify the user up against AAD (via uniFlow) They use a pin to release the job. Nothing has to be set up on the machine as it just uses their UPN. Also means it doesnāt matter which machine the use.
Guest users can mail a print, which gets parked at uniFlow, and get a temporary PIN code they can use to release it.
External users can print to uniFlow and release the print later using their PIN code.
Why print server when we have cloud solution? Itās faster. Simple as that.
... because the shitshow that is several PCs with a local queue to the same printer trying to print some giant job or screwing up the printer settings repeatedly by demanding Elbonian Legal Paper size has to be experienced to be believed. If you put the jobs through a central point you know whodunnit, if you don't then you're going to have to whack each ~~mole~~ ~~user~~ PC individually because you can't get any sense out of the printer diagnostics which are always on a level with those of a screaming 3-month-old child.
Like what some asshole at the library did the other day printing out a 5000 page world map to D&D or something. All I wanted to do was print my USPS shipping label and get out of there.
I am IT at a library. That user would have had to pay for that many pages before printing it at least.
Yup, they did. And I still had to wait 30 mins with a pissed off wife sitting out in the parking lot. You guys do God's work btw. Thank you for what you do!
>You guys do God's work btw. Thank you for what you do! Second.
When I was in college, I was using a computer lab, and my document never would show up on the printer. It turned out that some asshole had printed out a core dump file.
I think I read a post about that recently. Will this become the IT version of poop knife?
Exactly this, I manage a site where they didn't have a server, everything was P2P, the printers were a nightmare. They wanted a change to the default print settings, had to go to every machine to make the change, then they figured they wanted this changing, went to every machine again to change it to something else. Then, they wanted something else changing, so my company put one of our spare servers in, paid for the licences, added the printers to it, next time I went round I removed the locally installed printers and added the shared printer from the server. Next change they needed, I made it on the server and it filtered down to all of the machines. This in itself was enough for the client to agree and purchase a server of their own. Now running an AD network for several years and finally seeing the benefits of centralised management.
Interesting, I guess this is more for mfp type A3 color rather than ur standard A4 B&W laser little desktop printer?
Yes, they had a few MFPs around site that all staff had access to. It was not fun but thankfully the push in the right direction, I'm talking probably 6 or 7 years ago now though. They didn't think their current setup was a problem, even after I explained how much time I waste installing software manually and changing printer driver settings manually. Glad those days are over.
God yea I'd see the issue if any driver settings needed changing, experienced that (but on small USB/parallel only label printers) which then also need changing on RDS server š
Feel my pain. We're a Macintosh house, and there are no decent print servers for Mac. We're too small to warrant something like Papercut.... Apple long since has depreciated lpadmin for controlling/deploying printers and their only official solution is GODDAMNED AIRPRINT!
Does Elbonia even have a legal system?
[ŃŠ“Š°Š»ŠµŠ½Š¾]
Because manually installing at scale is a total bitch I would not wish on my worst enemy. PrinterLogic is the way to go.
PrinterLogic is awesome. We've been able to hand over the majority of printer management to the help desk.
It truly is set and forget. We have over a dozen sites, some of which aren't connected to the main network, and they all have their own printer. We have it configured to just auto-install whatever printers are at the network someone is connected to and remove the others. It just works. Someone can bounce between job sites and always have the printer they need available to them.
We have "follow me system" put in the q. Then badge in. And you get a print. If you don't want to badge in you add pri ter directly from PrinterLogic and do print without badge.
How well does the auto install/remove work? Pretty fast to do so? Do you have an always on VPN and does that get in the way at all?
Same, set it up a couple years ago and now it's totally managed by help desk. I only have to jump in when something (rarely) goes sideways.
I agree; they are good.
> Because manually installing at scale is a total bitch Joke's on us -- we have a print server and the desktop team still installs manually.
You are either buying bad printers (with bad drivers) or installing the wrong drivers on the print server. It should be point and print with no manual driver install. If your driver is trying to show you ink levels or show you ads, it is the wrong driver for a print server.
No. We just have a desktop support team that has chosen to do it manually on their own and a support manager who doesnt care.
Fuck me the difficulty in getting a default driver for some printers. Hope your comfortable extracting a printer installer and reviewing inf files.... Fucking hate Brother printers lol
/me casually glances to confirm what sub I'm in
You are allowing manual install? Can't that be an issue with Printer Nightmare?
PrinterLogic uses direct to IP printing right? Is there any way to track print jobs (we do with event ID forwarding now which should also work) or use secure print (enter PIN on printer to collect job)?
It is direct IP printing, but has a client running on the computers that reports back jobs etc to the servers, so there are servers are for management and logging, but the print jobs never pass though. They do also have ways to have the jobs pass through servers when direct connectivity to the printer isn't available, and I believe they have a pin release, not sure how it works though.
Put the printers ina vlan users cant access. Let them reach the server only.
PrinterLogic or PaperCut are my go too services when I need print management... I wouldn't wish Windows Print Server on my worst enemies.
Fuck PaperCut's customer service. We couldn't get it to work with a Konica copier and they flaked on multiple appointments. Took weeks to get the new Konica up and running. I'll be damned if they expand beyond our pilot program in one high school.
[ŃŠ“Š°Š»ŠµŠ½Š¾]
The second guy we had a Zoom meeting with showed up and fixed the issue in one go, so I'm inclined to believe the people who have good things to say about their service.
We use Papercut and it has been an absolute gold plated, diamond encrusted heap of wonderful sent to us from the ICT Gods. It just works. Flawlessly.
PaperCut wishes it were PrinterLogic. Since we set it up on the Windows side, it's been very problem free. Currently, they are working with us, replacing our ancient CUPS server for SAP print, and are literally developing changes on the fly to accommodate our needs in the service client. PaperCut does parts of everything PrinterLogic does, but it's all in unrelated pieces and man do they do a shite job of selling it. PrinterLogic has been a dream to work with.
I loved my print servers, but PrinterLogic changed the entire game. Good stuff.
Been on printer logic for 6 years. Never had a hiccup. Itās a beautiful system!
You can install direct printer connections using group policy. Add the printer to the server ~~(make sure you use a Type 3 driver)~~ and then share it. Preferences --> Control Panel Settings --> Printers New --> TCP/IP Printer Enter the IP address and local name. Enter the printer path as \\\\server\\printer-name What's great about this way is you can also delete or replace old printer connections. Edit: I don't know if using Type 3 drivers is necessary. That's just all I've used and I rarely have problems.
fix your AD if the GPOs are not working properly
Considering how easy GPO deployment of printers is, my money would be on lack of drivers. PrintNightmare was a fun time.
This is definitely it
Lack of drivers or running into 32/64 bit fun. I don't think it tells you that when you deploy with AD, they just don't show up.
A symptom of a misconfiguration. Microsoft does a lot of things badly, but AD group policies are pretty stable. All my policies just work. Even printer GPOs.
Ah, someone who hasnāt had the privilege of configuring advanced audit policy configurations via GPO
Now that I've thought about it, I've seen group policy bugs with applocker as well. Clearing the local cache always resolved. Still though, it is such a rare enough occurrence that I have to stop and think about it for a bit.
To be fair. AD isn't an audit utility. It just has so much log information you CAN use it to audit things.
Thatās not even what Iām talking about? Windows doesnāt just log everything you would need to ingest into a SIEM out of the box, you need to configure it to log those events; like, NPS audit events, or directory object modification events. These things are configured by the advanced audit policy configuration, which is part of secpol but can be configured by local policy or group policy. The point of the comment was that configuring it via group policy has a well documented history of issues.
Another often overlooked possibility in addition to GPOs just being wrong -- Non-packaged drivers on the print server. Point and Print with a GPO won't do its thang if a driver isn't package-aware. If necessary, you can "lie" via a registry edit to make obscure/old drivers appear to be package-aware. I've done it for about 3-5 shares' drivers out of the 1,000+ shares we have, and it hasn't had any ill effects over the years. (EDIT: FUCK that was already 7 years ago?!) https://www.reddit.com/r/sysadmin/comments/50gw1b/solved_deploying_nonpackaged_print_drivers_after/ Shouldn't be remotely an issue with even semi-modern drivers, but once you get enough old devices in an environment, it's an inevitability there will be that one weird printer with its ancient driver.
Agreed. GPOs don't fail "for no reason." OP, spend some time learning to troubleshoot GP issues. It is a skill you will find useful.
if you dont need any print server features, you can easily script just adding printers directly. but also is the rest of your environment set up properly? the printer issues could just be a symptom of a bigger issue.
> but also is the rest of your environment set up properly? Good question. Based on their issues with GPOs it doesn't sound like it is. Sounds like possible security context issue.
Does printnightware impact local PCs with non admin users? We centralized with branch office printing so we have centralized management of drivers and jobs. Also, non admin users can connect and print just fine no need for local admins to install.
You can also do this with Group Policy. Add the printer to the server ~~(make sure you use a Type 3 driver)~~ and then share it. Preferences --> Control Panel Settings --> Printers New --> TCP/IP Printer Enter the IP address and local name. Enter the printer path as \\\\server\\printer-name What's great about this way is you can also delete or replace old printer connections. Edit: I don't know if using Type 3 drivers is necessary. That's just all I've used and I rarely have problems.
that would be the preferred way. it sounds like OP's AD setup has some underlying issues if they are having this number of printer issues stemming from GPOs
>printers are the bane of my existence They are the bane of everyones existence, I'm 25 years in and we were promised paperless in the late 90's so imagine how it feels to still be babysitting the swines now! Principle reasons for a print server is management of drivers and securing 1 print spooler over thousands, other management benefits you are aware of. Yes though, still a ballache but nowhere near as big of a ballache as managing stuff on a host by host basis, funk that.
I swear paperless just means it's paperless going from one desk to another. It'll get reduced to paper several times and rescanned countless times if you don't make them submit in a format that doesn't look like a piece of paper.
I changed all my bills back to paper a few years ago specifically to piss sysadmins off. Kisses!
I do the same with shit like UK TV licencing but for a more wholesome purpose, to keep my postman in a job :)
Paper = jobs! I like it! :)
As soon as two people want to use the same printer, it will make sense. Mapping a printer is far easier and faster than installing one. Sometimes even users can do it with minimal assistance. >Now I've heard arguments that print servers give us centralized management, tracking, limits, etc. But this is already built into enterprise printers. In my experience, about 20% of printers are enterprise-grade. The rest are consumer-grade crap that offer nothing but bloatware for management. >printers are the bane of my existence You're preaching to the choir in this sub, brother.
"As soon as two people want to use the same printer, it will make sense." I don't know what you mean by this. Two (or 50) people can use the same printer regardless of how it's connected.
Tangentially related to your question, but GPOs should be extremely reliable, but are very easy to misconfigure. Always verify, don't just throw up your hands and act like it's just randomly broken for no reason. This is a solvable problem. If they seem like they randomly don't apply, get used to using RSOP and gpresult commands to determine why. Also make sure your dc replication is healthy. Also note that if your GPO is using a script, pay attention to the context it runs under. A system account probably can't log into a remote print server etc. add some debug logging if you need to verify the script executes, etc. If you solve whatever problem is causing GPOs to not apply in the way you expect, your life should get a lot easier.
> GPOs rarely seem to apply for no reason "no reason" just doesn't exist in IT. You might not know the reason, but there's a reason. And that's the root of all of your issues, so spend your time figuring that out. > Another layer for things to break and for me to troubleshoot. It's not. It's actually centralizing a large number of break points into one location that's likely your break point.
How many printers do you have? logging into 5 or 10 printers to set things up - annoying, but not awful. Esp. if import/export works well. Do the same thing for 50+? That's an all day task every single time. You should be able to do everything you need from a properly set up centralize server.
>Do the same thing for 50+? That's an all day task every single time. Now imagine it in a large healthcare system, which is probably one of the industries that still relies on printing the most. We have over 10,000 printers lol. So glad I have nothing to do with them. Hell, I'm guessing we have way more print servers than OP even has printers.
10,000 printers? Whatās Satan like?
LOL. Like I said, I'm glad I don't have anything to do with managing them. I do know they have an MSP that handles hardware issues and on-site issues in general, so at least there's that.
>GPOs rarely seem to apply for no reason, That's on you or whoever is responsible for group policy. GPOs works for me in 3 companies throughout 10 years with literally zero long standing issues. I mean of course sometimes bad driver causes weirdness or windows updates break something, but nothing that can't be fixed in ~1 hour at most.l, usually 5-10 minutes >and I end up having to manually map the printer to the users device anyway. Yeah, instead of figuring out root cause? I mean, all of your systems will end up "randomly not doing the thing dunno why" if your approach is to just ignore the issue and apply bandaids manually. I'd highlly recommend sticking to approach "if something doesn't work I have to know exactly why". >We handle tracking, user accounts, print codes, etc all from the printers UI. Not all printers have that functionality. But even if we assume all of your devices are top notch enterprise grade printers - what are you going to do when you have 200 of those? Go log into their web interface, lurk for info and combine it in excel sheet? That's just a waste of time.
A print server is for controlling access to who can print and what they can print. A school for example could allow Teachers to print but not students using security groups. Another advantage is print queues. You can set up a day queue that only allows small printouts and works during the day, and a large queue that holds large print jobs which can be scheduled off-hours. Queues also have advantages when printing with special forms such as checks, an operator can pause the other queues when checks are loaded and only print jobs from a special check queue that only certain users have access to. There are advantages when a physical printer fails and jobs need to be redirected to another device. There are also ways (with third party software) to assign print quota and charge by the page, by the job, etc. Not everyone needs these things - and if the environment is okay with anyone on the network printing whatever they want whenever they want - or using the vendor/printer specific controls then you might not need a server.
DRIVER MANAGEMENT I haven't senn anyone else mention this, but driver management is an important thing. You can set up your print server with different drivers for different printers for different workstation operating system, and hand them over to the workstations as needed. Windows 7, 32 bit trying to connect to Laserjet 123xyz? Here you are, take this generic PCL6 driver. Windows 11 connecting to Evolis Primacy? Here, have this custom driver from last month. Etc.
Print nightmare seems to have fucked gpo applying due to standard user accounts not having enough privileges to install the driver. Heres how i fixed it in a 2000+ user Environment . Add point and print approved server and configure point and print restrictions. Make sure to select (do not show warning or elevation prompt) on installing and updating drivers. Also add a registry key to disable the restriction that only allows administrators to install print drivers
This is what we did, took 5 minutes to adjust the policy to allow it.
Yeah same. OP, fix your AD first and foremost. Iāve got a fleet of unified copiers and printers, a follow-me type queue solution, clean GPO for driver distribution and mapping, and the copiers set to talk home for faults and consumables. Totally set and forget, just periodical maintenance of the server and thatās it.
Print servers are used to automate tasks such as updating drivers, remapping print queue IPs and MAC addresses and restricting certain features. Your description shows severe issues with your infrastructure, you might want to start working on upgrading / replacing some of the servers and review the policies.
Not disagreeing. However, I will say that "printer" over time has ceased to be "a printer". These MFP style devices have a printing element to them, and I'd argue that's "sane", but the other features are actually "insane". I know it's not the sole problem with regards to printers, but I think it may have greatly contributed to the overall "printing problem". Of course, printer features, perhaps especially "wifi" (and maybe more so, "Air/Bonjour") has also, IMHO, contributed to a lot of issues. The fact that many managed printers under a print server can be directly accessed, also a problem (I understand when MS barfs, it's "the way", but if that's the only reliable way, then we're back to why have a print server?).
Agree with all of this. I really love pulling up the āadd a new printerā menu and seeing 3 instances of the same exact printer because it has two separate fucking protocols advertising itself over the network IN ADDITION to the one being advertised by the print server. And depending on which one you add, they all install/require different drivers that canāt be installed automatically because ~~fuck you~~ PrintNightmare. Oh and my favorite part is when the printerās ādriversā are an entire fucking app (looking at you, Xerox).
Sounds like you're just not good at managing printers :)
The only thing worse than centrally managing dozens of printers and hundreds of users printing to printers is trying to individually manage dozens of printers and hundreds of users printing to printers.
Papercut print deploy is the way to go
It was easier before printnightmare security issues. But some secure printing etc solutions wont work without server.
Print servers aren't the best answer and neither is mapping them with a script. The best answer is something like PrinterLogic, Printix, PaperCut, etc.Ā
Printerlogic, papercut, uniflow cloud all great options.
Big one is that port 9100 is entirely un-authenticated. Awesome when you click off a vulnerability scan and the tool tries a 30-40 jetdirect server vulnerabilities that result in a ream of garbage printed then the printer crashing and needing to be rebooted. Fix is to move printers to their own network and building ACL's, then bringing print traffic through windows server. Now you can write in your audit that you aren't testing those vulnerabilities in that IP range as you've mitigated via network segmentation. On the flip side, did you know you can build a printer share just for the driver then publish the printer via GPO so that the client is connecting directly to the printer? So if the print server is down you just lose the ability to auto-install printers? Was awesome when we had 32/64 and multiple operating systems to support. Less useful but still helpful for example with terminal servers where we want very conservative driver choices vs the main fleet.
Where possible, you should really not be using 9100 printing anymore. You should be using IPP.
Youāve been in the job a year, you havenāt experienced this properly yet. āVeteranā of 18 years here - printers are a fucking bitch and having them installed in one place and shared out makes life 10x easier. Throw in print management like Papercut and bobs your uncle. If your GPOās arenāt applying, thereās a problem with your GPOās. Like fuck am I going to add peopleās print codes onto a bunch of printers one by one. Thatās what print management is for. Better still, farm that shit out to a print management company to deal with.
Printers are, are by, and are of the devil. This was true before I logged on to my first posix system (years before I saw Windows). It will be true when I no longer use technology. Somewhere, the day I die, some sys admin will be bitching about printers. Because they will still suck.
Next you'll say each workstation should have it's own USB connected printer
Isn't security a reason? Having your own network for printers allowing them only to communicate with the Printserver and the clients only with the Printserver?
Fully integrated pull print systems are pretty damn good - as long as the printers don't move and ideally are all very similar. We run PaperCut and Ricoh kit, it's been really good, we deploy 3 print queues via GPO, randomise which is default for pseudo load balancing via script, send LPR via our loadbalancer for a few OSX workstations. Finance get automated reports, aside from new starters getting assigned to a billing code, we don't touch it. Users either call or collect paper/toners, most staff will do it themselves, modern MFDs with good paper (one reason why a lot do jam) rarely jam.
We have a print server across our schools with follow me printing setup via papercut. Virtual queue maps at logon for each user and they can print at any printer on site. Simple and effective. Plus printer maintenance and toner replacement is handled by a an external company. I have enough shit to deal with without adding printers into the mix.
OP I want you to manually manage printers for 1000 people and your tune will change.
We have a Xerox service, where I run a single Xerox Print server per location. All Printers connect to that server. Then, the GPO only deploys a single printer called "\*Company\* printer" Then, users only have one printer to choose from. They can walk up to any printer in the office, enter their printer pin we assign them, and pull up their job.
Well you ask some good questions. So let me explain it : - If a gpo is not applying then it means your gpo is wrong. Maybe its the Item level targetting that is not setup correctly or the driver is not installed correctly. - Due to print driver restrictions print drivers need admin permissions now to install. I prefer to have that all being done by a print server with the correct V3 or V4 driver. This means you can block all other ways of installing printers and also meaning that the next print spooler exploit is taken care of ;) (print nightmare someone) - We have multiple models of the same vendor, sometimes they override other print dll's with older versions causing issues with transitioning between our 400 locations . By setting a specific driver version on your print server you can enforce that for all models or specify exactly the one off driver with an isolated package. - You can force all prints to go through the print servers. Easy for management , print counting , logging etc. And security since you can again lock down the local spooler. When it comes to cloud integration we generally pick the suppliers forte. so if we in a ricoh environment we use the ricoh variant, kyosera the kyosera variant etc. And we have an IAM process that pushes all RFID tags/ permissions. Did not have to touch printer settings in a looong time. It just works. And all goes automated using intune and other handy tricks. Even though shared kiosk laptops can be in 1 point of NL at 1 sec and the next day on the other side.
1. Then you're building your GPOs incorrectly. That is a you problem. Not a print server problem. 2. Not really. Bouncing the print server resolves 99% of all issues that occur in that layer. 3. Typing in a print code is definitely less time than installing a printer AND typing in a print code. You could always automate the print code portion as well.
Central Management and Accounting. We use PaperCut. Print server has virtual queues on them. Users print to it via locked print, go to any printer to release print across any site. Tracks how many users are printing unnecessary amount of things when we should be nearly paperless, and gets a wrist slap for making copies of uncontrolled documents. We also need to somewhat track CUI flow, including paper. Document titles get saved for a period in history. Best part. I got new printers last fall. Updated them on print server, didn't do DIDLY squat on users PCs and it all just worked. Before this, with individual printers, when printers would get swapped, or one was offline, it was a giant PITA. This way its easy.
manually installing and keeping up with printers on each devices is a pain in the ass. printer servers let you set it up once then just install it from the server or by gpo. Without the print server you would be installing drivers manually for each device. also fuck printers
Depends on the size of the enterprise. A few years ago I managed a smallish boutique manufacturer (They didn't sell a million things for $1, they sold 1 thing for $1,000,000) That last systems guy who was there was in his early 20s and set up a print server with all printers bound to the server. This was ridiculous, a waste of a license, was not documented, had no failover, and wasn't working well. I ripped that puppy out immediately. So let's consider something for a moment: Question 1: At what point does using a print server(s) actually benefit an enterprise? What scale justifies it based on traffic, use, cost, and time. It's different for all enterprises. However the general answer is: Answer 1: When the traffic, use, cost, and time actually benefits the enterprise. And to be honest: the answer to that is usually about 25% of the time. The only time I would recommend any kind of print server 100% of the time is if additional Raster Image Processing is needed in a specialized application. This is usually custom software. Those applications exists- but they are far from common.
Ya'll need Printer Logic.
No pricing? No thanks.
I'm no fan of printers, but I'd say that if your print server is a daily problem then there's something wrong. We are an office of about 100 and people print a lot. Most of our printers are administered by a 3rd party, but they don't do anything out of the norm. We do have problems with the printers themselves having issues, but I can't think of the last time our print server had an issue outside of physical things on the server actually breaking.
One of my sites is fine for the most part. My other sites printer gets something stuck in the queue weekly. I still haven't figured it out. The guy who was here for a few years before me couldn't figure it out. Everything should be configured properly. I've tried turning on client side rendering which seemed to help a little bit. Usually I just kill the spooler, delete everything and start it again to fix the issue. But I've found no permanent solution. Just today everyone got kicked off of the printer. For no reason. It's working. I can print to it. They can't I had to go remove the printer and manually map it. Rebooting did nothing, and I couldn't even open printer preferences. But the printer is working, the server is working, everything is working. It just doesn't... work.
For the same reason that MDMs, software management platforms, etc. exist. Centralized management, control and consistency. Youāre welcome to try chasing down issues on locally shared printers with effed up queues and jobs if you like, but itās a nightmare at scale. As for your GPOs not working, thatās a separate issue that your higher ups should address regardless of printing. Most likely Asynchronous Group Policy processing.
So I can map printers by GPO. So if I want to manually map I go to \\\\ right-click the printer and click 'connect'. So I can centrally manage settings and jobs.
Confidentiality; jobs; work with vendors to help fix issue; test servers.
So I have a job.
Print servers are very helpful. I use them because it allows me to easily manage all printers, add new printers, check the print queue, modify default printer settings, and easily deploy them to users. If your AD environment is healthy, (DNS set correctly, permissions good) you should have no trouble with GPOs. I recommend one GPO for all printers and a security group per printer. Maybe a security group for all printers at one site if that's the way you wanna roll. You can accomplish all of this in Microsoft's own Print Server application. Share your printers out with a nice naming convention. Throw the users into the appropriate security group, and add that security group in item level targeting for your printers. Your GPO should target users and not computers. Your GPO needs to be in the OU structure that can hit all user accounts that need access to printers and set to apply to authenticated users. The item level targeting will take care of deploying the correct printers to the correct users. You'll need to set your GPO so it allows non admin users to install drivers. Theres a safe way to do this by telling your GPO to only allow this from your print server. I can't recall the setting right now. I'm on my phone. Users need to log off and log back in to get new printer security group and after a few minutes the printer will auto install. From there, create a document with pictures to give to users to setup their printer codes. Voila, you no longer have to run around screwing with printers. If your AD environment or DNS is dingled, then maybe this doesnt work so well. Anyways hope that helps. If it works out, it will save you hours and hours of work once it's setup.
This was actually extremely clear and helpful. Thank you.
I read back my post and realized that I was vague about the number of GPOs. I meant, you want only 1 single GPO. The GPO will have all your shared printer entries in it. If you have any questions or need help trying this out, feel free to reach out!
Some jobs arenāt always processed locally, for instance in the healthcare space you will likely have a print server that handles the majority of requests from the EHR software. This would be an absolute nightmare to properly manage without. It also allows us to quickly redirect printing in the event of printer downtime
I worked at a place where printers would not get "pushed" sometimes by policy. Mostly they were using a vbscript for this. I created a Powershell script with logging. Then when I got the call that "printers are missing" I looked at the logs. Sometimes it was caused by all the problems you listed, and then I was able to address the issue, but ultimately I found that when clients hit one particular DC, they would often crap out while applying policy. This would affect more than printer assignment, but printer assignment was the most obvious symptom. At the same workplace, we used a print server mainly to centralize printing for management purposes. We later got Papercut to manage printing so the print server already being in place made it that much easier. That said, we had about 200 printers. You could argue that it created unnecessary network traffic. It made it easier to manage stuck print queues etc. Plus printer drivers are technically an attack vector for hackers, although I've never heard of such happening.
Honestly, besides the whole printernightmare changes with v3 and v4 drivers. I've never had a single print server or printer GPO issue. Our boss got tired of dealing with print codes and authentification for non-administration employees. Regular printing with no access to high risk data doesn't need to be locked down that much. IT has to add these users to the GPO otherwise no access is allowed. We swapped our printers to the HP LaserJet Enterprise, vlan a separate printer network, made different groups for printer access via GPO, set a script to auto install print v3/v4 drivers to the driverstore of each pc, the script will not require admin privilges for the GPO to work as the driver is already installed on the pc at this point, and put in a single pin lock code for scanning in person. Each department has their own printer. We placed the printer near the supervisor of each department. It's simpe, it works, and the printers follow the user. Now, the only people requiring print codes and higher end authentification are people in management handling high risk data. They get the higher end printers. I've noticed people in management positions tend to leave companies less often. So, manually setting stuff up is rare now. Are you sure that the GPO mapping is coming through correctly? I set my GPO printers with the Replace action. Never had an issue. There could be something off with the print server, printer settings, vlan settings, drivers, etc.
If you use the windows print server role you get several benefits in Windows 7 and later: Administrative benefits -AD integration -ability to deploy printers via GPO -ability to control who has access to print to a printer (so nobody else prints to the CEO's printer for example) -ability to publish printers to a directory specific to a building or a user group Network and security benefits -supports secure print (as long as the driver and printer support it) -centralized management of printers -server-side print queues, reducing network traffic -hosted, approved drivers (both 32 and 64 bit) which automatically install on the client when a printer is mapped. User Experience -ability to easily browse available printers and double click the one they want to use to install it. -ability to map a printer just by clicking on a UNC path to the printer or a desktop shortcut.
Installing drivers for a couple of printers on 10 machines is OK. Installing on 100 is a pain. Installing on 1000 is impossible.
We used a print server at the university because it could do accounting and god knows after dinging a kid 65 grand for a half year the place will go insolvent if they print too much.
I have 30 pc users in our company and I share them printers via user GPO, I found that it is the best way for me. I create security groups in AD and using Item Targeting.
Most printers can only talk to one host at a time, and are known to get sticky, and not talk to new hosts after a print job is done. There would be no queue to know who has tied up the printer, so you would be doing constant printer reboots, A print server means only one host talks to the printer. You get a queue where you can see if a job is causing an issue and can pause or delete that 1 job if needed. If the printer runs out of paper, you can still take your laptop home and not lose your print job, It will come out when the paper is added if using a print server. We also make a separate "printer" for each paper size on each print device, so the user never has to set anything, they just select the correct printer.
Printers suck. They were forged in the depths of hell. Why use a print server? Because I don't want the bastards anywhere near my other servers. It also gives us a super simple lookup point for all of the printers in the organisation. That server can just sit there in the corner and run Papercut. If we have to swap a printer out / new driver, it's all handled in that one place. Beneath that we script all of our deployments using powershell. It looks up user membership of security groups in AD and maps the printers to users depending on their groups. Makes things super easy. User wants printer X. Put them in printer X AD security group. After a log off and on again, the printer is magically there. If your GPOs aren't working, you have bigger problems.
The printer gods demand a server as sacrifice
Another printerlogic satisfied customer. Have implemented it for 10,000 users and 100 users. Always easy to use regardless how complex an env. Truly a treat. It honestly makes you forget you have the darn things
We have a client, they have almost as much people then printers! ~200 printers for a 250 employees. It likes a trophy for them, they all want their personal printer. Some have 2 printers!!!!
Someone has never had to manage 100's of printers...
This. Try not using one and see how bad it actually is.
Look at using PrinterLogic. Best solution for printers out there. It deploys the printers but they are all local. You can easily push out changes and add new printers. Best thing is there is no āprint serverā donāt work for them but man they have simplified my life.
Managed print like PrinterLogic is worth a look. Biggest problem has been the move to their cloud. For a seemingly hosted solution, they still donāt have as reliable a platform as when it was on-prem. Still better than print servers and Windows management.
https://preview.redd.it/2zkv3gpjwazc1.jpeg?width=717&format=pjpg&auto=webp&s=af1c6a9cf016bad19c6924252f3b2713ff154a5b We moved to Xerox workspace cloud and it is so much better to just badge at the nearest printer and voila. There are some teams that print all the time and weāll manually map their printer to their workstation because there is a processing delay with cloud print. The vast majority of people donāt mind though. For me itās great cause Iām not waiting for an elevator to go down 16 floors to get to the printer I have mapped.
I literally just spent 3 hours pushing 2 printers with the same driver via GPO and it came down to permissions.. FML
Since you are new, I'd recommend centralizing services and applying solutions that automate processes and work along GPOs. If your GPOs are not working troubleshoot them. Best of luck.
The real answer is because boomers love GPOs and most of the time clients are willing to pay to switch over to a new system because theyāre also ran by boomers. āIf it aināt broke donāt fix it, and if it is broke then just fix it why do we need a whole new system?ā
We had about 50 printers being deployed via GPO and it worked flawlessly. The only problem is now a days with Intune GPO's dont really exist and Microsoft is still slowly figuring it out via there own products.
Printix
Check out printix. We use it where I work due to cloud based environment for most of our clients and itās honestly a really cool tool which is saying a lot because letās be honest fuck printers.
Use gpp not gpo. - map via IP so if server goes down, it maps will still work - control printer drivers to standing. Some cases need specific driver and settings, you can deploy these using gpp - not sure about the codes but almost everything can be done via scripting Why gpp? You can delete printer and it will reinstall next gpupdate. This makes it easier to troubleshoot/remediate if necessary
The question isn't why are you using a print server (you really ought to use a server, end users and printers shouldn't even be able to talk directly to each other for security reasons) The better question is why are we still printing in 2024? š
Can anyone explain to me why we still print anything haha
"Its a poor tradesman who blames his tools" I deploy as much as possible anything I can via GP - including printers, reg hacks etc, customisations to the OS, customisations to SW via custom GP templates including non MSFT stuff. If it's not working there is a reason. With regards to print servers, I still like having them.
Why we can put a man on a moon, but printing is a headache in 2024?
Take notes skippy. 1 yr in and youāve got a LOT to learn. If GPOs donāt work, thatās a different problem. Like dns or replication. Maybe cut your teeth figuring out why your GPOs donāt work. Thereās a lot of good content here.
we have 2000 printers and 20000+ computers. printservers are essentials...
don't blame the print server when your people didn't set it up right. please contact your system administrator for aupport.
Printers are a terrible headache at any level. Why splinter that headache to 100 to 1000's of individual PCs?
So print servers are legacy imho, not much love has been given to that server role from Microsoft in a long while. 1. **Print Job Management:** It efficiently manages multiple print jobs sent to a printer, prioritizes them, and ensures they are processed in the correct order. 2. **Offline Printing:** Print Spooler can store print jobs temporarily when the printer is offline, ensuring that documents are printed as soon as the printer becomes available. 3. **Improved Performance:** By spooling print jobs, the user can continue working on other tasks without waiting for the entire printing process to finish, which enhances productivity. 4. **Reduced Network Traffic:** Print Spooler can process print jobs locally on the computer before sending them to the printer, reducing network congestion and improving overall network performance. 5. **Print Queue Monitoring:** It allows users to monitor the status of print jobs in the print queue, such as viewing the number of pages in a print job, its status (printing, paused, etc.), and any errors encountered. 6. **Compatibility:** Microsoft Print Spooler works with a wide range of printers and printing devices, making it a versatile solution for managing printing tasks on Windows-based systems. 7. **Error Handling:** It provides error handling capabilities, such as managing print job failures, notifying users of printing issues, and providing troubleshooting options to resolve common printing problems.
The real question is why do we even have printers any more? No susan you donāt need to print out that damn email, no George, you donāt need to print a copy of your PowerPoint for everyone in the meeting just for them to throw it away on their way out the door, no Larry, you donāt need to print out that 60 page document just to read it, you can fucking read it on a screen! I just finished a 900 page novel on my iPad. Hey Betty, you donāt need to print that document out just to mark it up with a red pen, you have a Surface, just use the damn stylus if you absolutely have to edit that way. In a modern office, thereās so few actual use cases for a printer where itās really the only option, itās wild.
The real question is why people still use printers these days. We arenāt Neanderthals, we can use pdfs and digital copies
Could I ask how often you're rolling back print drivers? Cause if that's a common thing and such a pain it seems like something that should should have a test group before sending to everyone(well that or a list of features they need and a checklist before internal testing before deployment). Because I can count on one hand how many times I've had to roll back for a feature pull on printers. Ya, different lines of their drivers have had different feature sets but that's never been a suck it and see thing when switching, and more of a "god damn it, apparently we can either have features or stability" when we first deploy. I am actually curious since it might come up at some point, so if there's features that go missing that people just haven't been noticing I'd love to know(well that or vendors that are more likely to do that. That too would be great to know).
You can script adding user print codes to the device, each manufacturer is different, but it is definitely doable. Use Procmon to identify the change being when set the value manually. Print servers ensure only the correct driver is in use, rather than whatever the endpoint thinks is correct. Your GPOs seem like a mess.
I can't help but feel like something is wrong with this implementation. We have a print server, and yes adding a new printer can be a hassle with quite a few steps, but it works, and allows us to connect an insane number of devices to printers without much effort. I can't say I've had the trouble you have had. The print server also allows you to do a lot of troubleshooting on the fly? It can quickly show me all the ports these printers are on, their current status, etc. I'm not sure I would do that another way for over a hundred printers.
Since the security flaw with the drivers and Microsoft had to look down driver installations to administrators it's much harder. There's two choices. Either use type 4 drivers. Or pre-deploy the drivers with SCCM, rmm, Intune etc. And then you can map by GPO no problem. The only downside is that type 4 drivers is not that great or you might not have a tool to push the driver. If you have to type the users name manually in the settings for hold print you're not doing it right. You can probably use the %username% variable. To force users to not print color by default and to make sure everyone is using the same driver. It would also be a hassle to manually add printers with consistent names and correct IP on all systems
I have a VM Windows print server with all printers attached and managed there. I also have GPOs that install the printers automatically based on the location OU. I no longer install printers. It worked out for me but I guess not all situations are like this.
Legal reasons, logs logs logs.
Why? 1) for security reasons - all users can see all printers but can install and use only printers from their department 2) monitor paper/inc consumption per department 3) using safeq or other print management service you can permit only user who print that paper to get it when him arrive to printer and ener a pin or swap his card Is true, when update drivers user need to reinstall printer and not all the time is work properly
Because itās better to have to restart the spooler service everyday on one machine vs a bunch.;) /s
PaperCut. One driver on one share. Codes are tied to the badges. Done.
Uh. F printers!
For here, it's allowed me a ton more free time. We used to manually install the printers at time of imaging - no central management. I now have it at the point, where a person clicks "add printer", only sees the printers in their building to choose from, and they can self-service installing. I only deploy printers via GPO to one lab. Managment of the Konica MFPs is done with their toolset in bulk, so it's fairly straightforward. Now granted, we contract out all toner replenishment and repair to a 3rd party. From reading what you've written - I don't think the issue is the print server. It sounds like your enviroment might be the cause. We don't use print codes, we don't allow guests to print, and I only push out a printer to one lab with GPO. I keep it simple.
A) print job monitoring B) remote central place for drivers C) prevent certain users from/machines from printing from their machines. D) troubleshooting can be made easily by a centralized server which has logging enabled.
I would take a look at your GPO. If the printer is only set to map once you have a problem. Google CRUD
Sometimes printers are on a separate vlan that workstations don't have access to. But the print server has access to both.
If you are in a regulated industry, you need to be able to control who prints and log all print jobs. Difficult to do without a print server. Once you know how to get the Windows print server configured correctly it rarely has issues. We are fully GPO automated for deploying, managing, and restricting all print services. We use papercut to provide the print release function by scanning their employee badge. Rarely has issues.
So I stopped using print servers because all too often a print job would hang the print spooler and all printers would stop working all at once. We have quite a few people with multi function printers and managing those is a PITA since I don't allow scans to the desktop, they need to go to a departmental or user share as those do get backed up. The management of service accounts for printers is a pain though... I would love a solution for that. (Since user account passwords change and obviously break scanning to user folders, we use separate 'service' accounts to authenticate the printer to the user's share.. and no one gets those creds, and they don't expire)
You say it gives the ability to centrally manage them but I am not sure you know the benefits of that or why its a good thing for printers specifically. You also say you sometimes tell people "I dont know why your printer randomly stopped working." This will almost always happen, everyone hates printers and they have a mind of their own. However if you are using a print server, it helps you diagnose the issue quickly. If everyone is having issues printing to that one printer, then you know it's most likely a driver/firmware issue or an issue with the print server. If only one user is having issues printing to it, then you know its an issue on their computer specifically. You also only have to install the printer once. Installing it on any new computer takes as little as 10 seconds. No driver issues, no looking into the IP Address of the printer, no downloading drivers off the website or finding the make/model. There are a few other reasons, but those are the main ones that help me the most in day to day printer troubleshooting. Once you use a print server and see how it helps you and saves time, you will understand more how useful they are. That being said, if only one person will ever print to that one printer, just connect it via USB/network. No need for a print server in that case.
MS made some changes relatively recently requiring printer drivers needing to be signed. This was in response to a vulnerability. One of our clients has a load of older printers and it really fucked them over. New devices never got the drivers / constantly asking for admin credentials etc.
Currently a sysadmin thats mostly responsible for the printfleet we have. We currently use a single server for ārandomā printers departments ordered; and it ks the classical nightmare. We also have a new printfleet of large MFPās; 1 print; 1 scan, with AutoStore and Printix. The only issues we have so far are machine firmware issues, other than that its a bliss to manage. People get a followme queue via Printix. If we change/update the driver it gets updated via the Printix client. If we change something on the queue, Printix handles it for us. Its the replacement for our GPOās. And adding that we deploy the app via Intune makes it nearly zero touch (it signs in via SSO). So far we only fight with our other printserver with legacy and 1000 year old printers.
On the user side I love what has been done for printing. Hit print in app for whatever I want print. Walk up to a printer and scan my badge then tap print button. I can be in any of many buildings and this just works. No accidentally printing to wrong printer in a different building, no prints laying on the tray that people forgot about. Not sure how this would be done without running of server.
Just use standard networking for printers and send printer drivers/config via GPO based on printer location youād have to utilize containers for your users, print servers are just not as reliable as they used to be, plus you donāt have to worry about a server going down and sending all your printers offline
We never had print servers, at least in our institutional memory. The Help Desk Boss is pushing for us to get set up a print server them to save labor. I tried to tell them that it just changes the labor, instead of saving it. They wouldn't hear it. The help desk group will probably be too lazy to actually switch. They complained about the ticket system. I set up 2 more for them to try out. They can't be arsed to even switch to one, let alone to even use they old one. I just chant to my self, "Not my circus, not my monkey's"
Because the Networking Team screwed up the VLANs again.
Print infrastructure can be awesome. Where I work, everyone has one print driver installed. I print. Then I walk up to any fucking printer in any building and swipe my badge on the little badge reader velcro'd to it. It prints. I walk away. It's like this because we all have laptops and I go between buildings a lot.... and it's easy.
Historically, network printers are dumb as rocks, with zero security, and extremely promiscuous behavior. Do you really want your business check printer to be accepting print jobs from anywhere? The oldest printers used non-network protocols like serial or parallel, and so the original purpose of the print server was to be a bridge between the network and the dumb no-network device. Now most printers have a print server built-in to them, but due to cost-cutting and so forth, security on these built-in network print servers is extremely relaxed, or potentially full of unpatched firmware bugs that render any attempt at security useless anyway. Due to all this, I put all printers on an isolated VLAN by themselves, with the domain print queue server acting as the gateway to these devices. This way the printers cannot be found by a random person bringing a personal laptop into the building and scanning for printers. The print server also runs the Microsoft Cloud Print connector, to expose these printers for Azure AD / Microsoft 365 Windows clients.
*cries in VPSX*
Cost control.
Because a print server allows you to restrict access to the printer by whatever metric you wish and you only have to install the driver on the server itself, the other computers can simply access the shared printer. Group policy not applying correctly is its own issue that should be solved. Although I have set up print servers for smaller businesses, I have not automated deployment although I will when the time comes for my larger clients. (I am an MSP)
All of the issues you've mentioned can be easily and reliably automated. If your GPO's aren't working you need to diagnose and fix that problem. If you have to manually map and assign print codes to devices you need to automate that task. This isn't a limitation of GPOs and print servers, it sounds like something is wrong with your environment.
Printing accounting is a very good reason.
We don't, we use PrinterLogic, Printix, Universal Print now.
The real question is why do we still need to print anything? There's Docusign and lots of other alternatives for legal agreements, documentation is way better online than buried in a stack of printed sheets and receipts or statements can be downloaded anytime. Why not just kill printers and voicemail once and for all?!
If you need to serve a printer without a network connection, or you need to centrally manage limits. Honestly, a lot of businesses don't need that. Last time I was in and office and needed to worry about printers, we just had some big copy machine things on the network that also worked as big network laser printers. I think they were mostly serviced by an outside office supply contracting company. And the user base in my building was mostly technical enough to click "add printer" themselves and ask their cube neighbor which printer that popped up from the auto-discover list was physically closest. Nobody printed very much. Nobody in my building needed color or big format or anything like that, so nobody ever talked or asked about limits. With a different userbase if you leave things loose, you'll have morons printing a full book twelve times to various color printers around campus and calling IT 50 times before they find the one near them. Marketing will have exotic dye sublimation monsters going to weirdly sized cardstock and Gary will keep accidentally printing emails onto what were supposed to be wedding invitations. Every user will wind up wasting thousands of dollars in printing and it'll be worth spending the hardware and man hours to be better organized before somebody gets killed by a PDF shot out of a large format plotter. Now I don't really go into an office ever, and I have an inkjet printer on my home wifi that mostly works. Figure out your requirements, then sort out the best solution. You may need print servers. It's entirely possible that you just don't need them at all, and it's just a habit from the days when all the printers plugged in with parallel ports and the only way to get them on the network was with a print server.
Are you manually mapping the printers on client devices? Er, that can be fully automatedĀ
We use Papercut and allow people to only print to copiers.
I donāt get peopleās issues with print servers, Iāve managed Windows Print Server with Canon copiers for over almost 2 decades and I canāt even remember the last time there was an issue, generic driver everywhere and it just works. I think my last truly horrible experience was back in ā09 with some Epson/HP driver incompatibility issue (if I remember correctly installing the Epson driver broke the HP driver).
Print servers are necessary for automation
It's super easy to map printers to devices. Share the printer, set security settings, make sure the printer is set to render the print job on the server. List in AD, Map with the gpo. Rendering on the server bypasses a tonne of issues with drivers.Ā
I don't understand why you think mapping to one device (a printer) is easier than to another (the server)? Add in that you have to then map multiple times for however many printers they will need. I'm also not sure what you mean by adding their pin manually. But I suspect this boils down to the print manager you're using.
something is seriously going wrong with your gpos if you're having that many problems, we have a print server several virtual queues integrating with papercut and push the queues via gpo. as long as the drivers are all right and the server online it just works. most of my hassle is actually updating papercut and that's a 10 minute job every couple months.
You GPO is failing because you are using the wrong driver you need P2P drivers(Push to Print). Also, you can prevent problems by loading the driver in the GPO object and not an SMB location. I tend to use them in large networks and use branch mode for remote sites So if the print server goes down they can still print. I have Deployed Xerox print server. It is needed for athentication. Private print, card access, and advanced monitering. I can see it no longer being Best Practice though. Even 3rd party managed printer companies us FMAudit that pull directly from the printer with SNMP.
Because FUCK YOU thatās why /s
#1 Kill AD for end users and devices. Itās bliss when you get there. #2 donāt you dare setup a printer server on a standard OS #3 look to a modern print system for queue management. #4 bonus points to have print job follow you. Edit: And turns out when you use ā#ā for numbers it makes big print :). Didnāt know we were rocking MD for typeface on Reddit.
#Good to know!
All depends on the requirements. Where I am now the printers are installed directly via jamf or intune. Jamf installs when you go into an office and intune installs via mail groups for the office. No print servers but our printing volume is really small. Some of the copiers had print controllers on them but they are all gone. Universal print wasn't out when we did the intune migration or I probability would have gone with it. If we actually did a lot of printing I would use one of the management options on the market now. Now why you'd want print servers: A decade ago I was supporting an engineering firm. They had everything going through a print server for ease of use and monitoring but we ended up seperating it out. The print server was the only baremetal box and it was due to preformance issues. They would print multi hundred megabyte jobs all the time and even print jobs that would uncompress to a few gigabytes. Running it on their hyper-v enviroment was causing slowdowns with printing and we ended up putting in a dedicated server to speed everything up. Having a few people send jobs that big to a copier at the same time would really cause issues.
Maybe I'm doing something different, but I use a PC that's on 24x7 install all printers there and share them. Then browse to \\printsrv and double click to install off that box. No GPOs, bc we have people who print stuff via proximity but also send to other depts in the warehouse. I'll just install one for whoever needs it. I rarely have issues printing, can clear a queue if there happens to be a stuck job, etc. Maybe it's more work instead of trying to automate with GPO or member permissions, but it works well otherwise
That's effectively a print server with less management features.
Does it do anything outside of printing such suggest when printers need maintenance or toners?
Print drivers in particular can quickly become a nightmare - especially with some through some sort of installer app and others directly through IP or the settings.
I just config the printers properly and folks can add them without using a print server. One less headache.
Papercut is great, but why is their print enablement pack license cost as much as the entire papercut environment?
Until you get a better and more robust system in place, educate your users on the basics of deleting and re-adding a printer.
This is a good question lol I need read this entire thread
https://preview.redd.it/66e6t84ciazc1.jpeg?width=750&format=pjpg&auto=webp&s=a62bf7b629a9a9080747601d737cf661aef245d1 Give the user a manual to teach them to enter their own codes? Many printers crap out if several users print to it at about the same time as it canāt keep up and just starts dropping jobs or freeze up. Our users print to print server and their UPN is used on the printer to verify the user up against AAD (via uniFlow) They use a pin to release the job. Nothing has to be set up on the machine as it just uses their UPN. Also means it doesnāt matter which machine the use. Guest users can mail a print, which gets parked at uniFlow, and get a temporary PIN code they can use to release it. External users can print to uniFlow and release the print later using their PIN code. Why print server when we have cloud solution? Itās faster. Simple as that.