How to Deploy Printers to Users or Computers via Group Policy

8.4K

Group Policy Preferences can be used to automate the connection of shared network printers to domain users. This article shows how to deploy printers to users’ computers using GPO in an Active Directory.

Supported environments

The procedures in our guide apply to Windows Server 2022 and Windows Server 2025 Print Servers, as well as Windows 10 and Windows 11 client devices. Although most steps also work on earlier supported Windows Server versions, the recommendations in this article reflect current enterprise deployment practices.

GPO Printer Deployment Architecture (3-Layer Model)

Keep in mind that you shouldn’t think of Printer deployment through GPP as a single action. It is a multi-layer system consisting of 3 components:

1. Print Server Layer

This is where the printer physically exists. This layer is responsible for:

• printer drivers installation
• sharing the printer via UNC path (\server\printer)
• serving driver packages to clients

In case this layer is broken, GPO cannot install anything.

2. AD Layer

This layer controls who is allowed to see and use the printer. The layer includes:

• security groups (access control)
• optional AD publishing of printers
• OU structure for GPO targeting

When this layer is wrong, printer exists but users don’t get it.

3. Client (GPO Processing Layer)

This is where installation actually happens. Client:

• processes Group Policy
• evaluates targeting rules
• connects to print server
• installs driver and printer connection

If this layer fails, printer is never created locally.

How the Layers Interact During User Logon

Now let’s take a look at how the previously described 3-layer model works in practice. When a user logs in:

1. Client (GPO layer) processes policy and performs connection to \\server\printer
2. Client connects to Print Server
3. Print Server provides the driver package
4. Client attempts to install the driver (it’s a subject to security restrictions)
5. Printer is created in the user session

Important. Note that each step above belongs to a specific layer. In case the deployment fails, you need to identify the exact step and map it to the corresponding layer.

Why this matters?

In case the deployment fails, you should look for the problem in one of these layers:

• Print server (driver/share issue)
• AD/GPO targeting problem
• Client-side restriction/policy
• Network connectivity problem

Important. Throughout this tutorial, we will be referring back to this 3-layer model. Note that each config step corresponds to one of these layers. In case something doesn’t work, you should always map the problem to the layer where it occurs (and not randomly troubleshooting).

Limitation. Note that automatic driver installation depends on driver type (Type 4 or package-aware Type 3), Point and Print restrictions policy, whether driver is already present in driver store, and user privilege restrictions (post-PrintNightmare).

Microsoft Universal Print as an Alternative to GPO Printer Deployment

While Group Policy remains the standard method for deploying shared printers in on-premises and hybrid AD environments, many admins are adopting Microsoft Universal Print in cloud-managed environments.

Universal Print is a Microsoft 365 cloud printing service that eliminates the need for traditional Windows print servers and printer deployment through Group Policy.

You should prefer Universal Print when:

• devices are Microsoft Entra ID joined;
• Microsoft Intune is used for device management;
• users work remotely or in hybrid work cases;
• you want to reduce print server infrastructure.

However, Group Policy printer deployment remains the most common solution in traditional AD and hybrid environments.

Sharing a Printer Over the Network

Step 1. Configure the Print Server layer

In this section we will cover the Print Server layer from the architecture model. At this stage, you are preparing drivers and shared printers. Note that in case this layer is misconfigured, GPO deployment will fail regardless of AD/client settings.

To configure automatic installation of printer drivers on clients, you must first deploy the print server on a Windows computer. Although printer sharing can be hosted on Windows client OSs, in case you are working with enterprise environments, you should use dedicated Windows Print Servers/Universal Print infrastructure.

Open the Print Management console (printmanagement.msc) on the computer where the printer is attached (this guide can be used to share either a network printer available via TCP/IP or a local physical printer connected to the host via USB).

Installing and Configuring Printer Drivers

At this stage, you need to configure the driver subsystem of the Print Server layer. Any problems at this stage will lead to driver installation failures on clients.

Let’s start by installing the printer drivers:

1. Right-click Drivers and select Add Driver. Select the type of your Windows environment (x64, x86, or both) and click Next;

   

2. If the driver you need is not listed, click Have Disk and Browse. Specify the path to the printer driver INF file and click OK. It is recommended to use only digitally signed drivers.
   

   

3. Install the drivers for each printer you want to share.
4. The Print Management Console will now display the list of installed print drivers.

Printer Driver Types and Security Requirements

Windows OS supports 2 main printer driver models:

1. Type 3 drivers (legacy)

• Traditional driver model
• Runs in system context
• Requires admin rights for installation in modern Windows OSs
• It is often blocked/restricted after PrintNightmare security updates

2. Type 4 drivers (modern)

• This was introduced in Windows 8/Server 2012+
• It is safer and more isolated
• Has limited features compared to Type 3
• It is a preferred one for enterprise deployment

Package-aware drivers requirement

In case you are working with GPO printer deployment without admin prompts:

• Driver must be Package-aware
• Driver must be digitally signed
• Driver must support Point and Print restrictions

In case the driver is not package-aware:

• You may face error 0x80070bcb during installation
• Users may be prompted for admin credentials
• GPO deployment may silently fail

Security impact after PrintNightmare changes

After PrintNightmare patches, now non-admin driver installation is restricted. Also, clients can only install trusted package-aware drivers. Keep in mind that drivers must often be pre-staged using:

pnputil /add-driver

Add new printers to your print server

Select Printers > Add Printers. You can add a printer in one of the following ways:

• Search the network for printers;
• Add an IPP, TCP/IP, or Web Services Printer by IP address or hostname;
• Add a new printer using an existing port;
• Create a new port and add a new printer.

In this example, we’ll connect to the network printer by IP address.

Select TCP/IP device and provide the IP address (or the DNS name) of your network printer (leave the default port name). Check the box Auto detect the printer driver to use.

Then select the printer driver you have previously installed.

Specify the printer’s name.

In the same way, install any additional printers.

Step 2. Configure the Active Directory layer

At this stage, you define who can access the printer. This includes:

• security groups
• printer visibility (optional AD publishing)
• GPO targeting scope

In case you will misconfigure this layer, users will not receive the printer even if it is properly shared.

So, expand Print Servers > ServerName (local) > Printers, right-click the printer you want to share and select Manage Sharing.

Specify the share name of the printer. We recommend you to set a short, meaningful shared printer name (do not use spaces or special characters, this can cause problems with UNC path parsing in GPO preferences). In our example, we’ve chosen to name it Brother_2750_Recep.

Check the options Share this printer and List in the directory, and then click Apply.

Step 3. Configure the Client (GPO processing layer)

At this stage, the Client layer processes GPO and creates the printer connection (as described in the architecture model above). In case this layer will fail, the printer won’t appear on the client device.

Configure GPO for Printer Deployment

Creating Security Groups for Printer Access

Create a domain security group and add the users to it to whom you want to make a shared printer available. For example, CA_ Brother_2750_Recep_Users.

Creating and Linking a New GPO

Open the Group Policy Management Console (gpmc.msc) and locate the Organizational Unit (OU) to which you want to deploy the shared printer. This OU can contain computer or user objects, depending on which objects you want to make the printer available;

1. Right-click on the OU and select Create a GPO in this domain and Link it here.

   

2. Specify the GPO name. For example, DeployPrinterCAUsers;
3. Right-click GPO and select Edit.
   

   

Configuring Printer Deployment Settings

Printer deployment settings can be found in:

• Computer Configuration > Preferences > Control Panel Settings > Printers;
• User Configuration > Preferences > Control Panel Settings > Printers.

If you deploy a printer from the Computer Configuration section, it will be installed for all users who log on to a computer. The user’s GPO only allows printers to be added to the logged-in user’s profile.

1. Select New > Shared Printer. Specify the shared printer name in UNC format (like, \\WKS-IT012\Brother_2750_Recep), or select from a list of printers published in Active Directory. WKS-IT012 it is the host name of your print server with shared printer.
   

   

2. Use the Update mode to install printer. This will create a printer if it has not already been created, and will replace any printer settings that have changed since the last GPO update.
3. You can immediately assign this printer as the user’s primary print device by enabling the Set this printer as the default printer option.
4. Go to the Common tab and enable the option “Run in logged-on user’s security context (user policy option)”;
5. Then check the option “Item-level Targeting” and click on the Targeting button;
   

   

6. Select New Item > Security Group, and specify your target security group name;

   

7. Save the changes.
8. To automatically remove a printer when a user leaves the security group, select the ‘Remove this item when it no longer applies’ option.
   

   

Deploying printers with PowerShell

You can also deploy printers via PowerShell without GPO for quick testing or scripted deployment. To add printer connection for the current user use the command:

Add-Printer -ConnectionName "\\PrintServer\Brother_2750_Recep"

If you want to set as default printer, use the following command:

(New-Object -ComObject WScript.Network).SetDefaultPrinter("\\PrintServer\Brother_2750_Recep")

Verifying Printer Deployment with PowerShell

After connecting a printer, we recommend you to check if it was installed successfully and is using the expected driver and config.

To list all installed printers, run the command:

Get-Printer

To view installed printer drivers, use the following command:

Get-PrinterDriver

To display the config of a specific printer:

Get-PrintConfiguration -PrinterName "Brother_2750"

In order to retrieve detailed information about a printer, use the command:

Get-Printer -Name "Brother_2750" | Format-List *

The commands above can help you confirm that the printer has been deployed successfully, is using the correct driver, and has received the expected config from the print server. The commands are also useful when troubleshooting printer deployment printers in enterprise environments.

Deploying Printers with Microsoft Intune

In cloud-managed environments, you can deploy printers using Microsoft Intune together with Microsoft Universal Print (instead of traditional Group Policy Preferences).

Universal Print integrates with Microsoft Entra ID and allows you to assign printers directly to users and devices without maintaining on-premises print servers.

Here are common deployment scenarios:

• assigning printers to Microsoft Entra security groups;
• automatic printer provisioning through Intune;
• remote and hybrid work environments;
• Microsoft Entra joined devices without AD connectivity.

Note that Universal Print is often the preferred deployment model in case you want to adopt a cloud-first management strategy.

GPO vs Intune Printer Deployment

Feature	GPO Deployment	Intune + Universal Print
Requires Active Directory	Yes	No
Requires Print Server	Usually Yes	No
Supports Entra-only devices	No	Yes
Remote Internet Users	Limited	Excellent
Best for	Traditional AD environments	Cloud-managed environments

If your organization is planning to migrate from traditional Group Policy to Microsoft Intune, you should consider using Group Policy Analytics. It analyzes existing GPOs and identifies which settings can be migrated to Intune and which require alternative management methods.

Testing and Verifying Printer Deployment

After configuration, you should verify each layer separately:

1. Print Server layer

• Check if the printer is shared and accessible through UNC
• Verify that drivers are installed on the server

2. AD layer

• Check that the user is in the correct security group
• Ensure that GPO is linked to the correct Organizational Unit

3. Client layer

• Check that GPO is applied with gpresult command:
  

  gpresult /r /scope user
  gpresult /h C:\gpreport.html

• Verify that the printer connection appears
• Ensure that the driver installation is successful

Updating GPO on Client Computers

Update the GPO settings on the client computer and check if the printer is installed automatically when the user logs on (Settings > Bluetooth and Devices > Printers and Scanners). This user must be a member of the security group you specified in the GPO.

You can deploy tens and hundreds of printers with a single GPO.

Troubleshooting Printer Deployment via GPO

Common Errors (e.g., 0x80070bcb)

Other types of drivers will not be installed automatically and the GPP Event Viewer logs will contain an error:

0x80070bcb. The specified printer driver was not found on the system and needs to be downloaded.

Pre-Installing Drivers with pnputil

You can pre-install the required print drivers on the user’s computers using the command:

pnputil /add-driver "\\Path to print drivers\*.inf" /subdirs

Or you can use a workaround described in the post Allow non-administrators to install printer drivers via GPO.

In case the deployment fails after GPO refresh, you should check if:

• Driver is Type 4/package-aware Type 3
• Driver is pre-installed/staged in driver store
• Installation is not being blocked by Point and Print restrictions policy

And keep in mind that most modern GPO printer deployment issues are caused by driver security restrictions (rather than GPO misconfig).

Note. Don’t forget that GPO guarantees printer connection delivery (not driver installation success).

Recommended Printing Architecture

In case you have traditional AD environment, you should prefer Group Policy Preferences when deploying shared printers.

If you are working with cloud-managed environments using Microsoft Entra ID and Intune, you should consider Microsoft Universal Print as an option to provide a simpler alternative that does not require dedicated print servers/printer deployment through Group Policy.

Recommended deployment model

Environment	Recommended Method
Entra ID + Intune	Universal Print
Hybrid AD	GPO + V4 Drivers
Legacy environment	Package-aware Type 3
Temporary workaround	Driver pre-staging

When deploying, you should always choose a strategy that matches your environment. You should verify each layer separately when troubleshooting: print server → AD targeting → client GPO processing. And keep in mind that most modern deployment failures are caused by driver security restrictions, not GPO misconfig.

Enterprise Considerations

Large enterprise environments may also implement:

• Highly available Print Servers using Windows Failover Clustering;
• Driver deployment through Microsoft Intune/PowerShell DSC;
• Kerberos Constrained Delegation for cross-forest printing cases.

These topics are outside the scope of our guide, which focuses on standard Group Policy printer deployment in Active Directory environments.