Printer deployment issues

[JordanT91]

We've just had some new MFPs installed to replace 15 or so classroom printers. There are 3 of them, and there's two virtual queues, one for mono and one for colour, so that staff can go to any printer and release their prints. I've done this via Print Management (so it's a user policy).

 

We don't want pupils to have to do anything to release their prints, so I've deployed the closest physical MFPs to classroom OUs. Again, this is through Print Management but this time its a computer policy.

 

One issue I'm having are that the physical printers are appearing for staff (as well as the virtual queues), because they're getting the user and computer policies. I have a feeling WMI filters may come into play here but I can't think how.

The other issue is that the colour printer is being set as the default, I need the mono printer to be the default. Because I'm deploying via Print Management on the print server, it uses the policies part of the GPOs and everything I've read says you can't set a default printer when doing it this way. Everything seems to suggest deploying via GP preferences, which is feasible and may not even be possible as they are virtual printers. I don't want to go down that route anyway, I like to manage everything from Print Management.

 

Has anyone got any suggestions?

 

Thanks.

[mikkydoos]

Loopback processing might do it. Install per computer but not if logged in as whatever user group you apply the GPO to.

 

 

Why not just deploy as a user policy? I do that and get the same result as you're after.

 

 

Whats your print management software too ?

Edited November 27, 2017 by mikkydoos

[JordanT91]

Can you explain how loopback processing would work in this situation? I've ready quite a bit about it but I've never been able to fully understand it.

 

The virtual printer queues are deployed as user policy for staff (for secure printing purposes, they can print to it and retrieve their printouts at any printer they like by swiping their fob), but pupils need to be able to print to a specific printer for immediate release.

 

Its Papercut MF.

[mavhc]

Loopback processing means that GPOs with User Settings that are in Computer OUs are applied to users who log into those computers.

[Davit2005]

At the last place we done these as shared under a user preference, with loopback processing enabled and placed the GPO on the OU where the computers were located by physical location. What MFD's are you using by the way.

 

 

Worked like a charm :-).

[JordanT91]

Loopback processing means that GPOs with User Settings that are in Computer OUs are applied to users who log into those computers.

Okay I get that (that's actually a really clear explanation!). What I don't understand is how to use this to do what I want. I still need a way stop staff from getting the physical printers deployed to them. If I deploy a physical printer to users on the Room 10 computer policy with loopback enabled, they will still get the physical printers the same as if I'd deployed the physical printers to the computers. Does that make sense? I need a way for only the pupils to have the physical printers deployed to them.

[Davit2005]

Do it all via Shared printers under the User preferences you can then deny the Staff group the ability to apply the policy.

[mavhc]

You'd need to deploy it to a GPO which only pupil users can access I guess.

 

https://blogs.technet.microsoft.com/askds/2013/05/21/back-to-the-loopback-troubleshooting-group-policy-loopback-processing-part-2/

[Rob_D]

I see 2 options, either make sure the staff policy processes last and put a "Delete all network printers" thing in it (but then all the printers get mapped and some get removed).

Or use WMI filtering or permissions to stop the loopback "student policy" from applying to the staff (you should be able to do this via OU)

[mikkydoos]

To start with.... https://blogs.technet.microsoft.com/askds/2013/02/08/circle-back-to-loopback/

 

 

Loopback works in a way where Computer settings are overwritten by the User settings in the same GPO. In effect you are reversing Computer settings taking precedence over User settings.

 

It should effectively hide the Computer GPO deployed printers when a staff member logs in.

 

I see what you mean... will the printer persist after the first time a student logs on?....... Try it.

 

Is there a persistence setting when you deploy the printer via GPO? If so, set it to No.

 

 

An example of a use of loopback processing that I use is screensavers not applying to whiteboard PC's. Although screensavers/auto screen locking is applied per user site wide, I have a 2nd policy attached to the OU's of computers that I don't want that to apply to that apply the same setting in Computer settings.

Edited November 27, 2017 by mikkydoos

[Katy]

Okay I get that (that's actually a really clear explanation!). What I don't understand is how to use this to do what I want. I still need a way stop staff from getting the physical printers deployed to them. If I deploy a physical printer to users on the Room 10 computer policy with loopback enabled, they will still get the physical printers the same as if I'd deployed the physical printers to the computers. Does that make sense? I need a way for only the pupils to have the physical printers deployed to them.

 

If you are deploying it as a GP Preferences you can go into the second tab, then click on Item Targetting and filter it by security group, e.g. only apply to members of the Students group.

[JordanT91]

I half solved this, thanks to everyone's help. I solved this by:

 

Sorting the computer accounts into security groups by room (they were already in room OUs but not groups).

Created three new groups, one for each new printer

Assigned the room groups to the printer groups based on where I want those rooms to print to

Created three new GPOs to assign the printers, under the PC OU.

Enabled loopback processing on them

Deployed the relevant printer to them in the user configuration

Filtered the GPO for the Pupil security group and the relevant newly created 'computers for xxx printer' group

 

The reason I said its only half done is because I still need to deploy the printers as preferences rather than through Print Management so I can set the mono queue as default. I'll do that today at some point.

 

Thanks for all the help folks. Much appreciated.

[mavhc]

If you're using Preferences you can use Item targetting