Urgent GPO help needed

[Yarpen]

Hi Everyone and thanks for reading.

 

I have a little situation which wrecks my weekend but I just don't seem to be able to find out what the problem is.

I want to create a GPO that adds printers on computers in four rooms - simple enough in theory ;-)

 

Done so far:

 

- created a batch script that adds printers, tested and working fine.

- created 4 separate OUs and then 4 linked GPOs

- everything has to be applied per computer, so I moved computers to the OU (no users in there as they change rooms)

- added the script under computer configuration, policies window settings

 

I restart the PC - nothing happens, I run gpresult /r and it doesnt even look like my policy is applied.

 

Since then I have tried adding a group with computers in the OU under "security filtering"

 

What am I missing? Why is the GPO not applied to the computers if it is linked to the OU with selected computers?

Any ideas would be much appreciated - going crazy in here trying to get this resolved.

[kmount]

Hello,

 

I expect you're facing pain because it's a script running on computer start up not user logon.

 

If you want to use a batch file, I suggest you enable GPO loopback 'merge' in your GPO for that OU so it will merge the user setting (logon script to run your batch file) with everything else that will be applied as part of the users own GPOs.

 

Pretty good post to help - http://www.edugeek.net/forums/windows/17877-default-printer-batch-file.html#post484521

 

I expect everything you've done so far is absolutely fine, just moving the script from Computer to User and making sure loopback is on merge (don't use replace in this situation) will probably save your weekend

[Yarpen]

Thanks for your reply kmount - if I add the script under user configuration instead of computer will it work even though the OU has only computers in it? I have the policy security filtering selected for usergroups but OU has no user accounts in it.

What worries me is that the GPO doesn't show under gpresult /r - I know I can run gpupdate /force but that requires me to go to each computer and there are 100 of them - if I have to do it this way I may as well just log in and run script manually...

[ZeroHour]

Thanks for your reply kmount - if I add the script under user configuration instead of computer will it work even though the OU has only computers in it? I have the policy security filtering selected for usergroups but OU has no user accounts in it.

What worries me is that the GPO doesn't show under gpresult /r - I know I can run gpupdate /force but that requires me to go to each computer and there are 100 of them - if I have to do it this way I may as well just log in and run script manually...

 

No if PC is the only thing in the OU it wont unless you enable group policy loopback processing.

If you are trying to add printers you can use a vbs in the users OU which would check the machine name to apply the relevant printer. Thats I used to do it.

It depends if you use a proper machine naming policy, we were {DEP}-{ROOM}-{ASSET TAG}

Edited September 29, 2012 by ZeroHour

[kmount]

Yeah, that's why I said you need to enable the loopback processing to merge so it will run the user side of the gpo even though it's a computer ou.

[Yarpen]

Hi ZeroHour

 

They do not have a proper naming convention - all PC names start with room number but rest is random. This gave me enough information to split them between 4 OU's but will be too random to set up a script based on the names.

I have enabled the loopback processing on the policy and even run gpupdate /force but still not getting any printers assigned. I am however getting the printer policy listed under gpresult /r since I run the /force command.

[kmount]

Modify your script to create a folder on your C drive or something to be sure the script is running.

 

Also, check your event log incase a software restriction policy is stopping the script running.

[detjo]

They do not have a proper naming convention - all PC names start with room number but rest is random.

That's all you need, isnt it? Why not use the room number part to add the printer

[ADMaster]

May I suggest you consider group policy preferences with item level targeting? I have a policy called gp prefs computer linked at the top level of my domain with all the printers. I use item level targeting to specify which printer goes to what room based on OU.

 

Item level targeting will let you do a lot more then OU though, individual computer, security group, ip range etc etc. Here is a post about it on windows networking.

 

Group Policy Preferences: Top 5 Item-Level Targeting Options

[Yarpen]

May I suggest you consider group policy preferences with item level targeting? I have a policy called gp prefs computer linked at the top level of my domain with all the printers. I use item level targeting to specify which printer goes to what room based on OU.

 

Item level targeting will let you do a lot more then OU though, individual computer, security group, ip range etc etc. Here is a post about it on windows networking.

 

Group Policy Preferences: Top 5 Item-Level Targeting Options

 

Good thinking, completely forgot about ILT - will try adding all of the printers on the default policy and just use ITL to each OU containing computers. I just hope it will automatically work for each user that uses the target computer.

Fingers crossed ;-)

[Yarpen]

Hmmm, something is still wrong and not quite sure what:

- group policy is added fine on the pc as per gpresult /r but no printers are added (added through GPP and item taregetting at the OU)

- tested and printers work fine, I can add them manually with same settings as set in group policy properties

[ADMaster]

On the print server where they are shared, go to the advanced tab and set the print processes to winprint raw.

 

Look at the event log and see if you get any errors, if the event log says that the print processor is not supported, this setting will fix it.

 

Also you have not mentioned what your server and client OS's are, if XP you will need the client side extensions installed.

 

http://www.microsoft.com/en-us/download/details.aspx?id=3628

[featured_spectre]

This may sound stupid but what OS are you trying to get them to apply to? I understand you're on S2K8R2, but no mention of 2000, ME, XP, Vista, or 7.

 

I have known there to be a fault with GPO's not picking up printers on Vista SP1 and previous. Vista SP2 onwards is usually fine. It may help narrow down the issue considerably.

[ZeroHour]

Check printers are ran in the users context (check box in gpp printer area somewhere) and users can install drivers which is a gp setting.

[Yarpen]

Big thanks to everyone who contributed. It took me a full day to get everything up and running but in the end I moved printers to 2008R2 server and deployed through print management. Worked on 90% of computers (remaining 10% being XP)

[penfold]

XP needs pushprinterconnections.exe running as a login script in order to install the printers, have you included that?

[Yarpen]

XP needs pushprinterconnections.exe running as a login script in order to install the printers, have you included that?

 

Thanks for the heads up, I havent tried pushprinterconnections but will keep that in mind if there are any problems with current setup.