Shared Printer Setup: Windows Print Server, IP Ports and Group Policy

To share an office printer reliably with Windows PCs, give the printer a fixed IP address, create a TCP/IP port and install the driver on a Windows print server, share the queue, and deploy the connection with Group Policy through Print Management. This guide shows each step in the interface and in PowerShell, then explains the Point and Print driver restriction that causes most "I can't add the printer" calls.

Who this is for

This is for administrators of small Active Directory domains who have one or more network printers and a Windows Server that can host the Print Server role. By the end you will have a shared queue on the server, a connection that appears on the right users' or computers' desktops automatically, and a way to verify and troubleshoot it.

If you do not run Active Directory, the manual steps for the port, driver and share still apply, but you will connect clients by hand with Add-Printer -ConnectionName.

Choosing an approach

The rest of the article covers the third approach, because it includes the other two.

Prerequisites

• A Windows Server joined to the domain. Microsoft's documentation names the Print and Document Services role as Print-Services and its Print Server role service as Print-Server, and says the role is not installed by default. Run Get-WindowsFeature *print* on your server version to confirm the names.
• Membership of the local Administrators group on the print server, and write access to the Group Policy object you will use.
• A fixed IP address or DHCP reservation for each printer, so the port does not break when a lease changes.
• The 64-bit driver package for the printer, preferably the manufacturer's current universal or model-specific driver for your Windows version.
• Windows updates applied consistently. Microsoft's KB5005652 notes that clients should have updates released January 12, 2021 or later before servers receive updates released September 14, 2021 or later, otherwise clients may fail to print.

Step 1: Install the Print Server role

In an elevated PowerShell session on the server:

Install-WindowsFeature -Name Print-Server -IncludeManagementTools

The -IncludeManagementTools parameter adds the Print Management console, which Microsoft says is not part of a role installation by default. Afterwards, open Print Management from Windows Administrative Tools.

Step 2: Create the TCP/IP port

A standard TCP/IP port points the server at the printer's address. Using the console, right-click Ports under the server and choose Add Port. In PowerShell, use Add-PrinterPort:

Add-PrinterPort -Name "IP_192.168.1.50" -PrinterHostAddress "192.168.1.50"

The documented parameters also include -PortNumber, and -SNMP and -SNMPCommunity for port management. Use a descriptive name that includes the address so the port is easy to identify later. Replace the example address with your printer's reserved address.

Step 3: Install the driver

Install the driver package from the manufacturer on the server, or add it from an INF file:

Add-PrinterDriver -Name "Contoso Model 400 PCL6" -InfPath "C:\Drivers\Model400\model400.inf"

Add-PrinterDriver takes the driver -Name, an optional -InfPath, which Microsoft describes as the path of the printer driver INF file in the driver store, and needs administrator credentials. If the cmdlet cannot find the driver, run the manufacturer's installer or stage the package into the driver store first, and use the exact driver name listed in the INF. The cmdlet works remotely with -ComputerName.

Step 4: Create and share the printer

Add-Printer -Name "Accounts Floor 1" -DriverName "Contoso Model 400 PCL6" -PortName "IP_192.168.1.50" -Shared -ShareName "Accounts-F1" -Location "Floor 1, Accounts" -Comment "Mono A4 duplex" -Published

The -Shared switch shares the printer, -ShareName sets the share name (otherwise the printer name is used), -Location and -Comment fill the descriptive fields, and -Published lists the printer in the network directory service. Keep share names short, without spaces, so UNC paths are easy to type.

Check the result:

Get-Printer -ComputerName localhost | Format-Table Name, DriverName, PortName, Shared, ShareName

Print a test page from the server first. If it fails here, the problem is the port, driver or printer, not Group Policy.

Set permissions

If a printer should be limited to a team, restrict who can print to it through the printer's security settings, or supply an SDDL string with -PermissionSDDL when you add it. Review the permissions on each new queue and test with a normal user account.

Step 5: Deploy with Group Policy

Microsoft's documentation describes the procedure in Print Management:

1. Open Print Management.
2. Under the print server in the tree, select Printers.
3. In the results pane, right-click the printer and choose Deploy with Group Policy.
4. In the Deploy with Group Policy dialog box, select Browse, then choose or create a GPO to store the printer connections, and select OK.
5. Choose how to deploy: select the The computers that this GPO applies to (per machine) check box so that all users of those computers get the printer, or the The users that this GPO applies to (per user) check box so that the users get the printer on any computer they log on to.
6. Select Add. Repeat for another GPO if needed, then select OK.

Per-user or per-computer

If you remove the printer connection setting from the GPO, Windows removes the corresponding printers from the client at the next background refresh or user logon. Link the GPO to the OU that contains the users or computers, and use security filtering or separate GPOs per office so each site receives only its own printers.

This procedure comes from an archived Microsoft page written for Windows Server 2008. Confirm the dialog wording on your server version.

Verification

On a client PC after policy applies:

gpupdate /force
Get-Printer | Format-Table Name, ComputerName, PortName

Log off and on again, since per-computer connections are added at logon. The shared printer should appear in Printers & scanners. Then print a test page as a standard user, not as an administrator.

Troubleshooting

Standard users are asked for administrator credentials

Microsoft's KB5005652 explains that updates released on or after August 10, 2021 require administrator privileges to install printer drivers using Point and Print by default. The behaviour is controlled by this value:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
RestrictDriverInstallationToAdministrators (DWORD)
  1 = enabled (the default, also when the value is absent)
  0 = non-administrators can install drivers from a print server

The Group Policy setting is Limits print driver installation to Administrators under Computer Configuration > Administrative Templates > Printers, available with updates released October 12, 2021 or later. Microsoft states that a value of 0 makes devices vulnerable and suggests using it only temporarily.

The options Microsoft lists for non-administrators are to enter administrator credentials at the prompt, to have the required printer drivers in the operating system image, or to temporarily set the value to 0 while drivers are installed. Pre-installing the driver on each client, through your image or software deployment tool, is the durable fix because the security setting stays on. If drivers still fail to install with administrator rights, Microsoft says the Only use Package Point and Print policy must be disabled.

Clients cannot print after server updates

KB5005652 notes that clients need updates released January 12, 2021 or later before servers receive the September 14, 2021 or later updates, otherwise clients may fail to print. Update clients first, or together.

The printer disappears after a policy change

That is expected when you remove the setting from the GPO. Re-add it, or check that the user or computer still falls in scope of the GPO after OU moves or security filter changes.

Port or printer shows offline

Confirm the printer's IP address is unchanged and answers a ping, that the port address in Print Management matches it, and that a local firewall is not blocking the printer's port. If the address changed, reserve it in DHCP and edit the port.

Maintenance checklist

• Record each printer's name, IP, MAC address, driver version and GPO in a simple table.
• Reserve the IP address in DHCP, or set it statically on the printer.
• Update drivers on the server in a test queue first, then switch.
• Review Group Policy scope after reorganising OUs.
• Keep Point and Print restrictions on, and manage drivers centrally.
• If scan-to-email also runs from these devices, see scan-to-email options with Microsoft 365.

References

• Deploy printer connections (Windows Server, archived): https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731292(v=ws.10)
• KB5005652, manage new Point and Print default driver installation behavior: https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872
• Add-PrinterPort: https://learn.microsoft.com/en-us/powershell/module/printmanagement/add-printerport
• Add-Printer: https://learn.microsoft.com/en-us/powershell/module/printmanagement/add-printer
• Add-PrinterDriver: https://learn.microsoft.com/en-us/powershell/module/printmanagement/add-printerdriver
• Roles, role services and features in Windows Server Server Core: https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-roles-and-services
• Add or remove roles and features in Windows Server: https://learn.microsoft.com/en-us/windows-server/administration/server-manager/add-remove-roles-features