# Shared Printer Setup: Windows Print Server, IP Ports and Group Policy

> Set up a shared office printer on a Windows print server with a TCP/IP port, then deploy it to users or computers with Group Policy, and fix the Point and Print driver prompt.

Source: https://www.epifive.com/blog/shared-printer-setup-windows-print-server · Published 2026-10-25 · EpiFive

## Key takeaways

- A print server centralises drivers, queues and permissions, and Print Management can deploy shared printers to users or computers with Group Policy.
- Per-computer printer connections are added at user logon, per-user connections are added during background policy, and removing the GPO setting removes the printers.
- Windows updates from 10 August 2021 onward default RestrictDriverInstallationToAdministrators to 1, so standard users cannot install drivers from a print server by default.
- Setting RestrictDriverInstallationToAdministrators to 0 makes devices vulnerable, so prefer pre-installing drivers or including them in the OS image.
- Give each printer a fixed IP address or DHCP reservation before creating its port, because the port refers to the address.

To share an office printer reliably with Windows PCs, give the printer a fixed IP address, create a TCP/IP port and install the driver on a Windows print server, share the queue, and deploy the connection with Group Policy through Print Management. This guide shows each step in the interface and in PowerShell, then explains the Point and Print driver restriction that causes most "I can't add the printer" calls.

## Who this is for

This is for administrators of small Active Directory domains who have one or more network printers and a Windows Server that can host the Print Server role. By the end you will have a shared queue on the server, a connection that appears on the right users' or computers' desktops automatically, and a way to verify and troubleshoot it.

If you do not run Active Directory, the manual steps for the port, driver and share still apply, but you will connect clients by hand with `Add-Printer -ConnectionName`.

## Choosing an approach

| Approach | How it works | Good for | Weak spot |
|---|---|---|---|
| Print server with shared queue | PCs connect to `\\server\printer`; the server holds the driver and queue | Offices with several PCs and Active Directory | The server must be online for printing |
| Direct IP printing per PC | Each PC creates a TCP/IP port and installs the driver | A few PCs, no server | Drivers and ports are managed on every machine |
| Print server plus Group Policy | Server queue, connection pushed by a GPO | Domains where users move between PCs | Needs correct driver and Point and Print behaviour |

The rest of the article covers the third approach, because it includes the other two.

## Prerequisites

- A Windows Server joined to the domain. Microsoft's documentation names the Print and Document Services role as `Print-Services` and its Print Server role service as `Print-Server`, and says the role is not installed by default. Run `Get-WindowsFeature *print*` on your server version to confirm the names.
- Membership of the local Administrators group on the print server, and write access to the Group Policy object you will use.
- A fixed IP address or DHCP reservation for each printer, so the port does not break when a lease changes.
- The 64-bit driver package for the printer, preferably the manufacturer's current universal or model-specific driver for your Windows version.
- Windows updates applied consistently. Microsoft's KB5005652 notes that clients should have updates released January 12, 2021 or later before servers receive updates released September 14, 2021 or later, otherwise clients may fail to print.

## Step 1: Install the Print Server role

In an elevated PowerShell session on the server:

```powershell
Install-WindowsFeature -Name Print-Server -IncludeManagementTools
```

The `-IncludeManagementTools` parameter adds the Print Management console, which Microsoft says is not part of a role installation by default. Afterwards, open **Print Management** from Windows Administrative Tools.

## Step 2: Create the TCP/IP port

A standard TCP/IP port points the server at the printer's address. Using the console, right-click **Ports** under the server and choose **Add Port**. In PowerShell, use `Add-PrinterPort`:

```powershell
Add-PrinterPort -Name "IP_192.168.1.50" -PrinterHostAddress "192.168.1.50"
```

The documented parameters also include `-PortNumber`, and `-SNMP` and `-SNMPCommunity` for port management. Use a descriptive name that includes the address so the port is easy to identify later. Replace the example address with your printer's reserved address.

## Step 3: Install the driver

Install the driver package from the manufacturer on the server, or add it from an INF file:

```powershell
Add-PrinterDriver -Name "Contoso Model 400 PCL6" -InfPath "C:\Drivers\Model400\model400.inf"
```

`Add-PrinterDriver` takes the driver `-Name`, an optional `-InfPath`, which Microsoft describes as the path of the printer driver INF file in the driver store, and needs administrator credentials. If the cmdlet cannot find the driver, run the manufacturer's installer or stage the package into the driver store first, and use the exact driver name listed in the INF. The cmdlet works remotely with `-ComputerName`.

## Step 4: Create and share the printer

```powershell
Add-Printer -Name "Accounts Floor 1" -DriverName "Contoso Model 400 PCL6" -PortName "IP_192.168.1.50" -Shared -ShareName "Accounts-F1" -Location "Floor 1, Accounts" -Comment "Mono A4 duplex" -Published
```

The `-Shared` switch shares the printer, `-ShareName` sets the share name (otherwise the printer name is used), `-Location` and `-Comment` fill the descriptive fields, and `-Published` lists the printer in the network directory service. Keep share names short, without spaces, so UNC paths are easy to type.

Check the result:

```powershell
Get-Printer -ComputerName localhost | Format-Table Name, DriverName, PortName, Shared, ShareName
```

Print a test page from the server first. If it fails here, the problem is the port, driver or printer, not Group Policy.

### Set permissions

If a printer should be limited to a team, restrict who can print to it through the printer's security settings, or supply an SDDL string with `-PermissionSDDL` when you add it. Review the permissions on each new queue and test with a normal user account.

## Step 5: Deploy with Group Policy

Microsoft's documentation describes the procedure in Print Management:

1. Open **Print Management**.
2. Under the print server in the tree, select **Printers**.
3. In the results pane, right-click the printer and choose **Deploy with Group Policy**.
4. In the **Deploy with Group Policy** dialog box, select **Browse**, then choose or create a GPO to store the printer connections, and select **OK**.
5. Choose how to deploy: select the **The computers that this GPO applies to (per machine)** check box so that all users of those computers get the printer, or the **The users that this GPO applies to (per user)** check box so that the users get the printer on any computer they log on to.
6. Select **Add**. Repeat for another GPO if needed, then select **OK**.

### Per-user or per-computer

| | Per computer | Per user |
|---|---|---|
| Printer follows | The PC | The user |
| Applied when | The user logs on | During background policy |
| Typical use | Shared room printers, kiosks | Department printers for roaming staff |

If you remove the printer connection setting from the GPO, Windows removes the corresponding printers from the client at the next background refresh or user logon. Link the GPO to the OU that contains the users or computers, and use security filtering or separate GPOs per office so each site receives only its own printers.

This procedure comes from an archived Microsoft page written for Windows Server 2008. Confirm the dialog wording on your server version.

## Verification

On a client PC after policy applies:

```powershell
gpupdate /force
Get-Printer | Format-Table Name, ComputerName, PortName
```

Log off and on again, since per-computer connections are added at logon. The shared printer should appear in **Printers & scanners**. Then print a test page as a standard user, not as an administrator.

## Troubleshooting

### Standard users are asked for administrator credentials

Microsoft's KB5005652 explains that updates released on or after August 10, 2021 require administrator privileges to install printer drivers using Point and Print by default. The behaviour is controlled by this value:

```text
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
RestrictDriverInstallationToAdministrators (DWORD)
  1 = enabled (the default, also when the value is absent)
  0 = non-administrators can install drivers from a print server
```

The Group Policy setting is **Limits print driver installation to Administrators** under **Computer Configuration** > **Administrative Templates** > **Printers**, available with updates released October 12, 2021 or later. Microsoft states that a value of 0 makes devices vulnerable and suggests using it only temporarily.

The options Microsoft lists for non-administrators are to enter administrator credentials at the prompt, to have the required printer drivers in the operating system image, or to temporarily set the value to 0 while drivers are installed. Pre-installing the driver on each client, through your image or software deployment tool, is the durable fix because the security setting stays on. If drivers still fail to install with administrator rights, Microsoft says the **Only use Package Point and Print** policy must be disabled.

### Clients cannot print after server updates

KB5005652 notes that clients need updates released January 12, 2021 or later before servers receive the September 14, 2021 or later updates, otherwise clients may fail to print. Update clients first, or together.

### The printer disappears after a policy change

That is expected when you remove the setting from the GPO. Re-add it, or check that the user or computer still falls in scope of the GPO after OU moves or security filter changes.

### Port or printer shows offline

Confirm the printer's IP address is unchanged and answers a ping, that the port address in Print Management matches it, and that a local firewall is not blocking the printer's port. If the address changed, reserve it in DHCP and edit the port.

## Maintenance checklist

- Record each printer's name, IP, MAC address, driver version and GPO in a simple table.
- Reserve the IP address in DHCP, or set it statically on the printer.
- Update drivers on the server in a test queue first, then switch.
- Review Group Policy scope after reorganising OUs.
- Keep Point and Print restrictions on, and manage drivers centrally.
- If scan-to-email also runs from these devices, see [scan-to-email options with Microsoft 365](https://www.epifive.com/blog/scan-to-email-microsoft-365-smtp-options).

## References

- Deploy printer connections (Windows Server, archived): https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731292(v=ws.10)
- KB5005652, manage new Point and Print default driver installation behavior: https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872
- Add-PrinterPort: https://learn.microsoft.com/en-us/powershell/module/printmanagement/add-printerport
- Add-Printer: https://learn.microsoft.com/en-us/powershell/module/printmanagement/add-printer
- Add-PrinterDriver: https://learn.microsoft.com/en-us/powershell/module/printmanagement/add-printerdriver
- Roles, role services and features in Windows Server Server Core: https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-roles-and-services
- Add or remove roles and features in Windows Server: https://learn.microsoft.com/en-us/windows-server/administration/server-manager/add-remove-roles-features

## Frequently asked questions

### Should I use a print server or connect each PC directly to the printer IP?

A print server gives you one place to install drivers, set permissions and see queues, and it lets you deploy connections with Group Policy. Direct IP printing avoids a single point of failure but means each PC needs its own port and driver. For more than a handful of PCs the server is easier to manage.

### What is the difference between per-user and per-computer printer deployment?

Per-computer connections are added when the user logs on and apply to everyone who uses that PC. Per-user connections are added during background policy and follow the user to any computer they log on to. If you remove the setting from the GPO, the printers are removed at the next refresh or logon.

### Why do standard users get a prompt for admin credentials when adding a shared printer?

Windows updates released on or after 10 August 2021 require administrator privileges to install printer drivers through Point and Print by default, through the RestrictDriverInstallationToAdministrators setting. Include the driver in the image, pre-install it, or supply admin credentials.

### Do I need administrator rights to run Add-PrinterPort?

Microsoft's documentation says you do not need administrator credentials for Add-PrinterPort, but Add-PrinterDriver requires them and Add-Printer may. Run the commands in an elevated PowerShell session on the print server.