Issues with Deploying multiple printers in a single GPO with Item-Level Targeting

active-directorydeploymentgroup-policyprintersecurity-groups

I have a single GPO that contains all printers I need to deploy.
The security filtering for this GPO is set to Authenticated Users.
The GPO is linked to the OU with all of our users.
GPO > User Config > Preferences > Control Panel Settings > Printers > (Printer's waiting to be deployed.)

I have a security group that I created with the users I want to have a specific printer. On the common tab of the printer, I check Item-Level Targeting, and target that specific security group. I deploy the printer with the single GPO.

Targeting Sequence:
GPO Editor > … > Printers > Properties > Common > Check ILT > Targeting… > New Item > Security Group > Select Group > OK

Deploying Sequence:
Print Management > Printer > Deploy with Group Policy… > Select single GPO > Per User > Add > OK

This results in all users in the domain gaining access to this printer. I thought item-level targeting would only limit the deployment to the security group I targeted, but it doesn't. What have I done incorrectly?

I know creating separate GPO's for each printer is a solution, but through research, it seems possible to deploy printers to specific security groups through a single GPO. Any tips?

Thank you,

Chris

Best Answer

You're deploying it two different ways. If you want to deploy it via Group Policy Preferences using Item Level Targeting than you do not need to and should not deploy it with Group Policy from the Print Management console on your print server.

Related Solutions

Deploying Printers via GPO/GPP – Is There a Programmatic Option?

I googled pretty hard, and even toyed with backup-GPO in hopes of being able to hack the resultant XML file and reimport it, but I suspect that a PowerShell script is in your future.

It's not that bad. You can generate the printer list from the nearest server and then loop through that and map them.

Something like this:

$net = New-Object -COMObject WScript.Network
$printserver = 'yourserver'

$printerlist = Get-WMIObject -class Win32_Printer -computer $printserver | Where-Object {$_.ShareName -ne $null} | Select-Object ShareName
foreach ($printer in $printerlist) 
{
    $printerpath = '\\' + $printserver + '\' + $printer.ShareName
    #echo $printerpath
    $net.AddWindowsPrinterConnection($printerpath)
}

If the printers are named logical things, and there's some logical way to identify the machines, you might be able to refine it more. I used to pick the nearest server based on pulling up the client IP address, for example. If IP address like 10.20.*, go to server1. Etc.

I hope that helps.

Edit:

Looking at @EvanAnderson's documentation, I'm pretty sure that XML is hackable.

Relevant bit of my exported file (with redactions):

<DSObject bkp:Path="CN={GUIDHERE},CN=PushedPrinterConnections,%GPO_MACH_DSPATH%" bkp:SourceExpandedPath="CN={13B9B596-452C-4652-A05D-78EF06610134},CN=PushedPrinterConnections,CN=Machine,CN={44A99FBA-0DB3-484C-808E-3DDAE9932A2B},CN=Policies,CN=System,DC=Domainname,DC=extension" bkp:ObjectClass="msPrint-ConnectionPolicy">
    <DSAttributeMultiString bkp:DSAttrName="showInAdvancedViewOnly">
        <DSValue><![CDATA[TRUE]]></DSValue>
    </DSAttributeMultiString>
    <DSAttributeMultiString bkp:DSAttrName="uNCName">
        <DSValue><![CDATA[\\Servername\PrinterShareName]]></DSValue>
    </DSAttributeMultiString>
    <DSAttributeMultiString bkp:DSAttrName="serverName">
        <DSValue><![CDATA[\\Servername]]></DSValue></DSAttributeMultiString>
    <DSAttributeMultiString bkp:DSAttrName="printAttributes">
        <DSValue><![CDATA[0]]></DSValue>
    </DSAttributeMultiString>
    <DSAttributeMultiString bkp:DSAttrName="printerName">
        <DSValue><![CDATA[PrinterShareName]]></DSValue>
    </DSAttributeMultiString>
</DSObject>

Deploy multiple printers with group policy preferences with one policy

For an easy way to manage those deployment I would use 1 GPO/GPP per printer, with one security group for each GPO.

I do this in all the shop I manage as when a user X call to get added a printer Y, you just have to add him to the security group and voila, it's done.

Related Topic