Question for anyone experienced in Server 2008 R2

[ÐeviÑ]

I work for my local school district in the tech department. It is just me and one other guy. Recently, we got some new Windows 7 computers. After getting them set up and such, we found that our printer policies are not working correctly. At first we thought it was just these new machines, but it turns out EVERY Win7 machine in the district is having problems with the printers. For whatever reason, when we change/delete/create a printer policy, the Win7 machines seem to stick with the policy that they originally got.

However, the XP machines seem to be getting the correct policies for printers, although we haven't looked too far into that, and only tried one of them.

Any ideas what the problem could be?

[Ben-BSH]

I guess you are talking about assigned printers in group policy yes?

If you are using scripts or a 3rd party app please tell me

couple of things..

you have tested with gpupdate /force on the client workstations? (forces an update of group policy)
are all the Win7 Machines x86 or x64? are the drivers on the print server up to date (and you are offering x64 drivers if needed)?
have you run the RSOP wizard for both the XP and Win7 workstations?
are your printers are all shared from one central server?
is there anything in the event logs?

Now, why are you changing the policy once you have set it? are you implementing location based printing?

and more importantly, what in the policy are you changing? if you want, PM me your GPO settings and highlight what you are changing / what isn't working properly (obv change to \\printsrv1\printer1 for security though)

[ÐeviÑ]

I think so. Neither of us at the tech department really know too much about Server 2008 R2.

I am pretty sure we aren't using any third party stuff.

Yes, gpupdate /force doesn't change it.
They are all x86, the drivers are up to date.
RSOP? O.o
In the event logs on the NEW COMPUTERS ONLY, there is an error about drivers not being found, but that is only on the new computers. All of the other Win7 machines don't have errors.

We wouldn't be changing it, but because we first thought it was only a problem with the new computers, we made some changes as a test. So, for instance, the computers in the Library should only have the library printers. There are some new computers in the Library, and some slightly older ones that are also Win7. Since we thought it was just a problem with the new computers, we added "Printer 2" from "Room B" to the policy so that any computer in the Library could print to "Printer 2." Now the problem is that Printer 2 won't show up.

It seems like the Win7 machines are stuck on the original printers that they are first assigned by a policy, which is a problem for the new computers, because they can't connect to the printers that were first assigned.. Any XP machine we tested (which again, was only one) didn't have this problem.

Also, if we wait until after a computer is logged on, remove the printers from the computer, then run gpupdate, the printers all are added nicely and can print, even on the new machines.

I am not at the school right now, but I will see what I can do about getting the GPO settings.

[Ben-BSH]

Forgive me for asking, but why are you using group policy to assign the printers? VB / Batch scripts work MUCH better imo.
unless you want the "location" based printing i mentioned earlier, but even then you can use VB scripts to map printers based on geographic location onsite.

I have not ever seen group policy be an efficient way of assigning printers, simply due to the time it can take to process and download.
which reminds me, try the "wait for network at logon" policy, enabling it, i think its under computer config, windows settings, adm templates, network (or system)

RSOP is the Resultant Set Of Policy Wizard which is run on your w2k8² server, and tells you what the winning policy/settings "should" be

it might be worth running gpresult /r on one of the client machines to see what policies are being applied, and if any are in a paused / waiting for next logon state.


what happens if you make a brand new GPO adding the printer, and only that? does that then work? if so i think the client machines are simply having trouble reading the updated gpo (or they are not seeing it as updated!)

[ÐeviÑ]

Forgive me for asking, but why are you using group policy to assign the printers? VB / Batch scripts work MUCH better imo.

To be honest, you aren't the only person who has said this. Our "Microsoft Certified" consultant actually set it up for us this way.

I am not at the school now, and will have to wait until Monday to try your suggestions and such.

Personally, I had nothing to do with the original setting up of the network. I came in after it was set up, so I really have no idea why anything is set up how it is. XD

[Ben-BSH]

Well, if it makes any difference, let your Network Manager know I am qualified to:

Microsoft Certified Systems Administrator
Microsoft Certified Technology Specialist
Microsoft Certified Professional
Microsoft Certified IT Professional

And I think group policy assigned printers is a huge headache, if were you I would do it via login scripts.

do you have a login script set in the users AD properties? if so, you can either add printer connections to the batch file (best way if you have windows 7 clients due to the "are you sure you want to run this" prompt when you add a VB script into a login script.) you can also do it with VB, but that requires a little more tweaking to get the prompt to go away

but either way, here is an example of both.

Code: (VB) [Select]

Set WshNetwork = CreateObject("WScript.Network")

WshNetwork.AddWindowsPrinterConnection "\\printsrv1\colour"
WshNetwork.AddWindowsPrinterConnection "\\printsrv1\black"
WshNetwork.AddWindowsPrinterConnection "\\printsrv1\photocopier"

WshNetwork.SetDefaultPrinter "\\printsrv1\colour"


best way imo

Code: (bat) [Select]

rundll32 printui.dll,PrintUIEntry /in /q /n"\\printsrv1\colour"
rundll32 printui.dll,PrintUIEntry /in /q /n"\\printsrv1\black"
rundll32 printui.dll,PrintUIEntry /in /q /n"\\printsrv1\photocopier"

rundll32 printui.dll,PrintUIEntry /y /n"\\printsrv1\colour"

Now the bottom line in both these scripts adds one of the printers previously connected to as the default, leave this line out to have any "local" (usb or other) printers as the default (usually!)

both these scripts do not themselves offer location based printing, but if you just spend 30 seconds on google, you can find VB scripts that query computer locations, names etc.

takes seconds to add a line of code, reduces chance of errors when playing with GP! and is immediate after a relogon whereas a GP might take hours. (unless you gpupdate /force manually at the machine)

[ÐeviÑ]

Alright, so here is what I found out.

-Our printer policies add SHARED printers to the machines.
-The printers that are added are based on item level targeting (where computer is in X OU)
-Adding a logon script in the same policy had no effect, but adding a local one did
-On a student account, using the batch script you provided (with necessary tweaking, adding our printers/server) it asks for a password to connect to the print server.


Also, not entirely sure what you want from the GPO, but here is how the printers are being assigned:

Code: [Select]

Name                                   Order Action Path                                      Default
Band                                         4   Create \\PrintServ1\Band                        Yes
HP Laserjet 1300                     1        Create \\PrintServ1\HP Laserjet 1300                Yes
HP LaserJet 1200 Series PCL 5             3   Create \\PrintServ1\HP LaserJet 1200                Yes
Lab HP Laser 4200                     5   Create \\PrintServ1\Lab HP Laser 4200                Yes
HP DeskJet 895C                              2   Create \\PrintServ1\HP DeskJet 895C                No

They all have item based targeting so that if, for example, the computer is in "band" ou, it gets the Band printer.

*I changed the server name and printer names for security reasons.

[Ben-BSH]

Ok, now we are getting somewhere, find out why that password prompt is appearing, sounds like that's your issue, as long as your print server is in the domain.. and so are the clients, there is a permissions issue, check the printers security tab in properties?



And for the scripts they are meant to be run via the netlogon share on your dc, using the profile account for the user in ad. Not VIA gpo's.

Sent from my HTC Sensation
Ben