Deploy Printers with Group Policy: A Small Office Guide

If you deploy printers with Group Policy, new starters get the right printers when they first sign in, people moving desks get the printer nearest to them, and nobody has to type an IP address or hunt for a queue. In a small office with an Active Directory domain, it is the tidiest way to stop printer setup from being a helpdesk task. This guide covers the usual method, the driver rules that have tripped many offices up since 2021, and what to do for computers that are not in a domain.

When Group Policy is the right tool

Group Policy is built into Windows Server Active Directory. It suits you when:

• your computers are joined to an on-premises Active Directory domain;
• you have a print server, or are happy to set one up (see print server vs direct IP printing);
• different teams or floors should get different printers.

If your computers are joined only to Microsoft Entra ID, or you have no server, see the alternatives section below.

Step 1: write a printer map

Before touching any policy, list:

Printer	Location	Who gets it	Default for	Driver
Example: Floor 1 MFP	Floor 1 copy area	All staff on floor 1	Floor 1 staff	Class driver
Example: Finance printer	Finance office	Finance group	Finance group	Manufacturer universal driver

Create or reuse security groups that match the “who gets it” column. Clear groups make targeting simple and make the map easy to keep current.

Step 2: sort out drivers first

This is where most deployments fail today. In 2021, the PrintNightmare vulnerability (CVE-2021-34527) in the Windows Print Spooler led Microsoft to change Point and Print behaviour. Since the update described in KB5005652, Windows by default requires administrator rights to install a printer driver through Point and Print. A standard user signing in will not be able to install the driver silently, and the printer connection fails or prompts for credentials.

Ways to handle it:

• Pre-install drivers on client computers with your software deployment tool, so Point and Print only has to create the connection.
• Use the Windows inbox class driver where it supports your printers’ features. Microsoft’s end of servicing plan for third-party printer drivers says that from July 2026 Windows ranks its IPP inbox class driver first, so it is worth testing now. Our universal print driver guide explains how to test drivers per model.
• Avoid loosening the security setting to let users install drivers. Microsoft introduced the default for good reason.

Step 3: share the printers

On the print server, share each printer with a short, clear share name, for example by floor and function. Set default printing preferences on the queue, such as duplex and mono, so every user inherits them. Turn on secure print release here too if your print management system provides it.

Step 4: create the Group Policy Preferences items

In the Group Policy Management Console, create a new Group Policy Object for printers. Then:

1. Go to User Configuration > Preferences > Control Panel Settings > Printers.
2. Add a Shared Printer item for each printer, using its share path, such as \\printserver\Floor1-MFP.
3. Choose the action. Update is a common choice: it creates the connection if it is missing and refreshes it if present.
4. Optionally set it as the default printer for the targeted users.
5. On the Common tab, enable item-level targeting and target the right security group, site or computer name.

Group Policy Preferences can also create TCP/IP printers that connect directly to a printer’s IP address, typically under Computer Configuration. That avoids a print server but needs the driver on every computer.

Step 5: test and roll out

• Link the GPO to a test organisational unit with one test user and computer.
• On the test PC, run gpupdate /force and sign out and back in.
• Check that the right printers appear, the default is correct, and a test page prints with duplex and mono defaults.
• Link the GPO to the wider organisational unit once the test works.

Keep the printer map next to the GPO documentation, and update both when you add or remove a printer.

Troubleshooting common problems

• Printer does not appear: run gpresult /r on the PC to confirm the GPO applies, and check item-level targeting and the organisational unit link.
• Driver install prompt or failure: the driver is not packaged or not on the print server, or Point and Print restrictions block it. Fix the driver on the server rather than relaxing the restrictions.
• Wrong default printer: two items both set a default. Use targeting so only one applies to each user.
• Slow sign-in: many printer items processed at sign-in can add delay. Remove items for printers that no longer exist.

Removing old printers

When you replace a printer, change the item’s action to Delete for a few weeks so old connections are removed from everyone’s computer, then remove the item. Our guide on when to replace an office printer covers the wider changeover.

Alternatives for cloud-joined computers

Computers joined only to Microsoft Entra ID do not process on-premises Group Policy. Options:

• Universal Print, Microsoft’s cloud print service for Microsoft 365 organisations, can deliver printers to users without a print server; Microsoft Learn describes requirements and supported printers.
• Independent cloud print management services with their own deployment agents; see cloud print management for small business.
• Scripts or configuration profiles delivered by your device management platform.

Security points

• Keep the print server patched; it is a high-value target.
• Do not grant users rights to install drivers to make deployment easier.
• Limit who can edit printer GPOs.
• Review the network printer security checklist for the printers themselves.

Summary

To deploy printers with Group Policy, write a printer map, solve drivers first because of the Point and Print changes, share printers with sensible defaults, create Group Policy Preferences printer items with item-level targeting, and test before rolling out. For cloud-joined computers, use a cloud print service or your device management tool instead.