Printer installed on terminal server 2012 only works with group "everybody"

Question

I'm trying to restrain access to printers on my terminal server.

The printers are installed directly on the server because we're using thin clients to connect, so people don't have a local default printer. This is why I'm not using EasyPrint

The problem I'm facing here is that I don't want everyone to see every printer. I tried adding the specific user to the security tab in printer properties with all access and remove the everybody group. When I do this, the printer I set up disappear from every accounts except the one I set the security rights(thjs is what I want) , but the printer won't print anything.

As soon as I add back the Everybody group with print access, the printer starts working again, but now everybody can see it.

Any idea what could cause this ?? Thanks !!

Do you know is there a way to make it coexist with printer redirection ? because I also have some user using the terminal server from a desktop pc. In that case I do need redirection — JonDoh, Jul 19 '16 at 13:29
In terms of best practices, it's highly recommended not to use printer redirection EVER. (including turning it off in RDP connection settings). — El Chapo Gluzman, Jul 19 '16 at 13:30
Oh thank you ! And just to make sure , when saying printer redirection, we are talking about Microsoft easyprint stuff right ? — JonDoh, Jul 19 '16 at 13:32
Yes. There is a powerscript discussion on how to avoid this here https://community.spiceworks.com/topic/214441-terminal-server-2008-r2-default-printer — El Chapo Gluzman, Jul 19 '16 at 13:44

score 0 · Answer 1 · answered Jul 19 '16 at 13:26

Best way to manage printer deployment is with gpo and print management roles.

To properly resolved the issue I would do the following:

Delete all printers from all profiles (can be done with scripts, if they are deployed through a GPO now, it will remain there even after GPO has been removed since it was an installation)
Verify all the printers are installed directly on your print management server, test them all and rename if you feel to do so. (can be installed the DC, file server etc... doesn't matter where as long as it has access to replicate from GPO server)
Create a blank GPO called "printer deployment"
Install Print Management Role
Configure Printer Management role by user

Open print management and select "installed printers" Select the printer you want to deploy Select "deploy printer using GPO" Select "printer deployment" GPO Check box "per user" Select "Apply" Verify it is now being displayed under "deployed printers"

Perform that above steps for all printers you want to deploy. This will deploy all printers install on printer manager server to all users, however it wont be based on which user\machine is on or offline since the printers are installed and coming from the server directly. Server or the printer would have to be offline for printing to not function.

Printer installed on terminal server 2012 only works with group "everybody"

1 Answers1