Whats the best method to add printers for users using GPO? Also is there any way to prevent thjem from adding network printers but allow them to add local printers?
Server is Win 2003 RC2, clients are a mix of XP and Win 7
This article is long winded, but has good advice. Basically use the Deployed Printers in a GPO, and run PushPrinterConnections.exe as a login script (part of pmcmgmt.exe from this MS DL Page).
Network Printer security should be handled at the Print Server end, not by trying to lock clients out (which will royally screw with the above process). Users who are not local admins will not be able to add local printers anyway (and we all know proper security dictates that normal users are not local admins, especially on XP).
I think consensus on this has been prnmgr.vbs for a while. @Chris makes a good suggestion, but I did not know that worked with XP clients (I thought all that business worked well with Vista or newer; I have still have tons of trouble with XP clients and printmanagement.msc).
To expand on some of the other answers, I'd agree that Chris S's method works best if you are deploying from a Print Server. But if you're talking about only local printers with TCP/IP ports, alharaka is correct in using prnmgr.vbs.
That is designed to be run from your own computer to push one time to a client. If you want to use it in a GPO, I'd suggest:
Make separate scripts for groupings of printers you'd like to deploy
Create a GPO with those scripts as a startup/shutdown script, targetting the appropriate OU's for your users or computers
Ensure you're placing the script in a secure location, because it will contain administrative credentials.
The only thing I'd find a way to add is some type of check to the script that says, "If this printer is already installed, skip". This way your startup/shutdown times aren't affected for computers that already have the appropriate printers.
In answer to your other question, I don't think its possible to allow users to add local printers without giving them admin rights.
This article is long winded, but has good advice. Basically use the Deployed Printers in a GPO, and run
PushPrinterConnections.exeas a login script (part ofpmcmgmt.exefrom this MS DL Page).Network Printer security should be handled at the Print Server end, not by trying to lock clients out (which will royally screw with the above process). Users who are not local admins will not be able to add local printers anyway (and we all know proper security dictates that normal users are not local admins, especially on XP).
I think consensus on this has been prnmgr.vbs for a while. @Chris makes a good suggestion, but I did not know that worked with XP clients (I thought all that business worked well with Vista or newer; I have still have tons of trouble with XP clients and
printmanagement.msc).To expand on some of the other answers, I'd agree that Chris S's method works best if you are deploying from a Print Server. But if you're talking about only local printers with TCP/IP ports, alharaka is correct in using prnmgr.vbs.
I had done a write-up of using prnmgr.vbs and the other related vbs scripts to deploy printers here: http://faultbucket.ca/2011/01/silent-printer-deployment-in-windows/
That is designed to be run from your own computer to push one time to a client. If you want to use it in a GPO, I'd suggest:
The only thing I'd find a way to add is some type of check to the script that says, "If this printer is already installed, skip". This way your startup/shutdown times aren't affected for computers that already have the appropriate printers.
In answer to your other question, I don't think its possible to allow users to add local printers without giving them admin rights.