Managing Client-Side Printer Experience Using Group Policy CHAPTER 18 803 print processor mismatch, the client spooler will always send jobs to the print server for rendering. Disabling the preceding policy setting does not override this behavior. n In cases in which the client print driver does not match the server print driver (mis- matched connection), the client will always process the print job regardless of the setting of this policy. Configuring Package Point and Print Restrictions Windows XP SP1 and Windows Server 2003 introduced the following Group Policy setting: User Configuration\Policies\Administrative Templates\Control Panel\Printers\Point And Print Restrictions This policy setting controls the servers to which a client computer can connect for Point and Print. A new feature of this policy setting for Windows 7 and Windows Vista is the ability to control the behavior of UAC prompts when installing printer drivers on Windows Vista computers using Point and Print (see Figure 18-8). This policy setting applies only to non– Print Administrators clients and only to computers that are members of a domain. FIGURE 18-8 Controlling the behavior of security prompts using the Point And Print Restrictions policy setting when installing printers using Point and Print When you enable the policy setting, the client is restricted to only Point and Print to a list of explicitly named servers. You can configure Windows 7 and Windows Vista clients to not show security warnings or elevation prompts when users Point and Print or when drivers for printer connections need to be updated. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 18 Managing Printing 804 If you do not configure the policy setting: n Windows XP and Windows Server 2003 client computers can point and print to any server in their forest. n Windows Vista and later client computers can point and print to any server. n Windows Vista and later computers will show a warning and an elevation prompt when users point and print to any server. n Windows Vista and later computers will show a warning and an elevation prompt when a driver for an existing printer connection needs to be updated. If you disable the policy setting: n Windows XP and Windows Server 2003 client computers can point and print to any server. n Windows Vista and later client computers can point and print to any server. n Windows Vista and later computers will not show a warning or an elevation prompt when users point and print to any server. n Windows Vista and later computers will not show a warning or an elevation prompt when a driver for an existing printer connection needs to be updated. Note that the Users Can Only Point And Print To Machines In Their Forest setting applies only to Windows XP SP1 (and later service packs) and Windows Server 2003. In addition to this updated Point And Print Restrictions policy setting, Windows 7 and Windows Vista include two new policy settings related to Point and Print: n Only Use Package Point And Print This policy restricts clients’ computers to use Package Point and Print only. If you enable this setting, users will only be able to point and print to printers that use package-aware drivers. When using Package Point and Print, client computers will check the driver signature of all drivers that are downloaded from print servers. If you disable or don’t configure this setting, users will not be restricted to Package Point and Print only. n Package Point And Print – Approved Servers Restricts Package Point and Print to approved servers. If you enable this setting, users will only be able to use Package Point and Print on print servers approved by the network administrator. When using Package Point and Print, client computers will check the driver signature of all drivers that are downloaded from print servers. If you disable or don’t configure this setting, Package Point and Print will not be restricted to specific print servers. In Package Point and Print, the complete driver package is put in the driver store on the Windows 7 or Windows Vista client computer. All files in the printer driver are installed on the client, and the installation process ensures that the package is digitally signed properly before adding it to the store. This result is a more secure form of Point and Print than found on previous versions of Windows. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Managing Client-Side Printer Experience Using Group Policy CHAPTER 18 805 note Printing from Windows Vista and later versions to print servers running earlier versions of Windows uses legacy Point and Print. Extending Point and Print Using Windows Update By default, Windows Update is checked for a compatible driver whenever a user uses the Add Printer Wizard to install a new printer. When a compatible in-box driver cannot be found when Group Policy is used to deploy a printer to a client computer, Windows Update is again checked for a compatible driver. This failover behavior can be turned off in enterprise envi- ronments using the following Group Policy setting, which is new in Windows 7 and Windows Server 2008 R2: Computer Configuration\Policies\Administrative Templates\Printers\Extend Point And Print Connection To Use Windows Update And Use An Alternate Connection If Needed If you enable or do not configure this policy setting, the client computer will continue to search for compatible Point and Print drivers from Windows Update after it fails to find the compatible driver from the local driver store and the server driver cache. If the client com- puter is unable to find a compatible Point and Print driver, it will attempt to create a CSR mismatch connection using any available driver that supports the hardware. If you disable this policy setting, the client computer will search only the local driver store and server driver cache for compatible Point and Print drivers. If it is unable to find a compatible driver, then the Point and Print connection will fail. If this policy is enabled, the new cross-platform Point and Print feature of Windows 7 is also enabled. Cross-platform Point and Print is designed to allow users who have computers running different processor architectures (x86 or x64, for example) to share their printers easily. Cross-platform Point and Print is designed to enable the following types of scenarios: n Karen brings home a new Windows 7 laptop for her son to use in school. She decides to upgrade her old Windows XP desktop to Windows 7 at the same time. She enrolls both PCs to her new HomeGroup during the setup process. She takes her existing inkjet printer and plugs it into her desktop system through the USB port. A short while later, she notices that her son’s laptop already has a print queue for her office printer so he can print reports and other documents. She is unaware of the fact that the desk- top is running an x86 version of Windows and the laptop is running an x64 version of Windows. This setup works because, in Windows 7, a user can add a printer locally to one system in a HomeGroup, and every other PC in the HomeGroup will search their local driver store, the print server, and Windows Update to find a suitable driver to make a print connection. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 18 Managing Printing 806 n Tony brings home a new Windows 7 laptop for working on personal projects. He already has a home network set up, including an older Windows XP file and print server in his office. After the new laptop is set up, Tony uses the Add Printer Wizard to create a new connection to his office printer. The new laptop is running an x64 edition of the Windows 7 Business operating system. The printer is older, and there are no in-box drivers. Without any prompts or elevations, the system searches Windows Update to find a suitable driver, installs it, and creates the connection to the printer. Tony then brings his laptop to work because he wants to use it for a presentation. After the meet- ing, he is asked to print out a copy of the slides for his manager. He navigates to the print server at work through Windows Explorer and opens the printer. After a few min- utes, it is available to print, and he makes a copy of the slides even though Windows Update is blocked by his company’s IT department. In business environments, you might want to disable the automatic querying Windows Up- date for compatible printer drivers, especially when Group Policy is used to deploy printers as described in the next section. An example of a scenario in which you disable this Group Policy setting might be the following: n Tony is setting up a small business computer environment for a startup. He is using Windows 7 for all of the systems. He writes some scripts to set up the servers, including a connection to a shared printer for printing out logs and other reports periodically. He also uses the Print Management console to set up the print server and push printer connections out to all of the clients. On the first client box he tests, he notices that it is going to Windows Update to find a print driver for the push printer connection. This is not the behavior he wants, so he investigates and finds out that a new feature in Windows 7 allows clients to search Windows Update for drivers when they aren’t avail- able on the server. He also discovers that Group Policy can be configured to disable this failover case. He disables this policy setting and adds the driver found on Windows Update to the print server so that the remaining clients can use standard Point and Print. Deploying Printers Using Group Policy The ability to deploy printer connections to Windows-based client computers using Group Policy was first introduced in Windows Server 2003 R2. You can use Group Policy to deploy printer connections in two ways: n As per-computer printer connections available for all users who log on to the client computer. You can deploy per-computer printer connections to computers running Windows XP or later versions. n As per-user printer connections available to the user on any client computer to which the user logs on. You can deploy per-user printer connections to users of computers running Windows 2000 or later versions. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Deploying Printers Using Group Policy CHAPTER 18 807 Deploying printers using Group Policy is useful in scenarios in which every user or com- puter in a room or office needs access to the same printer. Deploying printers using Group Policy can also be useful in large enterprises where users and computers are differentiated by function, workgroup, or department. diReCt FRoM tHe Field Configuring Printer Connections Using Group Policy Preferences Jerry Honeycutt Deployment Forum G roup Policy preferences, a new feature of Windows Server 2008, provides administrators with another means of deploying, configuring, and managing printer connections on Windows 7 computers. Configuring printer connections is a common task that administrators typically perform by writing logon scripts. The Printers preference extension, however, enables you to easily create, update, replace, or delete shared printers, TCP/IP printers, and local printers to multiple, targeted users or computers. Using preference targeting, you can deploy printer connections based on location, department, computer type, and so on. Windows 7 Group Policy provides native support for deploying printers. However, it supports only shared printers and requires AD DS schema extensions. In contrast, the Printers extension supports shared, local, and TCP/IP printers on Windows XP SP2, Windows Vista, and Windows 7. It also allows you to set the default printer and map shared printers to local ports. note For more information about Group Policy Preferences, see Chapter 14. Preparing to Deploy Printers Deploying printers using Group Policy requires you to perform the following preparatory steps: n If you are not using Windows Server 2008 domain controllers, your AD DS schema must first be upgraded to Windows Server 2003 R2 or later. This means the schema revision number must be 9 (for Windows Server 2003) and the schema version number must be 31 (for the R2 schema update). You can use ADSI Edit to determine your current schema version number by looking under the Schema node, right-clicking the object named CN=Schema,CN=Configuration,DC=forest_root_domain, selecting Properties, and then examining the value of the objectVersion attribute. The R2 schema update is required so that Print Management can create the following two objects in AD DS: Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 18 Managing Printing 808 • CN=Schema,CN=Policies,CN=GPO_GUID,CN=Machine,CN=PushPrinterConnections • CN=Schema,CN=Policies,CN=GPO_GUID,CN=User,CN=PushPrinterConnections n If your client computers are running an earlier version of Windows, you must deploy the PushPrinterConnections.exe utility to these clients prior to using Group Policy to deploy printer connections to these computers. The PushPrinterConnections.exe utility reads the GPOs that are used to deploy printer connections and adds or removes these connections on the client as needed. The easiest way to deploy PushPrinterConnections.exe is to use a GPO as follows: • As a user logon script for deploying per-user printer connections • As a computer startup script for deploying per-computer printer connections The simplest approach is to use the same GPO to deploy both PushPrinterConnections.exe to targeted users and/or computers using startup/logon scripts and the actual printer connections themselves to those users and/or computers. Beginning with Windows Vista, however, you do not need to first deploy PushPrinterConnections.exe to client computers because Windows Vista and later versions include this capability in the operating system. Deploying a Printer Connection After you complete the preceding preparatory steps, you can deploy a printer connection by following these steps: 1. Create a new GPO for deploying the connections, or use an existing GPO linked to the OU, domain, or site where the users or computers being targeted reside. 2. Open Print Management, right-click the printer you want to deploy, and select Deploy With Group Policy. 3. In the Deploy With Group Policy dialog box, click Browse, find and select the GPO you will use to deploy the printer, and then click OK. 4. Choose whether to deploy the printer as a per-computer connection, a per-user con- nection, or both. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Deploying Printers Using Group Policy CHAPTER 18 809 5. Click Add to add the printer connection settings to the GPO. 6. If needed, repeat steps 3 through 5 to deploy the same printer to additional GPOs. 7. Click OK when finished. The printer connection to be deployed using Group Policy will be displayed under the Deployed Printers node in Print Management. Per-user printer connections can be deployed immediately using Group Policy if the user next logs off and then logs on again to a targeted client computer. Per-computer printer con- nections can also be deployed immediately if the user’s computer is restarted. Neither type of connection will be deployed on earlier versions of Windows during normal background refresh of Group Policy. On Windows Vista and later clients, however, background policy refresh can also deploy both per-user and per-computer printer connections. note On Windows Vista and later versions, users can also force printer connections to be deployed immediately by typing gpupdate /force at an elevated command prompt. The deployed printer connection is also displayed in the GPO used to deploy the connec- tion. To view this, open the Group Policy Management Console (GPMC), right-click the GPO you used to deploy the connection, and then click Edit to open the GPO using the Group Policy Object Editor (see Figure 18-9). To remove the deployed printer connection from the targeted users or computers during the next background refresh of Group Policy, right-click the connection and then click Remove. Unlinking the GPO from the OU, domain, or site where the targeted users or computers reside also removes the deployed connections. note You can also use the Group Policy Results Wizard in the GPMC to collect RSoP information to verify the success or failure of deploying printers using Group Policy. For more information on using Group Policy with Windows 7, see Chapter 14. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 18 Managing Printing 810 FIGURE 18-9 Viewing a deployed printer connection in a GPO Limitations of Deploying Printers Using Group Policy The following limitations apply when deploying printer connections to Windows 7 clients using Group Policy: n You cannot configure the default printer on the targeted client using Group Policy. n Loopback mode is not supported. Assigning Printers Based on Location Windows Vista introduced a feature with the ability to assign printers based on location. This can be useful in large enterprises that span more than one geographical location, allow- ing mobile users to update their printers as they move to new locations. When mobile users return to their primary locations, their original default printers are restored. To assign printers based on location, deploy printers using GPOs linked to AD DS sites. When a mobile computer moves to a new site, the printer connections for the computer are updated using normal Group Policy processing. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. Deploying Printers Using Group Policy CHAPTER 18 811 diReCt FRoM tHe SoURCe Managing Deployed Printer Connections Alan Morris, Software Design Engineer Test, Windows Printing T here are two ways of managing deployed printer connections in Windows 7: n Using the Print Management console n Using the Group Policy Management Editor The following sections of this sidebar describe the differences between these two approaches. Managing Deployed Printer Connections Using the Print Management Console Deployed printer connections will be displayed in Print Management’s Deployed Printers node for the connections hosted by the current list of monitored servers when the Print Management operator has Read access to the domain policies in which printer connections are deployed. To deploy connections to a Group Policy using the Print Management console, you must have Write access to the domain policy, and the server that shares the printer must be added to the list of servers that Print Management is monitoring. The op- erator in charge of printer deployment does not need to have administrative rights on the print server. The deployed printer connections feature is not used to create local printers, but anyone with administrative rights can add printer connections to the local policy of a computer. Local Policy-deployed printer connections are useful when AD DS is not fully implemented or when setting up systems in a workgroup environment. Some form of peer-to-peer authentication is required when the workgroup computers or users cannot authenticate to a domain controller. Deployed printer connections do not need to be published to the AD DS. Deployed printers do not require any driver download prompts during installation. The user does not have access to delete deployed printer connections. The printer needs to be removed from the policy or the user must be unlinked from the policy for the printer removal to occur. Managing Deployed Printer Connections Using the Group Policy Management Editor This tool has a few advantages over the Print Management snap-in. You don’t need to monitor the server sharing the deployed printers. You can deploy printer shares Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. CHAPTER 18 Managing Printing 812 that have yet to be created. The user interface works directly within the selected GPO. The user does not need to be logged on to the same domain as the GPO. The big disadvantage when using this tool rather than the Print Management snap-in is the lack of any print share validation. If valid server and share informa- tion is improperly entered, the connection will fail. When no share validation is performed, the advantage is that this method allows for deployment of connections prior to creating the share. After the share is created, the connections will be added for the user during the next policy refresh on Windows 7 clients and the next time PushPrinterConnections.exe is run on previous-version clients. Printers hosted on a server in one domain can easily be deployed to clients in another trusted domain. Another important use of the Group Policy Management Editor is in the removal of deployed printers after a print server is retired. The Group Policy Management Editor will display the printers deployed to a policy and allow the operator to remove them after the server is no longer available on the network. Migrating Print Servers You can use either the Printer Migration Wizard or the PrintBRM command-line tool to export print queues, printer settings, printer ports, and language monitors and then import them on another print server running Windows. This is an efficient way to consolidate multiple print servers onto a single computer or to replace an older print server with a newer system. The Printer Migration Wizard and the PrintBRM command-line tool were introduced in Windows Vista to replace the earlier Print Migrator 3.1 tool available from the Microsoft Download Center. note The Printer Migration Wizard can also be useful for backing up print server config- urations for disaster recovery purposes. For more information on this topic, see the section titled “Exporting and Importing Print Server Configurations” earlier in this chapter. Migrate Print Servers Using Print Management To migrate print servers using Print Management, follow these steps: 1. Open Print Management, right-click the printer server that contains the print queues and printer drivers that you want to export, and then click Export Printers To A File. This launches the Printer Migration Wizard. Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark. [...]... Server, and Windows Server 2003 Search Versions Included in Windows 7 and Windows Vista Table 19-1 lists the different versions of Windows Search included in Windows 7 and Windows Vista Search and Indexing Enhancements  Chapter 19 Please purchase PDF Split-Merge on www.verypdf.com to remove this watermark 825 Table 19-1  Versions of Windows Search in Windows 7 and Windows Vista Windows Version Windows. .. digitally signed e-mail is also new in Windows 7 n Windows 7 allows searching the content of network file shares on computers running Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008, Windows XP, or Windows Server 2003 Some of these operating systems require the installation of an additional feature to support remote queries from computers running Windows 7 For more information, see the... version of Windows Windows Search is provided in several different forms: n As a built-in service called Windows Search in Windows 7 and Windows Vista n As a role service called Windows Search Service, which you can install from within the File Services role in Windows Server 2008 and Windows Server 2008 R2 n As a downloadable add-on from the Microsoft Download Center for Windows XP, Microsoft Windows. .. the Windows Search service included in Windows Server 2008 Table 19-2  Versions of the Windows Search Service in Windows Server 2008 Windows Version Windows Search Version Windows Server 2008 R2 4.00.6001.16503 Windows Server 2008 SP2 4.00.6001.16503 Windows Server 2008 RTM 3.00.6001.18000 In addition, Windows Search 4.0 (version 4.00.6001.16503) is available for Windows Server 2008 as a downloadable... Version Windows 7 4.00.6001.16503 Windows Vista Service Pack 2 (SP2) 4.00.6001.16503 Windows Vista SP1 3.00.6001.18000 Windows Vista RTM 3.00.6000.16386 In addition, Windows Search 4.0 (version 4.00.6001.16503) is available for Windows Vista SP1 as a downloadable add-on from the Microsoft Download Center Search Versions Included in Windows Server 2008 Table 19-2 lists the different versions of the Windows. .. Print Management for Windows 7 at http://technet.microsoft.com /en-us/library/dd 878 494.aspx n “What’s New In Print and Document Services for Windows Server 2008 R2” at http://technet.microsoft.com/en-ca/library/dd 878 502(WS.10).aspx n The Windows Server 2008 Print Services section of the Windows Server TechCenter at http://technet.microsoft.com/en-ca/windowsserver/2008/dd448602.aspx n Windows TIFF IFilter... integrated into Windows Vista as a system service and platform for use by applications (including the 20 07 Microsoft Office system) Now WDS 4.0 is included as part of Windows Vista SP2 and Windows Server 2008 SP2 and is integrated into Windows 7 and Windows Server 2008 R2 Note for trivia buffs: Microsoft Office XP shipped a version of the indexing engine for use on Microsoft Windows NT 4 and Microsoft Windows. .. excluded in Windows 7: n %SystemDrive%\ProgramData\* (with some exceptions, such as %SystemDrive% \ProgramData \Windows\ StartMenu) n %SystemDrive% \Windows\ CSC\* (excludes the CSC for Offline Files) n %SystemDrive% \Windows. *\* (excludes any old Windows installation directories) n %SystemDrive% \Windows\ * (excludes the Windows directory) n *\System volume information\* n *\$Recycle.bin\* n %SystemDrive% \Windows\ *\Temp\*... Earlier Versions of Windows Windows Search, which was previously known as Windows Desktop Search (WDS), is currently available from the Microsoft Download Center in the following versions: n Windows Search 4.0 n WDS 3.01 n WDS 2.6.6 Windows Search 4.0 (version 4.00.6001.16503) can be installed on the following platforms: n n Windows XP SP2 or later versions n Windows Server 2003 R2 n Windows Server 2003... Indexing Service on Windows 2000) Windows Search Engine Processes The new Windows Search engine in Windows 7 and Windows Vista is based on the MSSearch indexing and search engine developed previously for SQL Server, SharePoint Portal Server, Microsoft Office SharePoint Server, and other Microsoft products The new Windows Search engine replaces the Indexing Service (Cisvc.exe) used in earlier Windows platforms, . to PrintBRM in Windows 7 and Windows Server 2008 R2 CSS Global Technical Readiness (GTR) Team P rintBRM has been enhanced in Windows 7 and Windows Server. Karen brings home a new Windows 7 laptop for her son to use in school. She decides to upgrade her old Windows XP desktop to Windows 7 at the same time. She