How to restrict printers to specific users on a Remote Desktop Terminal Server?

Question

I have a Windows 2016 Terminal Server T1, where 50 users connect via Remote Desktop. The Terminal is connected to a domain and the users are in the Active Directory.

I have 5 IP-based network printers on T1. 5 users use Printer P1. 5 other users use Printer P2, and so on.

Right now, all 5 printers are visible to all 50 users. They can print any document to any printer. I need to restrict this access. Each user should only see the printer they are authorized for.

Can you suggest a scalable way to achieve this using Windows' built-in functionality? By scalable, I mean:

• I want to avoid adding each user to the printer. (Users come and go. With every new user, I do not want to assign permissions in Printer settings repeatedly. I prefer adding the user to a group in AD at the time of user creation. The group can have access to the printer).

• If I add Terminals T2, T3, in the same domain, I don't want to redo the settings for every user in each terminal. I want to assign permissions for the group only.

What I have tried:

• I created a Security Group (Global) in the AD. I named it PRINT_P1. I added 5 users to it.
• I went to Devices and Printers in T1 -> Printer P1 -> Security ->
• Removed Everyone from the list
• Added PRINT_P1 -> Print - Allow.

Result: The printer P1 is visible only to the 5 users, not visible to the other users. The same applies for other terminals T2 and T3. It seems to satisfy the requirement. But when I print, it shows "Sent to Printer", then the job disappears, and nothing prints. Have I missed something or is this another problem?

Edit: When I checked the Event Viewer, I am getting this error every time I print: Faulting application name: printfilterpipelinesvc.exe, version: 10.0.14393.7254, time stamp: 0x66ac6f56. Faulting module name: hpxtpsdrvf8.dll

Edit 2: I removed and reinstalled the printer driver for P1. I am still getting the error in Event Viewer: Faulting application path: C:\Windows\system32\printfilterpipelinesvc.exe Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\hpxtpsdrvf8.dll When I add the permissions to Everyone, this error does not come and printing works fine.

Answer 1

You have a faulty print driver inside one of your terminal server. Thats your problem.

As you did the correct method by removing the Everyone security group from the printers and add a security for both printer. Add peoples you want to use them by assigning the security group. I do the same method on TS I manage, even with over 50+ printers. I install the printmanagement console if you want to import/export your printer correctly between your TS.