“Printer connections via GPO not applying” — troubleshoot user vs computer GPO

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Windows 11/10, Windows Server 2016/2019/2022, Group Policy, Printers, Networking

GPO printers not applying on Windows 11/Windows 10 — Group Policy Preferences, Point and Print, security filtering

Technician

Hey! Let’s fix your printer connections via GPO not applying. Tell me: are printers deployed using Group Policy Preferences (GPP) or classic Deployed Printers? Also confirm if the mapping is under User Configuration or Computer Configuration, and what print server and driver type (Type 3 or Type 4) you’re using.

Customer

Windows 11 clients, Windows Server 2019 print server. We use GPP Shared Printer under User Configuration. Users don’t see the printers after logon — GPO printers not installing. gpupdate doesn’t help.

Technician

Got it. Common reasons why GPO printer connections don’t apply in Windows 11/10:
• Point and Print restrictions or Package Point and Print blocks driver install (post‑PrintNightmare hardening).
• Wrong scope: user GPO linked to an OU with computers only (or vice versa) / missing security filtering and GPP item‑level targeting.
• The printer GPP action is Create/Replace with “Run in logged‑on user’s security context” unchecked, causing access denied to printer share.
• Outdated Type 3 driver or mismatched x64 package; spooler refuses install; Event Viewer shows 4098/4096 GPP errors.
• Loopback processing or conflicting Computer policy removes user mappings.
We’ll validate RSOP, permissions, PnP rules, and fix the GPP settings.

Customer

Where do I check if it’s a user vs computer GPO scoping issue?

Technician

Verify scope with RSOP:
1) On an affected PC, run gpresult /h C:\gp.html and open it. Confirm the GPP Printers policy shows under User Details → Applied GPOs.
2) If it’s missing, check the GPO link: the OU must contain the user accounts for User Configuration (or computers for Computer Configuration).
3) In the GPO, ensure Security Filtering includes the target users or groups and the computers have Read access so user policy can read the GPP. If using Loopback (Merge/Replace), confirm expected behavior.

Customer

The GPO shows applied, but printers still don’t map. We hardened printers after PrintNightmare. Could Point and Print restrictions be blocking it?

Technician

Very likely. On Windows 11/10, driver installs via the print server require trusted servers and admin prompts. Fix:
• Configure Computer Configuration → Administrative Templates → Printers → Point and Print Restrictions: specify your print server FQDN under Trusted servers, set installation to not require elevation for Package‑aware drivers.
• Enable Package Point and Print – Approved servers and add the print server(s).
• Use only packaged Type 3 drivers or modern Type 4 where possible. Re‑publish the shared printer with the packaged driver.

Customer

We’re using GPP with Replace. Some users lose printers at logon. Any best practice for the GPP action?

Technician

Yes. For stability, use GPP Shared Printer → Action = Update (not Replace) so existing mappings persist. Check Common:
• Tick Run in logged‑on user’s security context (user policy option) for user mappings.
• Use Item‑level targeting (IP range, AD site, Security Group) to scope per location.
• Avoid Remove this item when it is no longer applied unless you truly want auto‑cleanup.

Customer

Should we switch to Computer Configuration for lab PCs? Users are non‑admin.

Technician

For kiosks/labs, mapping via Computer GPO is reliable: printers follow the device regardless of who signs in. Steps:
• Move the GPP item to Computer Configuration → Preferences → Control Panel Settings → Printers and use Shared Printer with Action = Update.
• Link the GPO to the OU containing the PCs and filter with a Security Group if needed.
• If using Loopback (Replace) in the computer OU, keep printer mappings in Computer side to avoid user side being overridden.

Customer

Event Viewer shows 4098 GPP errors and “Access is denied” to \\PRINTSRV\Color_MFP. The share is published with a Type 3 driver.

Technician

Do this:
• Reinstall a packaged x64 Type 3 or Type 4 driver on the print server; tick Render print jobs on client computers only if required.
• Ensure users have Read on the printer share & Print permission in the printer’s Security tab.
• From a client, test manual connection: rundll32 printui.dll,PrintUIEntry /in /n \\PRINTSRV\Color_MFP. If it prompts for admin, Point and Print restrictions are still blocking.

Customer

Any quick checklist to get GPO printers installing reliably on Windows 11?

Technician

Quick checklist:
• Trusted print servers in Point and Print Restrictions GPO.
• Use packaged drivers (prefer Type 4 if features allow).
• GPP action = Update; enable Run in logged‑on user context for user mappings.
• Correct OU link, Security Filtering, and Item‑level targeting (site/subnet/group).
• Validate with gpresult, check Event Viewer → Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational and PrintService logs.
• For roaming users, consider mapping via Universal Print or Intune where appropriate.

Customer

After applying your changes, new logons get the printers. How do we remediate existing profiles that kept stale mappings?

Technician

Add a temporary GPP printer item with Action = Delete for the old queues (target by group/site), or run a one‑time logon script:
rundll32 printui.dll,PrintUIEntry /dn /n \\PRINTSRV\Old_Printer
Then ensure your production mappings use Update. Finally, gpupdate /force and log off/on.

Customer

Perfect. GPO printer connections are now consistent on Windows 11 and Windows 10. Thanks!

Technician

Summary: When printer connections via GPO are not applying, confirm User vs Computer policy scope with RSOP, allow drivers via Point and Print restrictions, deploy packaged Type 3 or Type 4 drivers, and set GPP to Update with correct item‑level targeting. Need hands‑on help? Open the chat.

Quick answer: the accepted fix

Accepted fix when GPO printers not applying (Windows 11/10): 1) Verify the GPO link, security filtering, and item‑level targeting for the correct User or Computer OU; 2) Configure Point and Print Restrictions with trusted servers; 3) Use packaged drivers (Type 3/Type 4) on the print server; 4) Set GPP action = Update and enable Run in logged‑on user context; 5) Refresh policy with gpupdate /force and check Event Viewer for 4098/4096 entries.

FAQ

Step‑by‑step (User policy)

1. In GPMC, edit the User GPO → Preferences → Printers → add Shared Printer with Action = Update.
2. On the Common tab, enable Run in logged‑on user’s security context and add Item‑level targeting (group/site/subnet).
3. Configure Computer → Admin Templates → Printers: set Point and Print restrictions and Approved servers.
4. Link the GPO to the users’ OU; in Security Filtering include the user groups; update policy with gpupdate /force.

Step‑by‑step (Computer policy)

1. Create a Computer GPO → Preferences → Printers → add Shared Printer (Action = Update).
2. Filter the GPO to the device OU; optionally use Loopback Processing for kiosk/lab OUs.
3. Install packaged drivers on the print server and republish the share.
4. Check client logs (GroupPolicy/Operational, PrintService) and validate mapping at next reboot/logon.

Sources

• Microsoft — Point and Print restrictions
• Microsoft — Print Spooler security guidance
• Microsoft — Allow Point and Print
• Microsoft — Group Policy Preferences

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.