Map shared printers to users with a Group Policy Preferences (GPP) Shared Printer item under User Configuration, set the action to Update, and use item-level targeting to send each group only the printers it needs.

GPP printer items run in the user’s context at logon and on each background refresh (about every 90 minutes). The client reads the GPO, checks any targeting rules, and connects to \\printserver\sharename through Point and Print, which pulls the driver from the print server. Because of the 2021 PrintNightmare hardening, driver installation is the step most likely to fail; see Prerequisites and Troubleshooting.

Prerequisites

Confirm all five before building the GPO; a missing driver or share permission is the cause of most failed mappings.

• Print server ready. Each printer is installed and shared on the print server (Print Management → Printers → Properties → Sharing). Note the exact UNC path, e.g. \\PRN01.corp.example.com\HR-Floor2-MFP.
• Share permissions. The target users or groups have Print permission on the printer (Security tab). Everyone: Print is the Windows default.
• Drivers staged on clients. Since the August 10, 2021 updates, non-admins can no longer install printer drivers through Point and Print by default (KB5005652). Pre-install the drivers on clients (OS image, Intune/ConfigMgr package, or a computer startup script running pnputil /add-driver). If the driver is already on the client, the user mapping succeeds without elevation.
• OU and groups. The users who should get printers sit in an OU the GPO can be linked to, and you have a security group per printer or per site (e.g. PRN-HR-Floor2) for targeting.
• Rights. You can create and link GPOs (Domain Admins, or delegated Create GPOs + Link GPOs on the OU).

Keep Microsoft’s default (RestrictDriverInstallationToAdministrators = 1, set by the policy Limits print driver installation to Administrators). The KB is explicit that no combination of other mitigations is as safe as that default. If you must allow non-admin driver installs, set it to 0 only together with Point and Print Restrictions limited to your print server FQDNs and Package Point and Print – Approved servers.

How it works

[embed: node/d814fe03-7892]

The GPO tells the PC which share to connect to; the connection completes only if the driver is already installed, otherwise the user sees a UAC prompt or event 4098.

Procedure: create the printer GPO

One GPO can hold every printer for a site; targeting (next section) decides who gets which.

1. Create the GPO. Open Group Policy Management (gpmc.msc). Expand Forest → Domains → corp.example.com → Group Policy Objects, right-click → New, name it USR - Printers - <Site>.
2. Open the editor. Right-click the new GPO → Edit.
3. Go to the Printers node. User Configuration → Preferences → Control Panel Settings → Printers.
4. Add the printer. Right-click Printers → New → Shared Printer.
5. Fill in the General tab (illustrated below):
   • Action: Update — creates the connection if missing and corrects it if changed, without removing it on every refresh. Use Replace only when you need to force a clean re-map; Delete removes the connection.
   • Share path: the full UNC path, e.g. \\PRN01.corp.example.com\HR-Floor2-MFP. Use the FQDN so it matches any Point and Print server list.
   • Default printer: tick Set this printer as the default printer if wanted, and also tick Only if a local printer is not present so users with a desk printer keep it.
   • Local port: leave blank unless a legacy app prints to an LPT port.
6. Fill in the Common tab. Tick Run in logged-on user’s security context (shared printer items run as the user by default; ticking it makes this explicit). Tick Remove this item when it is no longer applied if the printer should disappear when a user leaves the group (this forces Action = Replace). Tick Item-level targeting → Targeting… to add rules (next section).
7. Repeat steps 4–6 for each printer, then close the editor.
8. Link the GPO to the users’ OU: right-click the OU → Link an Existing GPO… → pick the GPO. Leave Security Filtering at Authenticated Users and let targeting do the per-group work.

[embed: node/cca499c8-d906]

Schematic of the dialog in step 5: Action, Share path and the two default-printer boxes are the settings that matter; Common tab options are set in step 6.

Apply and verify

Test on one pilot user in the target group before telling the site; a pass is the printer listed in Settings and the GPO under Applied Group Policy Objects.

1. Refresh policy on the client as the test user:

gpupdate /force

Sign out and back in if the printer does not appear; some connections only complete at logon.

2. Confirm the GPO applied:

gpresult /r /scope:user
gpresult /h C:\Temp\gp.html   # full report: Settings > Printers shows each item and its result

3. Confirm the printer mapped:

Get-Printer | Where-Object Type -eq 'Connection' | Format-Table Name, ComputerName, DriverName

Or open Settings → Bluetooth & devices → Printers & scanners.

4. Check the event log if it is missing: Event Viewer → Windows Logs → Application, source Group Policy Printers. An Information event means success; event 4098 (Warning) carries the error code — look it up in Troubleshooting below.
5. Remote check (admin): in GPMC, right-click Group Policy Results → run the wizard for the user and computer to read the same report without visiting the desk.

Troubleshooting

Most failures are a missing driver, a wrong path or a targeting rule that does not match; start with event 4098 in the Application log.

Quick reference