Remove Everyone Group From Shared Printer
Prevent Users From Adding Printers Willy-Nilly
by JP Davy - November 4th, 2021
Recently, at work, we've been replacing older servers with newer ones, and along with that reorganizing our deployed printers. I was in charge of setting up the new printer shares, but starting having some issues when it came to Shared Printer Security. Here is what I found.
Are you getting a print error when you are trying to print to a shared printer on a print server? Do you have the Everyone group removed from the Security tab on the shared printer? Do you get the error even when you're a Domain Admin with full privileges on the shared printer?
The Problem - Printer Error When Everyone Group is Removed From Shared Printer
If you want to keep Everyone from printing to it, you would expect removing the Everyone group (not Denying the Everyone group, just removing the group from the list) would do this. And it does. Unless your printer was added to the print server using the WSD port, which then causes this basic expected functionality to break!
When you add a Network Printer to the print server, Windows tries to be smart and, if the printer supports it, use the WSD port equivalent for that device. WSD can be good for home users who are not statically setting the IP Addresses on their printers. But for a company with an IT Admin, WSD is a nightmare. You can google this on your own time and read the complaints of other IT Admins. I'm not sure why Microsoft would include this "feature" in a server environment.
The Solution - Add TCP/IP Port Back To Printer Share
It took me a while to figure this problem out. I kept searching the web and finding solutions related to Group Policy Objects, and Print Spooler restarts. None of those solutions worked. Even as a Domain Admin I could not get a test page to print to the shared printer. Here's what did work.
When you right-click the shared printer, and go to Properties, on the Port tab see if your printer port has changed from a TCP/IP port, to a WSD port. If it has changed, you simply need to click Add Port > Standard TCP/IP and type in the IP Address of the printer. Windows will check it, and then add the port as a Standard TCP/IP port this time. And that's it.