Urgent security message for all NG/MF customers
While I was a member of the Windows print spooler test team at Microsoft, one of my side tasks was to support Microsoft IT with their deployment of prerelease operating systems that hosted the print infrastructure at the main campus in Redmond. I provided support for IT when it came to printing at Microsoft and during this time, learned many lessons.
Many of the guidelines I learned should help you to make your infrastructure reliable and simplify the print experience for the end users printing through your environment. The following information is primarily intended for Windows print server administrators.
Setting up the machine to be the print server
Before adding printers to a server, you should:
- Disable printer redirection on any dedicated print server. This will cause a failure in the spooler service when print drivers not written for enterprise environments get installed due to printer redirection. Follow the guidance from Microsoft regarding this configuration on the machine.
- Move the spool directory so it is not under Windows. If you have another physical or virtual disk on the system, move spool files to this location so large spool files do not reside on the same disk as the operating system’s page file.
- Enable print driver isolation in shared mode for all Type 3 print drivers.
- Add the Print and Document Services role. Adding this role sets up the remote endpoint for sharing printers and adds the tools you will use to administer the printers on the machine.
If you do not want to add the Print and Document Services role, you should at least install print management tools. The following command run in an elevated command window installs PrintManagement and PrintBrm printer migration utility:
Dism /online /enable-feature /featurename:Printing-AdminTools-Collection
Printer setup
Proceeding through the Add Network Printer Wizard, you should take the following into consideration:
- Using WSD ports in enterprise scenarios can be problematic. In a DHCP environment, I have found that it is harder to determine the root cause of issues due to the limited methods to determine the actual IP of the device.
In the Add Network Printer Wizard, select the “Add a TCP/IP or Web Services Printer by IP address or hostname”, then “TCP/IP Device”
- I like Windows Update for print drivers. There are specific test requirements to have drivers posted to Windows Update that are not required for drivers from the print vendor site. I am sure vendors test their print drivers more thoroughly when they are released to any external source.
- Avoid setup.exe installers. These setup programs sometimes install other components that are not needed on a machine hosting an organization’s print infrastructure. If you have a relationship with a hardware vendor, ask for an INF based installer.
- Sometimes the vendor provides only a setup.exe or some other self-extracting executable. Typically, setup installers unpack the files to the user’s %temp% path. I generally copy these files to a network share, which I use for installing the driver using Have Disk in the Add Printer Driver Wizard or the Add Network Printer Wizard.
- Simplify your printer naming convention. Try to plan this in accordance with what makes sense for your organization. I avoid printer names with spaces, but I understand the need for this in many configurations. Attempt to keep the share names as one word, particularly in organizations with operating systems other than Windows.
- After you have set up your printers, disable language monitor software. Language monitors are loaded by the print spooler service. Any failures in this software can cause a failure in the print spooler service, which will affect all printing on the machine. In most cases, you can disable language monitors by clearing the Enable bidirectional support check box on the Printer Properties, Port tab.
Maintaining a healthy print server
After you have set up your print server and given it life, as time rolls on and changes occur in your environment, you will need to periodically make sure it stays healthy. Some of the tips I have learned are:
- Limit the number of print drivers. Clean up any unused print driver packages. Deleting the print driver removes the driver from the print spooler. Removing the print driver package also removes the driver from Windows DriverStore directory. Be careful not to inadvertently remove 32-bit drivers.
- Delete unused ports as the spooler service will perform an SNMP query to the IP for device status. When the IP no longer points to a device, the spooler retains the port in the list and will query the device, then timeout before continuing to the next port.
- Test the print drivers with the applications used in your organization. If you uncover problematic documents, keep these if the content is acceptable, so they can be used to test the next print driver version or operating system.
- When deploying 64 bit and 32 bit print drivers, use the same driver versions (for example, PCL 6 version 4.2.3 for both drivers).
- Client load can be a limiting scalability factor for a print server.
Thanks for taking the time to review my brief wordings on Print Management. Some of these suggestions may already be utilized in your environment and I hope the information presented is clear. My goal is to help you configure a durable Windows print infrastructure. Establishing a solid print foundation prior to installing PaperCut is always a best approach.
