Windows print server: printers, drivers and queues

Start DC01, SRV01 and CL01. Work on SRV01 as SAATLAB\Administrator in PowerShell as administrator.

1Install the Print Server role

On SRV01, run this:

Install-WindowsFeature Print-Server -IncludeManagementTools

You should see something like this:

Success Restart Needed Exit Code Feature Result
------- -------------- --------- --------------
True    No             Success   {Print and Document Services, Print Server, Print Management...

✅ Checkpoint: The Print Server role installed, and Print Management appears under Tools in Server Manager.

2Add the port, driver and printer

On SRV01, see which class drivers are available, then add the Finance printer:

Get-PrinterDriver -Name *Class* | Select-Object Name
Add-PrinterPort -Name IP_10.0.0.195 -PrinterHostAddress 10.0.0.195
Add-PrinterDriver -Name 'Microsoft PS Class Driver'
Add-Printer -Name 'Finance-Printer' -DriverName 'Microsoft PS Class Driver' -PortName IP_10.0.0.195 -Location 'Floor 2, Finance' -Comment 'Lab printer for Finance'
Get-Printer -Name 'Finance-Printer' | Select-Object Name, DriverName, PortName, Location, Shared

You should see something like this:

Name            DriverName                PortName      Location         Shared
----            ----------                --------      --------         ------
Finance-Printer Microsoft PS Class Driver IP_10.0.0.195 Floor 2, Finance False

If Get-PrinterDriver shows no PS class driver, use another class driver from its list, such as the IPP class driver, and keep the same name in the next commands. Class drivers ship with Windows, so clients won’t need to download anything.

✅ Checkpoint: Finance-Printer exists on SRV01 with the class driver and the IP_10.0.0.195 port, not shared yet.

3Share, publish and limit it to Finance

On SRV01, run this:

Set-Printer -Name 'Finance-Printer' -Shared $true -ShareName FinancePrn -Published $true
New-ADGroup -Name DL_FinancePrinter_Print -GroupScope DomainLocal -GroupCategory Security -Path 'OU=Groups,OU=SAATLAB,DC=saatlab,DC=internal'
Add-ADGroupMember DL_FinancePrinter_Print -Members GG_Finance
Get-ADObject -Filter "objectClass -eq 'printQueue'" -Properties printerName, location | Select-Object printerName, location

You should see something like this:

printerName     location
-----------     --------
Finance-Printer Floor 2, Finance

The printer is now an object in AD under SRV01’s computer object. To limit printing, open Print Management on SRV01, right-click Finance-Printer, choose Properties, Security. Remove Everyone, add DL_FinancePrinter_Print with Print allowed, and click OK.

✅ Checkpoint: Get-ADObject finds the published printer, and its Security tab lists DL_FinancePrinter_Print instead of Everyone.

4Connect Priya and print a test page

On CL01, sign in as SAATLAB\priya.sharma. You can also find the printer with Settings, Bluetooth & devices, Printers & scanners, Add device, then “The printer that I want isn’t listed” and “Find a printer in the directory”.

In PowerShell on CL01 (as Priya), connect and print:

Add-Printer -ConnectionName \\SRV01\FinancePrn
Get-Printer | Where-Object Type -eq 'Connection' | Select-Object Name, Type, ComputerName
'Lab test page from Priya' | Out-Printer -Name '\\SRV01\FinancePrn'

You should see something like this:

Name               Type       ComputerName
----               ----       ------------
\\SRV01\FinancePrn Connection SRV01

On SRV01, look at the queue:

Get-PrintJob -PrinterName 'Finance-Printer' | Select-Object Id, UserName, DocumentName, JobStatus

You should see something like this:

Id UserName     DocumentName             JobStatus
-- --------     ------------             ---------
 2 priya.sharma Lab test page from Priya Error, Printing, Retained

The job reached SRV01 under Priya’s name. Its status shows an error because nothing answers at 10.0.0.195; on a real network that’s the moment to check the printer is on and its IP address is right.

✅ Checkpoint: Priya has a connection to \\SRV01\FinancePrn and her job is in the queue on SRV01.

5Turn off the spooler on your domain controllers

On SRV01, check and disable the spooler on both DCs:

Invoke-Command -ComputerName DC01, DC02 -ScriptBlock {
    Stop-Service Spooler -Force
    Set-Service Spooler -StartupType Disabled
    Get-Service Spooler | Select-Object MachineName, Status, StartType
} | Select-Object PSComputerName, Status, StartType

You should see something like this:

PSComputerName Status  StartType
-------------- ------  ---------
DC01           Stopped Disabled
DC02           Stopped Disabled

DCs don’t host printers, so the spooler there is only attack surface. In Lesson 23 you’ll enforce this with Group Policy for every DC, and keep it running only on servers like SRV01 that really print.

✅ Checkpoint: Spooler is Stopped and Disabled on DC01 and DC02, and still running on SRV01.