Granular Printer Mapping with TruGrid and Group Policy Preferences

Group Policy Preferences (GPP) can give each Active Directory workstation or RDS host its own set of network printers, so TruGrid users get the printers that match the machine they connect to. This is the GPO-based counterpart to the Printer assignments policy used in Citrix environments.

A Citrix Printer assignments entry pairs a client name or IP range with a default printer and a list of session printers. Each part has a GPP equivalent:

One difference matters: Citrix matches the client device, while this method matches the computer name of the machine the user connects to. Group Policy processes on that machine when the session signs in.

Three pieces work together:

Item-level targeting only filters printer items. It does not bring a GPO into scope, so without the OU link and loopback no targeting rule makes printers appear.

Requirements

The target machines must be domain-joined, and you need rights to create and link a GPO.

• Each printer is already shared on a Windows print server, and the share names are confirmed.
• Workstations can resolve the print server by name (DNS) and reach it over SMB.
• Users have Print permission on each printer share (Everyone or Authenticated Users by default).
• The workstation computer accounts sit in an OU where you can link the GPO. Use a dedicated OU if loopback should not affect other computers.
• You have an account that can create and link GPOs, and a machine with Group Policy Management (RSAT).

Printer drivers

Standard users cannot install printer drivers through Point and Print by default since the 2021 PrintNightmare updates (KB5005652). Use one of these approaches:

• Pre-install the approved drivers on the workstations with your RMM or software deployment tool, or with a startup script: pnputil /add-driver <driver>.inf /install.
• Use package-aware drivers with your organization's approved Package Point and Print / approved servers policy.

Do not weaken Point and Print security globally (for example, setting RestrictDriverInstallationToAdministrators to 0) just to deploy printers.

Build sheet

Build a printer assignment matrix for the client before touching Group Policy. It doubles as the test plan. Example:

Configuration

Build one GPO with loopback enabled and one Shared Printer item per printer, each targeted by computer name.

1. Create and link the GPO

1. On a machine with Group Policy Management, run gpmc.msc.
2. Expand the forest and domain, and find the OU that holds the target workstation computer accounts.
3. Right-click the OU and select Create a GPO in this domain, and Link it here.
4. Name the GPO (for example, Deploy Selected Printers - Workstations) and click OK.
5. Leave Security Filtering at the default (Authenticated Users). If you narrow it, computer accounts must keep Read and Apply group policy, and Authenticated Users or Domain Computers must keep Read.
6. Right-click the GPO and select Edit.

2. Enable loopback processing (Merge)

1. Browse to Computer Configuration > Policies > Administrative Templates > System > Group Policy.
2. Open Configure user Group Policy loopback processing mode.
3. Select Enabled and set Mode to Merge, then click OK.

Merge keeps each user's normal user policies and adds this GPO's user settings on these workstations. Replace discards the user's normal user policies on these workstations, so use it only when that is intended.

3. Add the first Shared Printer

The Shared Printer item exists only under User Configuration. Under Computer Configuration, GPP offers only TCP/IP Printer and Local Printer.

1. Browse to User Configuration > Preferences > Control Panel Settings > Printers.
2. Right-click Printers and select New > Shared Printer.
3. On the General tab, set Action to Update. Update creates the connection if missing and updates it if present. Replace deletes and recreates it at every refresh.
4. In Share path, enter the UNC path, for example \\PRINT01\HP-Accounting.
5. Optional: check Set this printer as the default printer only if it should be the default on every workstation the item targets. With Update, this re-applies at each refresh and overrides the user's own default.
6. Open the Common tab and check Item-level targeting.
7. Optional: check Remove this item when it is no longer applied to remove the printer automatically when the workstation stops matching. This forces the item into Replace behavior.
8. Click Targeting, then select New Item > Computer Name.
9. Enter the workstation name (for example, SPRINTER01) and choose Use NetBIOS name. Choose Use DNS name only if you enter the FQDN.
10. Click OK to close the Targeting Editor, then OK to save the item.

4. Give one printer to several workstations

Targeting items combine with AND by default. A computer has one name, so two Computer Name items joined with AND never match. Switch them to OR:

1. Open the printer item, go to the Common tab, and click Targeting.
2. Add a Computer Name item for each workstation that should get the printer.
3. Select each item after the first and choose Item Options > Or.
4. Confirm the tree reads: the computer name is SPRINTER01 OR the computer name is SPRINTER02.
5. Click OK and save the item.

5. Add the remaining printers

Repeat steps 3 and 4 for every printer in the matrix. Only the items you create are deployed, so this does not connect every printer on the print server. The example finishes with four items:

Verification

Test on one workstation first, signing in as a standard user through TruGrid, before relying on the policy.

1. Pick a test workstation in the OU where the GPO is linked.
2. From an elevated Command Prompt on that workstation, run gpupdate /force.
3. Restart the workstation once so loopback takes effect.
4. Sign in as a normal (non-admin) user, locally or through TruGrid.
5. Open Settings > Bluetooth & devices > Printers & scanners (Windows 11) or Settings > Devices > Printers & scanners (Windows 10). Confirm the printers from the matrix appear and no unrelated printers were added.
6. Sign in to a different targeted workstation with the same user and confirm the printer set changes to match that workstation.

Review what applied:

gpresult /scope computer /r
gpresult /scope user /r
mkdir C:\Temp 2>nul
gpresult /h C:\Temp\gpresult.html

The first line shows the GPO applying to the PC, the second shows user settings arriving through loopback, and the last writes a full HTML report. Create C:\Temp first or the report command fails.

Where to look

Troubleshooting and TruGrid session notes

Most problems come from GPO scope, loopback timing, or targeting logic, so check those first.

TruGrid session behavior

• Redirected printers also appear. If client printer redirection is allowed, the user's local printers show up in the session, typically marked redirected. They are separate from the GPP printers and this GPO does not control them.
• Default printer. By default, an RDP session may set the client's default printer as the session default. To keep the GPP default, enable Do not set default client printer to be default printer in a session under Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Printer Redirection.
• Limiting the session to office printers. Review the redirection options available for the tenant and the RDS policy Do not allow client printer redirection. Confirm the client's requirements before turning redirection off.
• Targeting uses the remote machine name. Enter the name of the workstation or RDS host the user connects to, not the name of the home PC or laptop running the TruGrid client.

Symptoms and fixes

Removing a printer later

• Preferred: check Remove this item when it is no longer applied on the item, then change or remove the targeting.
• Alternative: create a Shared Printer item for the same UNC path with Action = Delete, targeted at the affected workstations, and leave it in place until all machines have refreshed.

Updated on: 20/10/2026