Printers in Group will not install on users laptop

Question

Printers in Group will not install on users laptop

Michelle Braund 0

My user cannot get printers to install on his computer. I've got a print server, in Azure everything is set up for the printers with universal print. I've got 3 groups for printing and they work, except in odd cases where the user will have some but not all of the printers and I can't push those that didn't flow through. I've tried removing them from the group, waiting a couple of hours and then adding them to the group. And I can't install the printers locally as I don't have permission as the user and if I install it as admin and then switch back to the user, they still don't have the printer.

I need some guidance. We have Microsoft 365 E5, and while I am the admin, I had help setting everything up, but a very security conscious individual. Meaning I can only do things in certain ways.

Pauline Mbabu 1,835 Reputation points Microsoft Employee

2026-04-17T15:09:28.02+00:00

Hello Michelle,
What you are seeing is an issue where user scoped printer provisioning can partially fail or stall for a specific profile even though group assignments are correct, especially in high security environments where driver and elevation paths are restricted. Universal Print printers are installed per user and rely on the Printer Provisioning CSP plus Windows enrollment state, Entra ID token health, licensing, and OS readiness, so when a user gets only some printers it usually points to a client side provisioning failure rather than a server or group issue. The most effective guidance is to first confirm the user has a valid Universal Print license and that the device is fully Entra ID joined and healthy, then check the Universal Print event logs on the client to see if the missed printers show installation or authentication errors, as Intune will not retry indefinitely once a provisioning attempt fails. Removing and re adding group membership often does not re trigger the install unless the printer provisioning profile itself is re evaluated or the user profile cache is cleared. Because local admin installation is intentionally blocked in Universal Print, installing as admin will not make the printer available to the standard user, which is expected behavior. In these cases Microsoft recommends validating OS version and updates, restarting the Print Spooler and Universal Print related services, signing the user out and back in to refresh Entra tokens, and reassigning the printer through Intune rather than manually installing it. If the issue persists for a single user while others work, opening a Microsoft support case is the supported path since cleanup of a stuck Universal Print installation requires backend remediation. Relevant documentation can be found at https://learn.microsoft.com/en-us/universal-print/fundamentals/universal-print-troubleshooting-support-howto

1 answer

Your answer

Pauline Mbabu 1,835 Reputation points Microsoft Employee

2026-04-17T15:09:28.02+00:00

Hello Michelle,
What you are seeing is an issue where user scoped printer provisioning can partially fail or stall for a specific profile even though group assignments are correct, especially in high security environments where driver and elevation paths are restricted. Universal Print printers are installed per user and rely on the Printer Provisioning CSP plus Windows enrollment state, Entra ID token health, licensing, and OS readiness, so when a user gets only some printers it usually points to a client side provisioning failure rather than a server or group issue. The most effective guidance is to first confirm the user has a valid Universal Print license and that the device is fully Entra ID joined and healthy, then check the Universal Print event logs on the client to see if the missed printers show installation or authentication errors, as Intune will not retry indefinitely once a provisioning attempt fails. Removing and re adding group membership often does not re trigger the install unless the printer provisioning profile itself is re evaluated or the user profile cache is cleared. Because local admin installation is intentionally blocked in Universal Print, installing as admin will not make the printer available to the standard user, which is expected behavior. In these cases Microsoft recommends validating OS version and updates, restarting the Print Spooler and Universal Print related services, signing the user out and back in to refresh Entra tokens, and reassigning the printer through Intune rather than manually installing it. If the issue persists for a single user while others work, opening a Microsoft support case is the supported path since cleanup of a stuck Universal Print installation requires backend remediation. Relevant documentation can be found at https://learn.microsoft.com/en-us/universal-print/fundamentals/universal-print-troubleshooting-support-howto

Answer 1

Use these checks to narrow down why some Universal Print printers from the group are not appearing/being installed for the user.

Verify the user can discover printers at all

On the user’s Windows device, go to Settings → Devices → Printers & scanners → Add a printer or scanner.
If no Universal Print printers appear:
1. Confirm the PC is joined or connected to Microsoft Entra ID using dsregcmd /status /verbose /debug and ensure one of these is true:
  - Device State – AzureAdJoined: YES and SSO State – AzureAdPrt: YES, or
  - User State – WorkplaceJoined: YES.
2. Confirm the user has a Universal Print license assigned.
3. Make sure the user is not still part of a Hybrid Cloud Print deployment by checking and deleting (if present) the registry key:
  - Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\<SID>\EnterpriseCloudPrint
4. Check that the user does not have multiple work accounts configured under Settings → Accounts → Access work or school. If the device is Entra-joined, remove additional work/school accounts; if it is not Entra-joined, keep only the account from the organization that owns the printers.
5. Ensure network access to Microsoft Graph for Universal Print:
  - Confirm Internet and *.print.microsoft.com are not blocked.
  - If a proxy is required, configure it with netsh winhttp set proxy ipaddress:port.

Verify the user has access to the missing printer shares For each printer the user is missing:
In the Universal Print admin portal, go to Printer shares.
Open the relevant printer share.
Confirm the printer is actually shared (Printer Share Name has a value).
Under Manage → Access Control, verify the user (or a security group the user belongs to) is listed. If not, add the user or group.

If the user cannot discover any printer, use steps 1 and 5 from the “User is unable to discover any Universal Print printer” section; if the user can discover some but not all printers, use the “User is unable to discover a specific Universal Print printer” checks.

Check the “top 10 proximity” behavior If the user has access to more than 10 printers, Windows only shows the first 10 printers reported by Universal Print, based on proximity to the user. If the missing printers have no location properties configured or the Windows location service is disabled on the user’s PC, they may not appear in the automatic discovery list.

Actions:

In the Universal Print portal, ensure location properties are set correctly for each printer (see Manage printer location settings in the referenced article).
On the user’s PC, ensure Windows 10/11 location service is enabled (see How to control location settings in the referenced article).
If still not visible, have the user search manually for the printer in the Add a printer or scanner dialog.

If using Intune/Endpoint Manager to push printers If printers are being deployed via the Universal Print printer provisioning tool and Intune:
Confirm the printers.csv file is present on the user’s device in the correct path for the deployment level:
- User-level: %AppData%\UniversalPrintPrinterProvisioning\Configuration
- Device-level (x64): %ProgramFiles(x86)%\UniversalPrintPrinterProvisioning\Configuration
- Device-level (x86): %ProgramFiles%\UniversalPrintPrinterProvisioning\Configuration
Open printers.csv and verify that the missing printers’ ShareID values (not PrinterID) are listed.
Check the PrintProvisioning event log on the client under:
- Applications and Services Logs → Microsoft → UniversalPrint
- Look for Event 3 with “The system cannot find the path specified.”
  - If present, either the user does not have access to that printer share or the CSV is using PrinterID instead of ShareID.
In Intune, verify the app deployment status for the provisioning packages and that detection rules are correct (for user-level deployment, detection rule path should be %AppData%\UniversalPrintPrinterProvisioning\Configuration with printers.csv as the file).
Consider VDI / shared PC behavior If the user is on Windows 10 in a VDI or shared PC environment:

Printers are installed per machine, so users may see printers installed by others, and printers do not roam between VMs. If the user logs into a different VM, printers must be reinstalled there.
For a more consistent experience, Windows 11 multi-session 22H2 and later has improved behavior for Universal Print in multi-session environments.

If printers were replaced or swapped If a physical printer was replaced, use the Swap printer feature in the Universal Print portal on the printer share instead of pushing a new printer to users. This ensures users’ existing printer shares continue to work without reinstallation.

If, after these checks, the user still has only some printers, focus on:

Access Control on the missing printer shares.
Whether those printers are in the top 10 by proximity.
Intune provisioning logs and printers.csv content if using the provisioning tool.

References:

Share via

Printers in Group will not install on users laptop

1 answer

Your answer