Running the Print Server Role on a Windows Server VPS: Queues, Drivers, and Print-to-PDF

A print server on a virtual machine looks trivial and is not. The VPS has no parallel port, no USB host and no printer, and the Spooler runs in session 0 where it cannot show a dialog. It can hold queues, apply defaults, convert to PDF and give Group Policy one place to point 80 workstations at; it cannot do anything that needs a device attached. This covers the role on a Windows VPS hosting setup acting as a shared queue host.

When a VPS print server makes sense

It makes sense when the printers are network devices with their own IPs and the server is only a broker: queues, drivers, permissions, then forward over 9100 or IPP. No physical connection is needed, and the datacentre location is irrelevant as long as the VPN reaches the printers.

It makes no sense for USB-attached printers in an office with no always-on machine. Redirected printers over RDP and USB-over-IP tools technically work, but they introduce a dependency chain – RDP client, spooler redirection, driver on the server – with three failure points for every print job.

Session 0 and the spooler service

The print spooler runs in session 0, isolated from interactive logons. Adding a port or driver from an RDP console session works for an administrator, but a vendor “add printer” wizard started from a user session can hang waiting for a prompt it never receives.

The spooler also holds every queued job in C:\Windows\System32\spool\PRINTERS. If that folder accumulates files, the spooler is stuck; deleting them while the service is running is how you corrupt a queue. Stop the service first with Stop-Service Spooler -Force, clear the folder, then start it again.

Installing the role and the right drivers

From an elevated PowerShell prompt: Install-WindowsFeature Print-Server -IncludeManagementTools. On Server Core the role works fine and Print Management can be run from RSAT on a Windows 10 or 11 client against the server name. Install drivers with Add-PrinterDriver -Name "HP Universal Printing PCL 6" after staging the INF with pnputil /add-driver hpcu*.inf /install; the driver must be in the Windows driver store before the cmdlet finds it.

Prefer universal PCL6 or PostScript drivers over model-specific ones: version-agnostic, clean x64 installs, no five legacy DLLs per device. Keep the Render print jobs on client computers setting enabled – the server then receives a spool file it only has to pass on, which cuts server CPU and memory per job by an order of magnitude.

Per-user versus per-machine queues

A machine queue is the classic design: one printer object, many users, permissions and default preferences controlled by policy. A per-user queue gives each person their own printer object with private defaults and their own job history, at the cost of dozens of identical queues. On a VPS with 50 users, 50 queues and 50 drivers is unnecessary; on 500 users sharing one queue, the “last user’s duplex setting wins” complaint is real.

The middle ground that holds up: one queue per physical device, with Use printer defaults forced by policy and printer preferences locked down through the Printers GPO node. Reserve per-user queues for the two or three printers where defaults genuinely differ – label printers, cheque printers, and anything that must always be mono.

Point and Print driver policy

Point and Print lets a client install the server’s driver with one click and no admin rights, which is convenient and was the vector for PrintNightmare. The current guidance is to restrict it to specific servers and approved drivers: RestrictDriverInstallationToAdministrators = 1 under HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint, plus a defined PackagePointAndPrintServerList.

If clients must install without admin rights, set PointAndPrint RestrictDriverInstallationToAdministrators to 0 only on machines in the approved list and only with UpdatePrinterSettings and TrustedServers configured. Check what actually got applied with Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint", because the legacy keys still exist on some systems and confuse auditing.

Print-to-PDF and XPS as server-side queues

Microsoft Print to PDF is a client feature, not something the server role exposes usefully – a job printed to it on a VPS lands in session 0 and prompts the interactive user, which is nobody. The workable approach is a third-party PDF port monitor or a virtual printer whose output folder is a shared path, so jobs convert and appear as files.

Better still, do not print at all: use a script or an application export that writes PDF directly, and keep the print server out of the path. Where a PDF queue is unavoidable, point it at a folder on a data disk with a quota, name files by %u_%t.pdf, and let a scheduled task move them to the client-visible share, so a failed job cannot fill the system disk.

Ports, port monitors and LPR

Network printers use the Standard TCP/IP port (RAW 9100) or IPP. LPR through the LPR Port Monitor still exists for old print servers and mainframe gateways, but adds RFC 1179 overhead for no benefit on modern hardware.

Add ports with Add-PrinterPort -Name "10.20.4.31_9100" -PrinterHostAddress 10.20.4.31 -PortNumber 9100 and then create the queue with Add-Printer -Name "Floor2-Mono" -DriverName "HP Universal Printing PCL 6" -PortName "10.20.4.31_9100" -Shared -ShareName Floor2-Mono. Give each port a static printer IP; DHCP reservations that change after a power event are the most common cause of “printer offline” tickets.

What breaks with RDP-redirected printers

Printer redirection over RDP creates a queue named like HP LaserJet (from DESKTOP-12) in session 3 inside the user session. It exists only while the session lives, it is invisible to other users, and its driver is the client’s edition – often the wrong architecture or a version the server does not have, which is why the server declines the connection and the device simply does not appear.

Enable Easy Print or install matching x64 drivers before blaming the client, and accept that redirected printing is for convenience, not for a managed queue. If users need reliable printing from a remote session, publish a proper shared queue on the print server and map it by policy rather than relying on redirection.

Cleanup jobs, spooler hangs and stuck queues

Jobs that never complete block everything behind them. Find them with Get-PrintJob -PrinterName "Floor2-Mono" and remove with Remove-PrintJob -PrinterName "Floor2-Mono" -ID 12. A job stuck in “Deleting” usually means the spool file is locked; restart the spooler and clear spool\PRINTERS with the service stopped.

Prevent the worst case: cap the spooler folder with a scheduled check, enable spooler restart-on-failure recovery so a hung queue does not need an RDP session on a managed Windows server at 2 a.m., set the queue to Keep printed documents off so the spool file is deleted after success, and add the print server to monitoring with a probe that submits a one-page text job every 15 minutes and alerts if it does not reach “Printed”.

Deploying queues to clients with Group Policy

Under User Configuration, Preferences, Control Panel Settings, Printers, add a Shared Printer action pointing at \\srv-print\Floor2-Mono. Set it to Update, not Create, so changes replace the existing queue. Add a delete rule for retired queues, or clients keep a dead queue forever.

Also set the default printer in the same GPO rather than letting Windows “manage your default printer”, which on Windows 10 and 11 switches defaults based on last use and generates the same complaints every week. Verify with Get-Printer | Select Name,DriverName,PortName,Shared on a client after a policy refresh, and check gpresult /r lists the printer GPO.