How to replace your print server (and when not to)

What a print server does

A print server sits between people and printers. On a typical Windows network it does five things:

1. Shares printers. People add a printer from the server instead of by IP address.
2. Hands out drivers. When someone adds a shared printer, their computer downloads the driver from the server (Microsoft calls this Point and Print).
3. Queues jobs. Jobs wait on the server and go to the printer in order.
4. Applies policy. Who can use which printer, default settings like two-sided printing.
5. Records usage, often through print management software installed on it, which is also where secure release and billing live in many offices.

Every one of those jobs is still useful. The question is whether a server you maintain is the best place to do them.

Why offices are moving away from them

The Print Spooler became a security problem

In 2021, a set of vulnerabilities in the Windows Print Spooler, the service behind Windows printing, became known as PrintNightmare. One of them, CVE-2021-34527, allowed remote code execution with system privileges. Microsoft released emergency updates in July 2021, and its advice for systems that didn’t need to print included disabling the Print Spooler service altogether.

In August 2021, Microsoft changed the default behavior of Point and Print: installing or updating printer drivers from a print server now requires administrator rights. That closed a door for attackers, and also broke the main convenience of print servers, letting people add printers themselves. Many offices found that every new printer or driver update now needed IT.

Printer drivers are on their way out

Microsoft announced in 2023 that it is ending servicing of third-party printer drivers through Windows Update over several years, in favor of its built-in IPP class driver for Mopria-certified printers. Windows 11 also has an optional “Windows protected print mode” that only uses that built-in printing. Existing drivers keep working, but the direction is towards driverless printing, which doesn’t need a server to hand out drivers.

Work doesn’t happen on one network anymore

Laptops come and go, contractors and visitors bring their own devices, and many companies no longer run a domain at all. A print server works best when every device is joined to the same Windows network, which is less and less true.

It’s one more server

A print server needs patching, backups, monitoring and someone who understands it. When it’s down, nobody prints.

Serverless printing: the options

“Serverless printing” covers several different setups. They solve different parts of the problem:

A general comparison. Individual products differ; check what each one installs and where it keeps jobs.

Direct IP printing is the cheapest, but you’re back to installing drivers everywhere, with no release and no record of who printed what. Built-in driverless printing is excellent for a small office on one network, with the same gaps. Cloud print management and browser printing keep the parts of a print server that people actually valued, release and tracking, without the server.

When a print server still makes sense

A print server is the right tool in some cases. Keep one, or keep part of one, if:

• Applications print, not people. ERP systems, warehouse label printers and other line-of-business software often print to a server queue from another server.
• You depend on driver-only features. Booklets, stapling, hole-punching or special trays on large multifunction printers sometimes only work with the manufacturer’s driver.
• Your printers need drivers. Older printers without IPP Everywhere, AirPrint or PDF support can only be shared the old way.
• You have a working setup and a domain. If every device is managed, the server is patched and people are happy, there may be nothing to fix.

It doesn’t have to be all or nothing. Many offices move people to serverless printing and keep a small server, or a direct queue, for the applications and printers that need it.

How to replace it, step by step

1. List what prints through the server. Every queue, every printer, and every application or server that sends jobs to it. The server’s own logs show which queues are used.
2. Check which printers are driverless. The free printer checker asks each printer on the network what it supports and gives a verdict, without printing anything.
3. Decide what stays. Application printing, driver-only finishing and printers that need drivers. Everything else can move.
4. Choose release per printer. Printers in shared areas usually get secure release; a printer in a private office can print straight away. See What is pull printing?
5. Pilot with one printer and one team. A week is usually enough to find the documents that print differently.
6. Move people over. Share the print page, put a QR code on each printer, and remove the old shared printers from devices with group policy or device management.
7. Lock the printers down so the old route stops working (next section).
8. Retire the server, or shrink it to the queues that still need it.

Stop people printing around it

If the printers stay reachable on the network, people will keep printing to them directly, and your release and reports will miss those pages. Options, from simplest:

• Turn off the protocols you don’t use on the printer’s own settings page (for example raw port 9100 and LPD), and the printer’s own Wi-Fi Direct.
• Put printers on their own network segment that only the print service can reach.
• Plug printers into a device that hides them. The Commontray Box has a printer port: printers plugged into it have no address on the shared network, so nothing but Commontray can reach them.

Where Commontray fits

Commontray is browser printing with release and tracking built in. It runs as one small service on a computer at your site (Windows, macOS or Linux), or on the Commontray Box, and talks to your printers directly over IPP. There’s no print server, no driver on anyone’s device, and no inbound port to open.

• People print PDFs, photos and Office files from any browser.
• Documents wait until their owner releases them at the printer.
• Every job is recorded against a person, after the printer confirms the pages.
• Commontray updates itself at night and only accepts updates signed with its release key.
• Works with printers that take PDF or support IPP Everywhere.

Commontray for offices   How Commontray handles security