Close Menu
Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Facebook X (Twitter) Instagram
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    • Home
    • Intune
    • Windows
      • Modern Workplace
    • macOS
    • Android
    • iOS
    • Automation
      • Logic Apps
      • Intune Monitoring
      • GitHub
    • Security
      • Passwordless
      • Security
    • Speaking
    • About me
    Peter Klapwijk – In The Cloud 24-7Peter Klapwijk – In The Cloud 24-7
    Home»Intune»Manage printer mappings on cloud-managed Windows devices
    Intune

    Manage printer mappings on cloud-managed Windows devices

    Peter KlapwijkBy Peter KlapwijkOctober 11, 2023Updated:January 6, 202455 Mins Read

    I was having some discussions lately after my session Our journey to a Modern Windows Workplace at the Workplace Ninja Summit. With several attendees of the summit, we discussed the challenges we have when moving from a traditionally managed Windows device (controlled with GPOs and Configuration Managed) to an Azure AD joined (Microsoft Entra joined) Intune-managed Windows device (Modern Windows workplace).

    A few challenges people have is how to handle automatically assigning group tags to Windows Autopilot objects when the company has multiple countries or business units. Or how to manage printer mappings or drive mappings for the end users. The drive or printer mappings might be considered as legacy you want to get rid of, but for a lot of companies that’s currently impossible, unfortunately.

    We sometimes need to be creative as we don`t have GPOs (GPO preferences) available and not everything can be done natively with Microsoft Intune. Most of the time by being creative and with some scripting, we can workaround our challenges. Although I’m certainly not a scripting guru (like a few of my colleagues), it might be interesting to share with other people how I’ve done printer mappings for a group of users.

    The solution

    The solution I use is a PowerShell script which is triggered via a scheduled task. Every time a user logs on to the device, the script is triggered, with a short delay of a few minutes. This way I know the connection to the domain is up and running.
    If your devices are not always connected to the domain, a better trigger might be on an event log item. An example is event ID 10000 which is found in the NetworkProfile events folder. This log entry is written to the event logs by a network change.

    The scheduled task starts a VBS script. The only thing the VBS script does is start another (PowerShell) script. This is to avoid any user-facing pop-ups because the scheduled task runs under Users.

    The PowerShell script that is eventually triggered, checks if the domain connection is available, and if that is the case, it connects the printer.

    If you counted correctly, you now know my solution consists of three scripts. I wrap these scripts as a win32 app and deploy this package as a required application with Microsoft Intune (tracked by the ESP) to our Windows devices.
    Depending on your needs, another package containing the printer driver might also be needed.

    The scripts

    Let`s walk through the different scripts involved.

    The script whose name ends on CreateScheduledTask, creates the scheduled task as the name already shows.

    First, the variables are set, from which you most likely want to change the company name.

    In the functions region, we define a ClaenUpAndExit function, which is also used for Intune detection when wrapped as a win32 package.

    Next, we handle copying the other two scripts to a local folder. The location is defined in the variables. In my case, the location is C:\Program Files\Common Files\CompanyName\PrinterMapping.

    In the last part, the script creates the Scheduled task.
    As you can see the trigger is AtLogon.
    It executes wscript.exe with an argument of the vbs script.
    I used the SID S-1-5-32-545 instead of a group name, to make sure the script not only runs correct on a device running an English OS.
    And a delay is set at 4 minutes.

    Then we have the vbs script whose name ends on ScriptRunFromTaskScheduler.vbs.

    As said, it only triggers the initial PowerShell script that does the actual printer mapping.

    And last we have the script whose name ends with ScriptRunFromTaskScheduler.ps1.

    First, the CleanUpAndExit function is defined. Second, a function to check the connection to the domain is defined, followed by two functions to test the connection to the printers.

    In the second part, the Test-DCConnection function is used to test domain connectivity. If the connection is not available, it stops and the status is written to a log file.
    If there is a domain connection, the script tries to connect the printers, if the printer is not already connected.

    In the last part, a final check is done to check the end state of the printers.

    And that`s all to connect one or more network printers to your (cloud-managed) Windows devices. It’s a pretty simple solution, but it does the job.

    In case something goes wrong in connecting the printer(s), the log file can be found in %programdata%\Microsoft\IntuneManagementExtension\Logs. I chose this location so it is part of the Device Diagnostics zip folder you can retrieve remotely from your Intune managed devices. Makes troubleshooting a little easier.

    In case you want to use the scripts to build your own solution, it is found on my Github repo.

    Another challenge you might have when moving to a cloud-managed Windows workplace is mapping network drives. I also shared a post on that topic.

    Below is a short video to show that on-premises resources are available, although some people still think this is not possible.

    Microsoft Technical Takeoff video:
    During the Technical Takeoff days of Microsoft, I participated in the session On-premises to cloud native in Intune: expert tips and key considerations.
    This might be interesting for you when you are moving to cloud management.

    Automation Modern Workplace PowerShell Windows Windows 10 Windows 11
    Share. Facebook Twitter LinkedIn Email WhatsApp
    Peter Klapwijk
    • Website
    • X (Twitter)
    • LinkedIn

    Peter is a Security (Intune) MVP since 2020 and is working as Modern Workplace Engineer at Wortell in The Netherlands. He has more than 15 years of experience in IT, with a strong focus on Microsoft technologies like Microsoft Intune, Windows, and (low-code) automation.

    Related Posts

    Connect to Azure file shares with Microsoft Entra Private Access

    May 24, 2024

    The next step in a passwordless Windows experience

    October 28, 2023

    Deploy Heimdal Security with Microsoft Intune

    December 22, 2017
    View 5 Comments

    5 Comments

    1. Ľuboš Nikolíni on October 12, 2023 16:00

      Hello Peter,
      nicely done!
      I also use a similar approach, however less elegant than yours: running a Remediation every few fours that will map the printer, if not already mapped.

      function Set-NewPrinter {
      [cmdletbinding()]
      param (
      [Parameter (Mandatory=$true)][string]$printerName,
      [Parameter (Mandatory=$true)][string]$printServer
      )

      $returnCode = 0 # successfully mapped – at least added a job that will map it

      $printer = “\\” + $printServer + “\” + $printerName
      Write-Verbose “Printer: $printer”
      $printerFound = Get-Printer -Name $printer -ErrorAction SilentlyContinue
      Write-Verbose “Printer found: $printerFound”

      if (-not $printerFound) {

      $pingtest = Test-Connection -ComputerName $printServer -Quiet -Count 1 -ErrorAction SilentlyContinue
      Write-Verbose “Ping test: $pingtest”

      if($pingtest){

      try {

      $addPrinter = Add-Printer -ConnectionName $printer -AsJob -Verbose
      Write-Verbose “$printServer;$printerName;Add-Printer-AsJob”

      } catch {
      Write-Verbose “Exception while adding printer.”
      Write-Verbose $_ -ForegroundColor Red
      $returnCode = 99 # Exception
      }

      } else{
      Write-Verbose “$printServer is not reachable”
      $returnCode = 50 # printServer is not reachable
      }

      } else { # if (-not (Get-Printer -Name $printer))
      Write-Verbose “$printServer;$printerName;printerFound”
      $returnCode = 1 # OK, printer found – already mapped
      }

      return $errorCode

      }

      Set-NewPrinter -printServer MyPrintServer -printerName MyPrinter

      Reply
      • Ľuboš Nikolíni on October 12, 2023 16:02

        And I even pasted an incorrect code (facepalm)
        It should be ‘return $returnCode’

        Reply
        • Peter Klapwijk on October 12, 2023 16:07

          As written in the post, we have to be creative 🙂
          I think a lot of different approaches are used to overcome these kind of challenges.

          Reply
    2. Philip Brown on April 3, 2025 06:35

      How on earth are your azure ad joined devices resolving internal DNS names? That is the issue I am currently having. Sure I can connect to local domain resources, but I have to use the IP address because there is no way to resolve the IP from the netbios name. Thanks,

      Reply
      • Peter Klapwijk on April 8, 2025 21:30

        Entra joined devices can find DCs when they’re on the same network and when DNS is configured correctly, also name resolution works fine. Directly on the same network, but also via VPN/ zero-trust solutions

        Reply
    Leave A Reply Cancel Reply

    Peter Klapwijk

    Hi! Welcome to my blog post.
    I hope you enjoy reading my articles.

    Hit the About Me button to get in contact with me or leave a comment.

    Awards
    Sponsor
    Latest Posts

    Hide the “Turn on an ad privacy feature” pop-up in Chrome with Microsoft Intune

    April 19, 2025

    How to set Google as default search provider with Microsoft Intune

    April 18, 2025

    Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs

    April 13, 2025

    Using Visual Studio with Microsoft Endpoint Privilege Management, some notes

    April 8, 2025
    follow me
    • Twitter 4.8K
    • LinkedIn 6.1K
    • YouTube
    Tags
    Administrative Templates Android Automation Autopilot Azure Azure AD Browser Conditional Access Edge EMS Exchange Online Feitian FIDO2 Flow Google Chrome Graph Graph API Identity Management Intune Intune Monitoring iOS KIOSK Logic Apps macOS MEM MEMMonitoring Microsoft 365 Microsoft Edge Microsoft Endpoint Manager Modern Workplace Office 365 OneDrive for Business Outlook Passwordless PowerApps Power Automate Security SharePoint Online Teams Windows Windows 10 Windows10 Windows 11 Windows Autopilot Windows Update
    Copy right

    This information is provided “AS IS” with no warranties, confers no rights and is not supported by the authors, or In The Cloud 24-7.

     

    Copyright © 2025 by In The Cloud 24-7/ Peter Klapwijk. All rights reserved, No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

    Shorthand; Don’t pass off my work as yours, it’s not nice.

    Recent Comments
    • Peter Klapwijk on Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs
    • John M on Using Windows Autopilot device preparation with Windows 365 Frontline shared cloud PCs
    • Christoffer Jakobsen on Connect to Azure file shares with Microsoft Entra Private Access
    • Ludo on How to block Bluetooth file transfer with Microsoft Intune
    • RCharles on Automatically configure the time zone (during Autopilot enrollment)
    most popular

    Application installation issues; Download pending

    October 1, 2024

    Restrict which users can logon into a Windows 10 device with Microsoft Intune

    April 11, 2020

    How to change the Windows 11 language with Intune

    November 11, 2022

    Update Microsoft Edge during Windows Autopilot enrollments

    July 9, 2024
    Peter Klapwijk – In The Cloud 24-7
    X (Twitter) LinkedIn YouTube RSS
    © 2025 ThemeSphere. Designed by ThemeSphere.

    Type above and press Enter to search. Press Esc to cancel.

    Manage Cookie Consent
    To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
    Functional Always active
    The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
    Preferences
    The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
    Statistics
    The technical storage or access that is used exclusively for statistical purposes. The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
    Marketing
    The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
    Manage options Manage services Manage {vendor_count} vendors Read more about these purposes
    View preferences
    {title} {title} {title}