Ten printing rules with Citrix XenApp

http://www.thomaskoetzing.de/index.php?option=com_content&task=view&id=340&Itemid=307

Printing has always been an issue with XenApp or the Remote Desktop Services (RDS) and still is. Therefore I have now written my "ten printing rules with Citrix XenApp" where parts of it apply also to RDS. Also settings are for XenApp 6.0 and Server 2008 R2 but you will find most of the settings with previous versions as well.

The Ten Printing Rules

Since Presentation Server 4.0 (CPS 4.0) use the Citrix Universal Printer Driver based on EMF for client printers, especially with Windows Clients.

User Policy\ICA\Printing\Universal Printing = Use universal printing only

Presentation Server 4.0 Printing Enhancements

http://support.citrix.com/article/CTX108170

Client network printer (network printer connected to the client) should also be mapped by EMF and the print output should go through the client in indirect mode.

User Policy\ICA\Client Printers\Direct connections to print server = Disabled

Print server should always be located in the same network as the XenApp server, especially when the printers are in a WAN location, branch office. This is when not going through the ICA connection (see point 2)

Once Citrix has released the Universal Print Server (UPS), which is expected by the end of 2011, only use the UPS to connect to printers located on the print server.

Set Microsoft group policies to disallow Pont-To-Print (P2P), to use print isolation, disallow kernel-mode drivers and render jobs on the print server.

Computer Configuration\Policies\Administrative Templates\Printers

Always render print jobs on the server

Execute print drivers in isolated processes

Point to Print Restrictions (set to localhost)

Disallow installation of printers using kernel-mode drivers

See also

How to Restrict Print Drivers From Being Installed on XenApp Servers Hosted on Windows Server 2008/R2

http://support.citrix.com/article/CTX128786

How to Restrict Print Drivers from Being Installed on XenApp Servers

http://support.citrix.com/article/CTX120618

Set Citrix user policies to avoid unwanted in-box printer driver.

User Policy\ICA\Printing\Automatic installation of in-box printer drivers = Disabled

----- if you cannot use Citrix universal print driver ----



Always use Microsoft native printer driver first, that come with the operating system.

How to Distinguish Native/Inbox Print Drivers from Non-native/Manufacturer Ones in Windows Server 2008 R2

http://support.citrix.com/article/CTX126093

When you use 3rd party printer driver (HP, Lexmark, Xerox etc.), test them first with StressPrinters and make sure the spooler doesn't crash.

Understand and use StressPrinters

http://bit.ly/StressPrinters

Do not use 3rd party printer driver with print monitors, try to get drivers without monitors or disable/remove them.

Out of experience, avoid PCL6 printer driver if you have to use 3rd party printer driver.

Q&A

Q: When using 3rd party printer driver what can happen?

A: If you are lucky noting but you might see: print spooler crash, delayed logons, stuck logons or the worst blue screen of death (BSOD) - server crash.

Q: Why only use the Citrix EMF universal printer driver?

A: With Windows Clients, EMF actually uses the local client printer driver with all capabilities.

Q: What about non-Windows (MAC, Linux...) clients?

A: Non-Windows clients cannot use EMF and automatically fall back to a Universal Printer Driver (UPD) based on a color laser printer but will not give all capabilities the client printer driver might have.

Q: Why not use HP Universal Printer Driver?

A: The HP UPD should only be used for network printer mapped to the XenApp Server and only until UPS is released. With HP UPD make sure you use at least version 5.x and printer isolation, since the driver has been buggy in the past

HP Printers Supported in XenApp Environments

http://support.citrix.com/article/CTX110571

Q: What is printer isolation good for?

A: As it says, it isolates the printer driver and therefore protects the spooler to crash. So if the driver is buggy, the isolation might fail but the driver will not crash the spooler service.

Q: Why disable Pont-To-Print (P2P)?

A: P2P automatically installs printer driver without you really knowing it. That can be very dangerous because you might spread a bad driver to all servers in your farm.

Q: Why should be a print server close to XenApp and not located in a branch office over WAN?

A: Especially with Office 2010, printers are "live" enumerated and over a WAN might take a long time. Also the XenApp server would do a RPC call over the WAN to the print server and is very slow and sluggish.

Q: Why avoid PCL6 printer drivers?

A: There is no technical reason but experience from the filed have shown often PCL6 driver to cause several issues.

Q: What is the Citrix Universal Print Server (UPS)?

A: It's an upcomming printing component, hopefully released by the end of 2011. In short, UPS has two parts the print server service (you install on the print server) and a client service (UPC) that will be installed on a XenApp server. Now network printer between print server and XenApp will be mapped also with the Citrix EMF and therefore no printer driver on the XenApp server needs to be installed! UPS is high secure, optimized and allows even firewall transversal. UPS uses the Citrix common gateway protocoll (CGP) and the UPC will be incl. in future XenApp releases.