Print Server Migration to Universal Print

Because most of what the print server did is now a service you already pay for. A print server exists to hold drivers, queue jobs and map printers to users; Universal Print holds the printers in your Microsoft 365 tenant, Intune maps them by group, and clients need no drivers at all. What you lose is a single point of failure, a spooler that has been a favourite target for attackers, a login script that breaks when the server name changes, and one more box to patch — and remote users print to the office without a VPN. Upgrading is still the right answer for a handful of cases: applications that print from the server, a print-management platform without Universal Print integration, or devices with no usable IPP or V4 driver. The disposition names those, and where a small print host is genuinely needed the Windows Server 2016 to 2025 Upgrade Service builds it properly instead of keeping the old one alive.

At the time of writing Microsoft includes Universal Print in Microsoft 365 E3, E5, F3 and Business Premium, in the education A3 and A5 plans, and in Windows Enterprise E3 and E5; anyone else needs the standalone Universal Print subscription. Each license also adds print jobs to a tenant-wide monthly pool — 100 per E3, E5 or Business Premium license, five per F3, Windows Enterprise or standalone license — and Microsoft sells volume add-on packs of 500 and 10,000 jobs when the pool is short. We check every printing user's assignment during the licensing check; the licenses are Microsoft's subscriptions at Microsoft's price and are not part of our fee.

Only if you have printers that are not Universal Print-ready. The connector is a Microsoft service you install on a Windows Server or Windows 11 machine on the same network as those printers; the printers are installed on that host with Microsoft's IPP class driver or the manufacturer's V4 driver, the connector registers them with Universal Print, and jobs flow from the cloud through the connector to the printer. If every printer in the estate registers directly from its own firmware, there is no on-premises print infrastructure left at all. If some do not, the connector host is a small, ordinary server — we put it on Windows Server 2025 or 2022, never on the 2016 machine you are retiring — that must run 24x7 with sleep disabled and reach Microsoft's endpoints outbound over HTTPS.

By design, because the product does not do it for you yet. Microsoft supports one connector per printer — the same printer cannot sit behind two — and has said redundancy is planned. So we spread the printers at each site across two or more connectors, sized on Microsoft's guidance about memory use at startup, so that one host failing takes out some printers rather than the whole floor; we never clone a connector host, which Microsoft warns will interfere with the original; and we hand your team the as-built list of which printer sits behind which connector so a failure is a ten-minute re-registration, not an investigation.

Through Intune. Each printer share has a cloud device ID, a shared ID and a share name; an Intune settings-catalog policy under Printer Provisioning carries those values with the action Install, and every device in the assigned group installs the printer without the user doing anything — with a default printer where you want one. Users can also add any printer shared to them from Settings, and Universal Print anywhere gives a single pull-print queue for people who move between sites. The Group Policy preferences and login scripts that mapped the old server's queues are removed in the same wave, which is what makes the old server safe to switch off.

From home, yes — the device talks to Universal Print over the internet and the connector or the printer pulls the job from the cloud, so no VPN is involved; a job sent from a kitchen table prints at the office when the printer is reachable. macOS is supported through Microsoft's Universal Print app from the Mac App Store, generally available for commercial tenants at the time of writing, and we include Mac users in the pilot where they are in scope. Azure Virtual Desktop and Windows 365 session hosts on Windows 11 multi-session are supported clients — printing from a cloud desktop is one of the cases Universal Print handles better than a print server ever did. Mobile and Linux printing are scoped only where Microsoft documents a supported path.

They are the exceptions we look for first. Label and receipt printers driven by raw streams, wide-format devices, and applications that print from a Windows Server without a person at a keyboard — ERP, warehouse, pharmacy, badge systems — may not have an IPP or V4 driver and may not be served by a Windows client print path at all. We inventory them, test them through a connector in the pilot, and give each a written disposition: connector-attached where it prints correctly, or a documented non-Universal Print path where it does not — which sometimes means a small, patched Windows Server 2025 print host for a handful of devices. What we will not do is declare the migration complete while a warehouse quietly keeps printing to a server that is supposed to be gone.

Usually, but through the vendor. Several print-management platforms publish Universal Print integrations for secure release, accounting and quotas; we confirm one exists for your product and version, design the shares and groups so the platform can sit in front of the printers, and coordinate the cutover with it. Deploying or reconfiguring the platform itself is the vendor's work or a separate engagement, and if there is no integration for your version we say so at disposition time rather than after cutover. If badge release is all you need, Universal Print's own secure release with a QR code may replace the platform — a decision we lay out with the trade-offs, not one we make for you.

On measured volume, not headcount. We read a representative month of job counts from the print servers' logs, compare it with the pool your licenses create — 100 jobs per E3, E5 or Business Premium license per month at the time of writing, five per F3, Windows Enterprise or standalone license — and state before cutover whether the pool covers it with headroom or which volume add-on packs (500 or 10,000 jobs) to buy. The pool resets monthly. Microsoft's own description of what happens when it is exhausted has changed between versions of its documentation, so we check the current behaviour during design rather than repeat either version here, and we size the pool so you never test it.

Per Microsoft's data-handling documentation, job data is encrypted in transit and at rest, stored in the geography your tenant was created in, and held only until it prints or expires — unclaimed jobs are aborted after three days and cleared within ten. Access is by Microsoft Entra identity and group, the same model as your files and mail, which is stronger than a print server's share permissions and a lot stronger than an open IPP port. Secure release adds the physical step: a job prints only when the person scans the printer's QR code. And you remove a spooler service from a server that has been a recurring target for attackers. Where a regulator or a contract forbids documents leaving the site even encrypted, we keep that printer on a local path and record why.

$45 per printer plus a $1,450 tenant fee, fixed, quoted in writing before work begins; you pay after you approve delivery. Fifty printers come to $3,700, one hundred and twenty to $6,850. The fixed price covers up to 299 printers with a connector design at one site; 300 or more printers, or connectors at several sites, are quoted per estate because connector count and site paths drive the work more than printer count does. Universal Print licenses, add-on packs, connector hosts and printer hardware are yours and are not in the fee.

About 2 weeks for a typical estate: inventory and design in the first four days, registration and sharing by day 8, pilot by day 10, wave cutovers and decommission by day 14; several hundred printers or many sites extend the last stage and the wave plan states the real dates. Users notice new printer names appearing on their computers without a visit from IT, the old ones disappearing, and — where you enabled it — a QR code to scan before a confidential job prints. We give you the announcement wording so nobody learns about it from a missing printer.

After each wave we leave the old queues in place but unshared for an agreed soak period, so anything we missed shows up as a call rather than a loss. Then the queues are removed, the spooler service is disabled and the Print and Document Services role is uninstalled. If the server hosted nothing else it is shut down and its DNS and Active Directory objects cleaned up per the checklist; if it also carries file shares, DHCP, certificate services or an application, the print role is gone but the server stays until those roles move through their own engagements — the Windows Server 2016 End of Support Assessment and Roadmap sequences them, and for the interim Windows Server ESU Enrollment through Azure Arc keeps it patched past January 2027.

Roman Sotnik is the service owner. IT Partner has been a Microsoft partner since 2006, holds the Solutions Partner designation for Modern Work, and delivers this alongside its Intune setup and managed Intune practice — so the people who deploy your printers are the people who already manage the devices they land on.