Group Policy Preferences - Printer Mapping Issues

[CHiLL]

Hello,

We have recently moved away from using scripts to map our printers are are currently mapping them during user logon via Group Policy (User Config > Preferences > Control Panel Settings > Printers). However we are currently encountering two issues:

1) DNS issues appear to be preventing some users from getting the mapped printer apply. Logging off and back on or switching to another machine generally sorts it, but I think I've gotten to the bottom of it...but don't know how to rectify it. Two error messages appear in the event log:

a.

Event 4098, Group Policy Printers 
The user 'RM02' preference item in the 'P - Printer Mapping {97636583-AAEA-4FB2-892C-2E1372291C09}' Group Policy Object did not apply because it failed with error code '0x80070057 The parameter is incorrect.' This error was suppressed.

b.

The user 'RM02' preference item in the 'P - Printer Mapping {97636583-AAEA-4FB2-892C-2E1372291C09}' Group Policy Object did not apply because it failed with error code '0x80070057 The parameter is incorrect.' This error was suppressed.

From some research, it appears that when applying the printers, its struggling to resolve our print server/share by name (\\print\RM02). However if I use the IP of the server (\\10.22.11.18\RM02), it seems to be mapping the printers without any issues what so ever.

 

2) Staff and students get different printers, as the mapping is using item-level targeting. However on a lot of machines, I am noticing that some of the printers are simply not deleting.

Within GPP, the first 'Printer' in the order it 'Delete All'. This is set as a 'Delete' function, with the tick box enabled for 'Delete all shared printer connections' checked.

The printers that aren't deleted then remain on the PC and appear for other users, even if that user isn't meant to be getting that printer.

Example. A member of staff logs onto a student ICT suite PC and gets the Staff Room printer, but NOT the printer in the ICT suite. Staff member logs off and then a student logs onto the same PC. The student gets the printer in the room, but also has the Staff Room printer, despite it should have been deleted and not re-added due to item-level targeting.

I get no messages appearing in the even log as to why this happens, and the only way I can remove this printer from the PC is for me to log on using my admin credentials and manually removing it, which obviously isn't great.

 

Ideally I'd like to:

Have the printers adding via the server name (\\print)

Have the printers actually delete when they should.

 

Note: We are using Windows 8.1 x64 as our client OS.

[disk]

Are you using the FQDN when specifying printers in policy?

[CHiLL]

Are you using the FQDN when specifying printers in policy?

No, simply the normal UNC path to the printer. Though it does work, just not all the time.

[jbutlin]

Is it worth checking DNS, or flushing the DNS cache on some of these workstations?

[vladker]

I had an issue with GPP Printer installs. Check out KB 2748246

 

Fixed the problem I had, although I can't recall if it is the same issue as you have. May be worth a go on a test machine.

[CHiLL]

Thanks for the replies, but I'm still having issues with these printers.

One thing I have noticed...during the shutdown of student machines, we have DelProf2.exe running to delete all cached profiles. With this in mind, the first time a user logs on the machine after it has powered on or rebooted, the printer is NOT added. If they log off and back on again, it IS added. If second user logs onto the machine after the first user, without rebooting it, the printer IS still added.

[mattpant]

I get similar issues and would love to find an answer - using Windows XP and a login script it worked everytime but no longer on Windows 8.1 - Do you use mandatory profiles? I think it's something to do with them? As users with a roaming or local profile don't seem to have the same issue?

[rrrrr]

I had a similar issue. Changing the mapping to the fqdn resolved it for me. Eg if mapped as \\printserver\printer they would not always map, changing it to \\printserver.local\printer resolved it.

[negasonicteenagewarhead]

Error code 0x80070057 is typically associated with security permissions. In this instance point-and print restrictions were preventing non-admins from installing packaged drivers. configured point and print restrictions as per Microsoft KB article and issue now appears to be resolved.

https://technet.microsoft.com/en-us/library/cc753269(v=ws.11).aspx

[Planehazza]

Fast forward this to 2022 and we're still having similar issues. Tried various things and it always ended up with the conversation starting with user saying "printers aren't here" and our saying "log off and back in" then the printers' magically appearing...

 

Package point and print don't do much now, not since MS's balls up with the KB update that stopped non admins from installing printer drivers. We've applied that registry fix (I mean vulnerability) but it was still taking two log ins. I've just changed the UNC path of the printers to FQDN as per the advice above and the printers are now appearing first time! Wooo! However, does this suggest a DNS issue?

[georgeescott]

Event 4098, Group Policy PrintersThe user 'RM02' preference item in the 'P - Printer Mapping {97636583-AAEA-4FB2-892C-2E1372291C09}' Group Policy Object did not apply because it failed with error code '0x80070057 The parameter is incorrect.' This error was suppressed.

 

We had this exact error as well intermittently occur for different computers and different users.

 

Within GPP, the first 'Printer' in the order it 'Delete All'. This is set as a 'Delete' function, with the tick box enabled for 'Delete all shared printer connections' checked.

We also have a 'Delete All' item before the printer mapping happens.

 

I've just changed the UNC path of the printers to FQDN as per the advice above and the printers are now appearing first time! Wooo! However, does this suggest a DNS issue?

 

This is what fixed 95% of our printer issues with the '00x80070057 The parameter is incorrect' error. Setting the print server location to be FQDN in the GPO.

 

However, we still had some issues with printers not mapping with the same error after this. After a lot of troubleshooting, i stumbled upon two posts:

http://www.edugeek.net/forums/windows-10/183649-windows-10-printers-keep-coming-back.html and https://serverfault.com/questions/1082240/where-are-these-printers-coming-from-in-devices-and-printers.

 

We have student mandatory profiles which are cleared by the 'Delete user profiles older than a specified number of days on system restart' GPO as well as Delprof running regularly.

 

It turns out that neither of these clear out the 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider' key, which gets filled up with GUIDS of users/printers when you map a shared printer that has 'Render print jobs on client computers' (otherwise known as Client Side Rendering) enabled.

 

Setting the following registry keys on our workstations computer policies resolved the remaining 5% of issues:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] 
"InactiveGuidPrinterAge"=dword:00000384 
"ActiveGuidPrinterAge"=dword:00000384
"InactiveGuidPrinterTrim"=dword:00000384
"RemovePrintersAtLogoff"=dword:00000001

 

It's hard to find any documentation on the exact purpose of these keys though as Microsoft have removed it all from their site.

[CHiLL]

We had this exact error as well intermittently occur for different computers and different users.

 

 

We also have a 'Delete All' item before the printer mapping happens.

 

 

 

This is what fixed 95% of our printer issues with the '00x80070057 The parameter is incorrect' error. Setting the print server location to be FQDN in the GPO.

 

However, we still had some issues with printers not mapping with the same error after this. After a lot of troubleshooting, i stumbled upon two posts:

http://www.edugeek.net/forums/windows-10/183649-windows-10-printers-keep-coming-back.html and https://serverfault.com/questions/1082240/where-are-these-printers-coming-from-in-devices-and-printers.

 

We have student mandatory profiles which are cleared by the 'Delete user profiles older than a specified number of days on system restart' GPO as well as Delprof running regularly.

 

It turns out that neither of these clear out the 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider' key, which gets filled up with GUIDS of users/printers when you map a shared printer that has 'Render print jobs on client computers' (otherwise known as Client Side Rendering) enabled.

 

Setting the following registry keys on our workstations computer policies resolved the remaining 5% of issues:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] 
"InactiveGuidPrinterAge"=dword:00000384 
"ActiveGuidPrinterAge"=dword:00000384
"InactiveGuidPrinterTrim"=dword:00000384
"RemovePrintersAtLogoff"=dword:00000001

 

It's hard to find any documentation on the exact purpose of these keys though as Microsoft have removed it all from their site.

Thanks, I'll give those a try. We still have some issues, but now it's related to printers not adding at first logon only. Subsequent logons on that machine get it.

 

Just to clarify, I presume those DWORDs are hex?

[georgeescott]

Just to clarify, I presume those DWORDs are hex?

 

Yes, hex. E.g. 0x384 (decimal 900).

[CHiLL]

So I added these registry entries before Christmas on some machines and it seems to have caused more problems, such as no default printer being selected, individual printers being removed, but others staying, all printers being removed and their printer added by GPP not being added.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] 
"InactiveGuidPrinterAge"=dword:00000384 
"ActiveGuidPrinterAge"=dword:00000384
"InactiveGuidPrinterTrim"=dword:00000384
"RemovePrintersAtLogoff"=dword:00000001

 

I've now put in a GPP registry delete entry to remove those registry keys from that group and I'll see if it goes back to normal.

[georgeescott]

So I added these registry entries before Christmas on some machines and it seems to have caused more problems, such as no default printer being selected, individual printers being removed, but others staying, all printers being removed and their printer added by GPP not being added.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] 
"InactiveGuidPrinterAge"=dword:00000384 
"ActiveGuidPrinterAge"=dword:00000384
"InactiveGuidPrinterTrim"=dword:00000384
"RemovePrintersAtLogoff"=dword:00000001

 

I've now put in a GPP registry delete entry to remove those registry keys from that group and I'll see if it goes back to normal.

 

Although it didn't get reported/seen during our initial testing of those registry keys, we too had issues with the default printers not being selected so we also reverted the registry keys back.

 

The last few weeks we've been testing a different combination that was inspired from other forum posts http://www.edugeek.net/forums/windows-10/183649-windows-10-printers-keep-coming-back.html and https://social.technet.microsoft.com/Forums/lync/en-US/71d06204-3735-4473-8bc9-20be9e19090e/problem-with-multiple-instances-of-shared-printers-being-installed-on-client-computers-when-the.

 

We're currently only setting the following registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] 
"RemovePrintersAtLogoff"=dword:00000001

 

and then having a startup script remove specific keys under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider

It's being tested across our Trust, but early results are promising; we've not had more '0x80070057 The parameter is incorrect' errors being logged.

 

I'll test it for another week or two and then I'll post the script.

Edited March 2, 2023 by georgeescott

[scottcopus]

Hi @georgeescott,

 

We're also experiencing the '0x80070057 The parameter is incorrect' event log errors with the occasional (or sometimes frequent) printers not being mapped at first user logon. Our environment is mostly similar. In our labs/classrooms, while we don't have mandatory profiles, we do make use of the 'Delete user profiles older than a specified number of days on system restart' GPO too.

 

I'm interested in whatever you found that may have helped solve this, including if you still use a script you mentioned.

 

Also, has anyone noticed if this issue is consistent on both Win10 and Win11 equally? This is something I'm hoping to have time to test.

 

cheers,

Scott

 

[Badaz52]

Hi @georgeescott,

 

We're also experiencing the '0x80070057 The parameter is incorrect' event log errors with the occasional (or sometimes frequent) printers not being mapped at first user logon. Our environment is mostly similar. In our labs/classrooms, while we don't have mandatory profiles, we do make use of the 'Delete user profiles older than a specified number of days on system restart' GPO too.

 

I'm interested in whatever you found that may have helped solve this, including if you still use a script you mentioned.

 

Also, has anyone noticed if this issue is consistent on both Win10 and Win11 equally? This is something I'm hoping to have time to test.

 

cheers,

Scott

 

 

We are still having this issue on Windows 11, if a user hasn't logged in for a while their profile gets removed. We are using local profiles and print mapping works when they sign out and back in again which is annoying as even though with local profiles you are talking 3-5 seconds to log back in our users hate doing it.

 

- - - Updated - - -

 

Although it didn't get reported/seen during our initial testing of those registry keys, we too had issues with the default printers not being selected so we also reverted the registry keys back.

 

The last few weeks we've been testing a different combination that was inspired from other forum posts http://www.edugeek.net/forums/windows-10/183649-windows-10-printers-keep-coming-back.html and https://social.technet.microsoft.com/Forums/lync/en-US/71d06204-3735-4473-8bc9-20be9e19090e/problem-with-multiple-instances-of-shared-printers-being-installed-on-client-computers-when-the.

 

We're currently only setting the following registry key:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider] 
"RemovePrintersAtLogoff"=dword:00000001

 

and then having a startup script remove specific keys under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider

It's being tested across our Trust, but early results are promising; we've not had more '0x80070057 The parameter is incorrect' errors being logged.

 

I'll test it for another week or two and then I'll post the script.

 

Did it continue to work for you?

[Badaz52]

I just tested the RemovePrintersAtLogoff key and deleted the Guids under Client Side Rendering Print Provider manually and now it works like clockwork with existing profiles and new ones.

[georgeescott]

Did it continue to work for you?

 

Yep, we’ve not had any further issues with printers since applying the RemovePrintersAtLogoff key, and running the script regularly to clear out any remaining keys.

 

I’ll upload the script to my GitHub this week and post a link when it’s done!

[Badaz52]

Yep, we’ve not had any further issues with printers since applying the RemovePrintersAtLogoff key, and running the script regularly to clear out any remaining keys.

 

I’ll upload the script to my GitHub this week and post a link when it’s done!

 

Great stuff, yes all working well here on fresh computers every user even with a new profile gets the printers first time every time. I look forward to the script just so I don't have to re-image everything to clear it out! Cheers!

[CHiLL]

and then having a startup script remove specific keys under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider

Out of curiosity, which keys are you deleting? The SID entries? Would you mind sharing the startup script? I'm just wondering if I can do it via GPP, rather than a script.

[sideone]

Also following with interest - @georgeescott please share the script and keys!

[scottcopus]

[Attempted to fix formatting]

 

At this point in time, I've implemented the following GPO settings & script on about 200 of our ~2000 lab & instructor (i.e. shared/multi-user) Win10 & Win11 endpoints. So far it seems to have resolved the issue where AD printers will occasionally fail to get installed. However, I still have noticed that Event Viewer still shows one of the errors "0x80070057 The parameter is incorrect" or "0x80070709 The printer name is invalid" and that it can sometimes take up to a couple minutes before the printer will show up in the "Printers & scanners" settings UI. One odd thing is that these event log errors will show early nearer to login time (sometimes), but there's no *more* related event logs at or near the time the occasionally-delayed printer installs finally happen. Here's hoping someone at Microsoft sees this and maybe acknowledges this as a bug and hopefully fixes it!

 

I'm planning to roll this out to the remaining endpoints in a few days. But due to the holiday break and low population at my university between now and over winter break, I probably won't hear much feedback about the results until closer to February 2024.

 

Here's my current solution in case it helps anyone else.....

 

GPO settings:

SAME AS BEFORE:

- User\Preferences\Control Panel Settings\Printers

- Shared Printer: MyPrinter, Action:Update, Share Path:\\server\printer, Set this printer as default printer:True

 

NEW: Computer\Preferences\Windows Settings\Registry:

- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider\RemovePrintersAtLogoff (REG_DWORD) = 1

NEW: GPO SHUTDOWN script:

ex: \\server\share\path\Printers-ClientSideRenderingCleanup.ps1

This script cleans up all the cached Client Side Rendering user+printer connections. It's probably a good idea to run this script during shutdown/restart, otherwise it my require the Print Spooler service to be restarted because this deletes spooler-related registry keys, which I didn't want to do at startup/logon/etc. So after this is implemented, you basically need to wait a couple hours until group policy is refreshed on your clients (or manually run GPUPDATE), and then restart the endpoints.

 

$scriptName = $MyInvocation.MyCommand.Name
Start-Transcript -Path "$env:WINDIR\Logs\$scriptName.log" -Append

function timestamp {
   return Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
}

$StartTime = Get-Date
$ClientSideRenderingRegKey = 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider'
If (Test-Path $ClientSideRenderingRegKey) {
   # Regex pattern for username SIDs (security identifiers)
   $SIDregex = 'S-1-5-21-\d+-\d+\-\d+\-\d+$'
   # Find and delete all the registry keys holding cached Client Side Rendering user+printer connections
   $UserRegKeys = Get-ChildItem "$ClientSideRenderingRegKey\*" | Where-Object {$_.PSChildName -match $SIDregex}
   "$(timestamp) Deleting cached Client Side Rendering user+printer connection registry keys..."
   if ($UserRegKeys) {
       $UserRegKeys | ForEach-Object {
           $_.Name
           $_ | Remove-Item -Recurse -Force
       }
   } else {
       "$(timestamp) None found."
   }
} else {
 "$(timestamp) Creating registry key $ClientSideRenderingRegKey ..."
 New-Item -Path $ClientSideRenderingRegKey -Force | Out-Null
}

# Set this here, even though it's better it gets set permanently (like in the same or separate GPO) on all new OS deployments going forward
$RegName   = 'RemovePrintersAtLogoff'
$RegValue  = '1'$RegType   = 'DWORD'
"$(timestamp) Setting registry key $RegName=$RegValue ($RegType) ..."
New-ItemProperty -Path $ClientSideRenderingRegKey -Name $RegName -Value $RegValue -PropertyType $RegType -Force | Out-Null
$TimeDiff = New-TimeSpan -Start $StartTime -End (Get-Date)"$(timestamp) Done. Finished in {0}m {1}s." -f [int][Math]::Floor($TimeDiff.TotalMinutes), $TimeDiff.Seconds

 

cheers,

Scott

Edited December 6, 2023 by scottcopus
formatting

[scottcopus]

Doh, that last line of script code in my last post should have been broken up into two lines. I guess vBulletin has a hard time with formatting of pasted code... and I guess the time has expired for more edits. 🤷

 

$TimeDiff = New-TimeSpan -Start $StartTime -End (Get-Date)
"$(timestamp) Done. Finished in {0}m {1}s." -f [int][Math]::Floor($TimeDiff.TotalMinutes), $TimeDiff.Seconds

[georgeescott]

I’ll upload the script to my GitHub this week and post a link when it’s done!

@CHiLL @Badaz52 @sideone sorry for the delay in posting it, I finally had some time over Christmas!

 

I've uploaded it here: https://github.com/georgeescott/Scripts/tree/main/PowerShell/Remove-ClientSideRenderingPrinterConnections.

 

 

Out of curiosity, which keys are you deleting? The SID entries? Would you mind sharing the startup script? I'm just wondering if I can do it via GPP, rather than a script.

I've documented which keys I'm deleting and why in the GitHub repo.

 

My script goes a bit further than @scottcopus's and deletes some extra keys I observed being removed on logoff when the 'RemovePrintersAtLogoff' key is set.

 

Give it a test and submit any issues to my repo.