KB3170455 preventing printer installation

[sonofsanta]

KB3170455 from July's round up is giving me grief.

 

It closes down a two decade old vulnerability in the print service installing anything without question, allowing for malware from poisoned devices. It also now seems to be blocking network printers being installed from the print server.

 

If I--even as an administrator--try to add the printer manually, I get the following error:

The driver in question is unsigned, because it's an HP one I've modified to set various defaults. It works fine on computers outside my patch test area, so it is definitely KB3170455 at fault.

 

I've followed the instructions here. I can add the printer by IP and then point at the driver on the print server and it installs, but trying to add by share name (\\server\printer) gives the error above.

 

Anyone else hit this and solved it yet?

[siuko]

We had the issue but I hadn't realized that an update was the cause.

 

I fixed it by switching the Kyocera universal driver with a Kyocera KX driver which fixed the issue for us.

 

Very strange!

[pete]

There was a reddit thread about it here (which veers off into drama about mid-way down, but there's various people reporting success/failure with the workaround):

 

 

I haven't had this yet (*touches wood*).

[sonofsanta]

There was a reddit thread about it here (which veers off into drama about mid-way down, but there's various people reporting success/failure with the workaround):

 

 

I haven't had this yet (*touches wood*).

 

Yeah, I found that thread and have been trying to find further clues in it, but no joy so far.

 

I should add that our printers are normally mapped via .vbs logon script.

 

EDIT: just hit the drama. Good god, reddit, get it together.

Edited July 18, 2016 by sonofsanta

[pete]

Ah, we use Group Policy to push them out and set a sensible default. I did have one person with an odd spooler issue the other day and wondered if it was related to this, but restarting the spooler let them carry on (and mapping a printer as them worked).

[Steve21]

When you say you added it via IP did you try just using the server name?

 

We use PnP restrictions but use the servername fully qualified for it as that's why it uses when you try to do via the share name etc

 

Steve

[sonofsanta]

When you say you added it via IP did you try just using the server name?

 

We use PnP restrictions but use the servername fully qualified for it as that's why it uses when you try to do via the share name etc

 

Steve

 

It's normally added via the NetBIOS name e.g. as \\server\printer. I just tested with the FQDN \\server.domain.local\printer and it didn't change anything, alas, despite my brief surge of hope that it would

 

When I say added via IP, I mean I can add it by going directly to the printer (i.e. not via the print server queue) and when it asks for a driver, point it at \\server\c$\Drivers\ and it will install fine. It flashes up the unsigned warning, as expected, but doesn't block it outright.

 

Just to confirm that uninstalling the update does resolve the issue, but it's the kind of vulnerability I would rather have patched in the long run...

[TwistedHelixis]

What is MS up to. That's the third big update issue for me since June.

[Steve21]

It's normally added via the NetBIOS name e.g. as \\server\printer. I just tested with the FQDN \\server.domain.local\printer and it didn't change anything, alas, despite my brief surge of hope that it would

 

Sorry I meant within the PnP GPO. Did you add the server name (not printer) into that fully qualified?

 

Steve

[sonofsanta]

Sorry I meant within the PnP GPO. Did you add the server name (not printer) into that fully qualified?

 

Steve

 

We don't deploy by GPO anymore (it wasn't reliable for us, for whatever reason), we deploy by VBS script at logon, which is fine without this update. That does add via NetBIOS not FQDN, because I was too lazy to type the full thing out, but altering it didn't seem to make any difference. I would expect the manual add and the script behaviour to match up right now, given that it's all worked OK in the past.

[Steve21]

We don't deploy by GPO anymore (it wasn't reliable for us, for whatever reason), we deploy by VBS script at logon, which is fine without this update. That does add via NetBIOS not FQDN, because I was too lazy to type the full thing out, but altering it didn't seem to make any difference. I would expect the manual add and the script behaviour to match up right now, given that it's all worked OK in the past.

 

Sorry think I'm failing to explain

 

The point and print restriction GPOs limited what servers you can connect to to download a driver from.

 

Even if it's connecting via the VBS script if you have that not set it wouldn't allow you to download the drivers while it's connecting as per that link you posted above.

 

Steve

[sonofsanta]

Sorry think I'm failing to explain

 

The point and print restriction GPOs limited what servers you can connect to to download a driver from.

 

Even if it's connecting via the VBS script if you have that not set it wouldn't allow you to download the drivers while it's connecting as per that link you posted above.

 

Steve

 

Oooh sorry, the "users can only point and print to these servers"? Yeah, that's set with the FQDN. Tried ticking the "in their forest" box as well, tried various combinations of security prompts, nothing.

[DavR]

This has just hit me for all four of our main photocopiers, which is all the teachers can see to print from. I'm using Ricoh copiers and I've edited the drivers using their tool to make them prompt for print codes etc, and I can't go back from that. I guess this KB is seeing my edited driver as untrustworthy.

 

Luckily, most teachers have a cached profile on their machine with printers in, but its screwing new logons.

 

Glad I found this thread to know I'm not going mad!

 

Reckon I'll be looking at removing this update, unless anyone comes up with a way to permit drivers you trust.

[quiet_andy]

I've got the same issue but am struggling to find/block the update, although I think I might have prevented it in WSUS. Is there an easy way to remove updates via GPO or similar?

[DavR]

I've got the same issue but am struggling to find/block the update, although I think I might have prevented it in WSUS. Is there an easy way to remove updates via GPO or similar?

 

I've declined the update in WSUS (for Win 7, Win7 64 and Server 2012 in my environment).

 

I'm uninstalling the update by script, this command line works:

 

wusa /uninstall /kb:3170455 /quiet /norestart

[psydii]

Have people experiencing this open support cases with microsoft? I believe that support in the event of Windows breaking due to a security update is free? If not, a call is only £200.

 

You can open a ticket via this site: https://support.microsoft.com/en-gb/assistedsupportproducts

[Edjge]

This link has information on removing an update using WSUS. May come in handy.

 

Removing a bad patch using Microsoft Windows Server Update Service

[djwingfield]

I have resolved the issue with Windows 7 by applying the following GP settings for both user and Computer,

 

Computer Configuration

 

Administrative Templates > Printers

• Only use Package Point and print = Set to Disabled

• Point and Print Restrictions Enabled

• Users can only point and print to these servers: Enabled

○ Enter fully qualified server names separated by semicolons:

FQDN of the print server

• Security Prompts:

○ When installing drivers for a new connection: Do not show warning or elevation prompt

○ When updating drivers for an existing connection: Do not show warning or elevation prompt

 

User Configuration

 

Administrative Templates > Control Panel > Printers

• Only use Package Point and print = Set to Disabled

• Point and Print Restrictions Enabled

• Users can only point and print to these servers: Enabled

○ Enter fully qualified server names separated by semicolons:

FQDN of the print server

• Security Prompts:

○ When installing drivers for a new connection: Do not show warning or elevation prompt

○ When updating drivers for an existing connection: Do not show warning or elevation prompt

Edited August 17, 2016 by djwingfield

[fiza]

Thank you all. Removing the update has fixed things for me.

Is the solution to remove the patch or is it needed in any way? Should we be using the point and print settings as described by @djwingfield above?

Edited August 17, 2016 by fiza

[jakehildreth]

In my experience, if you add "Domain Computers" to the Scope of your printer deployment GPO, problems are eliminated.

[themightymrp]

Anybody else starting to experience this problem with the November rollup update KB3197868? I had uninstalled and blocked update KB3170455 but after the November update I'm getting it again For now I'm uninstalling it but I think I need to resolve the cause of this now.

[Arthur]

I had uninstalled and blocked update KB3170455 but after the November update I'm getting it again.

Yeah. With the updates being cumulative it will keep happening every Patch Tuesday until you resolve the issue.

 

I think I need to resolve the cause of this now.

I solved it by updating the drivers on our print server with the latest ones from the manufacturer which are package-aware. The registry edits didn't make any difference in our case.

 

If you have MFDs make a note of any options/settings beforehand just in case they get lost.

Edited November 11, 2016 by Arthur

[psydii]

The October preview of this month's updates implied that this would would be fixed:

 

 

October 18, 2016—KB3192403 (Preview of Monthly Rollup)

 

Perhaps as a test, remove the November CU and install KB3192403?

[robk]

I have a strange one with printing. Windows 7 X86 printing is fine... Windows 7 X64 is not. A windows update kills printing but not sure which one... With the cumulative updates now is not that helpful to even identify which update, just the fix!

 

No network printers installed, with a very strange error that seems to indicate can't set default printer!

 

The drivers in question are the Ricoh Universal PCL 6 drivers.

 

Is anyone else just seeing this affect 64bit windows 7?

[themightymrp]

Just reading this article:

 

https://support.microsoft.com/en-gb/kb/3170005

 

My server is 2012 R2 and currently, without any of the above reg mods the package aware column shows as True for everything. Am I right in suspecting that if I install the recommended update on my server and set the Point and Print settings in the GPO then it might cure my issue?