Cannot Connect to domain printer W7 Client "A Policy is in Effect"

[pscowan]

I have an odd problem on my school network that has just reared its ugly head.

 

When I try to connect to a network printer from a machine on the domain I get the following error message -

 

"Connect to Printer - A Policy is in effect on your computer which prevents you from connecting to this print queue. Please contact your system administrator."

 

This has just started happening in the last few days and as far as both me and my colleague know we haven't made any changes to the network/GPO's or print queues which could have caused it.

It effected 1x laptop (not on the domain) last week and I fixed this by connecting directly to the IP address. It is now effecting several stations & laptops.

 

Server is Windows Server 2008 R2 and the clients are Windows 7.

There are two network printers (Ricoh Multi-Function) which are shared normally.

There is a batch file which runs a kikscript which allocates different rooms different printers which has not been changed in months.

 

Things I have tried -

 

-Restarting the spooling service & the printers themselves
-Stopping the spooler service and deleting items from the 'spool' folder, then starting up again.
-Checked the batch files & the kikscript for errors - nothing detected (these definitely haven't been changed so unlikely to be the issue)
-Connected as an Domain admin I noticed that the printers were present but as soon as I removed them, once I tried to connect them again I received the above error.
-Connected as a regular user without admin rights I get no printers - obviously this just proves that the script is not able to put them back.
-Logged in as a local admin, same error
-Changing the Local Computer Policy via MMC to "Allow print spooler to accept client connections"
-Completely removing a machine from the domain, logging in as local admin, same error.
-Created a 'generic' domain login and gave it admin rights (no groups etc), same result
-Checked that there was a policy in place on the server for 'Point to Print' - this is enabled with the 'users can only print to the machines in their forest' so this all looks good.
-Attempted a 'virus/malware/registry' clean of a random station to rule out anything nefarious
-Rebooting the server
-Creating a completely different print queue from the same IP address and connecting to that.

 

The things I haven't tried as it would guarantee no-one could access the printer while I was doing it -

 

-Completely re-installing the print driver/queue on the server from scratch including removing the current driver from the list of potential drivers on the print management screen
-Changing the script (we run a kikscript) to map the printer via an IP (haven't looked into whether this is even possible?)

 

I will update the post with the latest but this is what I have got to so far - any ideas?

Edited July 20, 2016 by pscowan

[NokiX]

Hi There,

 

I believe this will be a recent windows update:

 

http://www.edugeek.net/forums/windows-7/172860-kb3170455-preventing-printer-installation.html

 

If you remove kb3170455 from WSUS and uninstall it on the machines that should hopefully sort your problem.

Edited July 20, 2016 by NokiX
Spelling

[sonofsanta]

As @NokiX said--that's exactly the error message I got with the update installed.

 

Still not found an answer; just uninstalled it for now.

[pscowan]

legend I will try this windows update ty!

[pscowan]

Update listed as installed on effected computers on the 13th July, looks like this is the problem! Just now how to figure out how to uninstall the update using WSUS and decline it so it doesn't happen again! How does Microsoft expect this not to screw up millions of printers when using usigned drivers (99% of which are totally fine) ??

[pscowan]

OK trying a 'approve - removal'. I cant find the section that shows whether the update can be removed or not though, hopefully it will.

[DavR]

Update listed as installed on effected computers on the 13th July, looks like this is the problem! Just now how to figure out how to uninstall the update using WSUS and decline it so it doesn't happen again! How does Microsoft expect this not to screw up millions of printers when using usigned drivers (99% of which are totally fine) ??

 

Mentioned on the other thread, but if WSUS removal doesn't do it for you, the command line to uninstall this update is wusa /uninstall /kb:3170455 /quiet /norestart. I've currently got that in a startup script.

[M1k]

[system.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null

[system.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic') | Out-Null

 

$computer = [Microsoft.VisualBasic.Interaction]::InputBox("Uninstall KB3170455.", "Uninstall KB3170455", "Computername")

 

function Uninstall-Hotfix {

[cmdletbinding()]

param(

$computername = $env:computername,

[string] $HotfixID

)

 

$hotfixes = Get-WmiObject -ComputerName $computername -Class Win32_QuickFixEngineering | select hotfixid

 

if($hotfixes -match $hotfixID) {

$hotfixID = $HotfixID.Replace("KB","")

Write-host "Located KB3170455 on" $computer

Write-Host "Uninstalling..."

$UninstallString = "cmd.exe /c wusa.exe /uninstall /KB:$hotfixID /quiet /norestart"

([WMICLASS]"\\$computername\ROOT\CIMV2:win32_process").Create($UninstallString) | out-null

 

while (@(Get-Process wusa -computername $computername -ErrorAction SilentlyContinue).Count -ne 0) {

Start-Sleep 3

Write-Host "Waiting ..."

}

[system.Windows.Forms.Messagebox]::Show("KB3170455 now removed $computer")

}

else {

 

[system.Windows.Forms.Messagebox]::Show("KB3170455 cant be found on $computer")

 

return

}

 

}

 

Uninstall-HotFix -ComputerName $computer -HotfixID KB3170455 -ErrorAction SilentlyContinue