How to find out how a printer is getting deployed?

[BJG]

I'm investigating an IT suite on a network that I have relatively limited knowledge about or control over. They have a couple of PaperCut printers added automatically and I can't see where they're coming from. If you delete them, they reappear. I thought it must be group policy, but I haven't been able to trace any relevant settings so far so I'm wondering if it might be something else. (I don't have access to the PaperCut server.)

 

Is there some event log or diagnostic utility I could look at to find out how it's happening...? (I know about GPRresult.)

Edited December 4, 2019 by BJG

[Champagnetickler]

It's possible that the printers have been added using the printui command. To delete them open a command prompt and use printui /gd /n"\\servername\printshare". This will remove it from the machine. Give this a try on one machine and see if it deletes them after restarting the print spooler.

[ComboSmith]

You can use RSOP (resultant set of policies) on the machine to see all GPO settings being applied and which GPO they are coming from, a bit easier than GPResult in my experience

[djm968]

logon script?

[3s-gtech]

GP deployed printers (not GPP) don't show in the GP console unless you have Print Management installed. Usually easiest to install the GPMC onto your print server then look in there to see if they've been added this way. Took me ages to figure this one out!

[BJG]

Thanks for the replies; all useful stuff to know.

 

I found a thread somewhere where someone was complaining that rogue printers kept reappearing when deleted, until he deleted the relevant entry in the Windows registry here:

 

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider\Servers\

 

I'm not sure what this "Print providers" stuff is...but I think this might have worked...(so far at least, time will tell).

[2097]

DELTREE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers")

DELTREE("HKEY_USERS\.DEFAULT\Printers\ConvertUserDevModesCount")

DELTREE("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider")

 

My Rogue ones were in the .DEFAULT account IRC