[1909, ou] Removing printer

[Ertech]

I have pushed out a network shared printer using GPO on user level (User Configuration > Preferences > Control Panel Settings > Printers > Shared Printer) which worked well - now it's time to remove the printer and I have changed the "UPDATE" action to "DELETE" but the printer is still on the computers.

 

The PC is getting the GPO but it's not removing the printer - any ideas on how to remove the printer?

 

Thanks in advance

[bezzoh]

Are you using client side processing? Its likely you are so even though its not being deployed reg keys are holding on to it. You can remove in a couple of ways.... Logon/Logoff script for each user (suitable example below,) and wipe out the entire 'client side processing reg key' ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider") so it doesn't come back for previous users of the system where profiles might have been 'cleaned up'. This reg key holds on to old UIDS, so if users come back even after profile deletion, it takes the printers back as well.

 

This is from a larger script, hence more Dim's than needed for this action but you'll get the point.. .This 'VBS' will remove network printers from a user profile;

 

 

 

Option Explicit

On Error Resume Next

 

Dim objShell : Set objShell = WScript.CreateObject("WScript.Shell")

Dim objNetwork : Set objNetwork = WScript.CreateObject("WScript.Network")

Dim objGroupList

Dim enumPrinters : Set enumPrinters = objNetwork.EnumPrinterConnections

Dim strWorkDir : strWorkDir = ObjShell.ExpandEnvironmentStrings("%temp%")

Dim strUser : strUser = objNetwork.UserName

Dim strDomain : strDomain = objNetwork.UserDomain

Dim strGroup

Dim objUser : Set objUser = GetObject("WinNT://" & strDomain & "/" & strUser & ",user")

Dim intCounter

Dim localPrinter : Set localPrinter = False

 

'Remove all current network printers

 

For intCounter = 1 to enumPrinters.Count -1 step 2

objNetwork.RemovePrinterConnection enumPrinters.Item(intCounter), true

Next

[Ertech]

It's a client side processing. I cannot get my head around on why the DELETE GPO is not doing the job - is there any other way of deleting the printer?

[Oaktech]

Create a Delete, 'Delete all shared printer connections' action at the top, remove the one you don't want to keep, leave any you do, let the GPO do it's thing.

 

There's a tiny processing overhead on the GPO with the delete all in place, but on modern hardware it's negligible.

Edited May 25, 2021 by Oaktech
clarity

[DavR]

The only way I've found through the printers GPO was to add a "delete all printer connections" command as first item in the list to run once only, and then let it re-add all your necessary other printers again after that. Other than that, you will need a script.

[Ertech]

I have just tried 'Delete all shared printer connections' but no luck - missing something?

[DavR]

I generally test these by logging a test user off, and back on. Sometimes it can take a few minutes for printers to process in the background.

[Oaktech]

I have just tried 'Delete all shared printer connections' but no luck - missing something?

 

Always worth a GPUpdate /sync when you make a change like that.

[Ertech]

I have the old GPO which has been changed from UPDATE to DELETE which seems to be causing a conflict - the separate GPO to 'Delete all shared printer connections' is failing (Error code:0x8007005) which is at the lower level for test purposes.

 

Can I not use two separate GPOs?

 

 

[Oaktech]

I have the old GPO which has been changed from UPDATE to DELETE which seems to be causing a conflict - the separate GPO to 'Delete all shared printer connections' is failing (Error code:0x8007005) which is at the lower level for test purposes.

 

Can I not use two separate GPOs?

 

 

 

 

Not sure - I've never tried it. I always use one GPO for all printers and item level targeting to differentiate between user groups. It's better for performance anyway.

[DavR]

Not sure - I've never tried it. I always use one GPO for all printers and item level targeting to differentiate between user groups. It's better for performance anyway.

 

Always done the same as @Oaktech there, and have all printer logic in one policy. In my policy, delete all printer connections is the first item, then printers via item level targeting after that.

[Ertech]

Hi All

 

I have tried the DeleteAllSharedPrinters GPO and it's giving a failure error Code: 0x80070005 on the GPRESULT - has anyone come across this issue before?

 

I have a error log on the client - event ID 10016

 

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{2593F8B9-numbers and characters}

and APPID

{15C20B67-numbers and characters}

to the user \username SID (S-1-5-21-1826920540-numbers-numbers…) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

 

 

 

Many thanks

Edited May 28, 2021 by Ertech

[Oaktech]

That's an access deinied...

 

Go into Common and tick 'run in security context of logged on user' and see if it helps.

 

Hi All

 

I have tried the DeleteAllSharedPrinters GPO and it's giving a failure error Code: 0x80070005 on the GPRESULT - has anyone come across this issue before?

 

I have a error log on the client - event ID 10016

 

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{2593F8B9-numbers and characters}

and APPID

{15C20B67-numbers and characters}

to the user \username SID (S-1-5-21-1826920540-numbers-numbers…) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

 

 

 

Many thanks

[Ertech]

I have just tried that but no luck - I'm running out of ideas.. any other suggestions?

[Oaktech]

This mechanism 100% works, but we need to get the right combination of user/computer policy settings, user/computer scopes and permissions

 

can we get a few screenshots of your policy, settings and scope?

[Ertech]

Oaktech I have just noticed something.. The main site printers have been pushed out by Print Deployment (not GPP) at the top domain level - having the "delete all shared printers" GPO at the bottom level or using both methods could be causing the problem? Edited May 28, 2021 by Ertech

[Oaktech]

Yes, I suspect that your user level GPO does not have rights to remove system level printers.

 

You can try recreating the GPO assigned to PCs, with a computer policy of delete all and then a user policy to create in the same policy, but that's a bit cludgey and I'm not really expecting it to work but it might be a quick fix.

 

Personally, I'd be abandoning the 'deployed printers' way of doing it, and moving everything, including the delete into the one GPO with item level targeting.

[Ertech]

I may need to find a logon script to delete the printers in the mean time - anyone have good powershell script to delete an individual network printer?

 

Printer targeting and rearranging is something for the future.

Edited May 28, 2021 by Ertech