Koldov Posted July 9, 2021 Posted July 9, 2021 Is this even possible...? I am trying to create a situation where all printers are installed by GPP and users cannot install a printer.... any printer. I did manage to stop it once, but I've made so many changes I can't remember what it was and it actually stopped all the GPP printers installing too! Am I missing something obvious? I have a standard user with no GPOs applying I have a fresh domain joined Windows 10 VM in an OU with no GPOs applied except: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies/Security Options - Devices: Prevent users from installing printer drivers But I can still quite happily browse to \\server\printer and install it! How do you do it?
LeMarchand Posted July 9, 2021 Posted July 9, 2021 I've got a feeling this doesn't work, but not got time to test it. What about unticking the "List in the directory"" box? or only allowing certain users to print to it? 1
Koldov Posted July 9, 2021 Author Posted July 9, 2021 (edited) They are 'unlisted' in the directory, but this only seems to have the impact that they don't show up in the 'printers & scanners - add a printer or scanner' dialogue box... Click on 'The printer that I want isn't listed' and get to the 'advanced printer setup' dialogue box - 'select a shared printer by name', type \\server\... and the list comes up, select it and it installs... The users permission thing might be quite a task as obviously I'm looking at a site-wide, all-users setting. I don't want to hide them as such (obscurity) or stop anyone printing to a particular printer. It's more of a run-on from Print Nightmare and I wondered if I could just stop the actual user from initiating any sort of printer install, that can only be a good thing... So, I guess it isn't a simple question, as it seems with Windows 10 and server 2012R2 having packaged and signed drivers even basic domain users can install them, no matter what I do. Even when I apply Point and Print with 'require elevation' it doesn't stop the install or ask for elevation! Edited July 9, 2021 by Koldov
AliG Posted July 9, 2021 Posted July 9, 2021 Maybe you have the GPO option Point and Print restrictions set which allow the print server and allows users to install drivers via this setting
Koldov Posted July 9, 2021 Author Posted July 9, 2021 Yeah, for the main Domain I have, but this computer and user don't have any domain GPOs applied.
localzuk Posted July 9, 2021 Posted July 9, 2021 I think you're looking for point and print settings. https://docs.microsoft.com/en-us/troubleshoot/windows-server/printing/use-group-policy-to-control-ad-printer
Koldov Posted July 9, 2021 Author Posted July 9, 2021 (edited) Thing is... I already have that enabled on the Domain (not on this user or computer though) it is also best to have it disabled from what I've read, so that's what I'm aiming for. I've tried it enabled and it doesn't work here for some reason... no warning, no elevation needed... just installs the printer! I want to stop users being able to install printers.... Edited July 9, 2021 by Koldov
localzuk Posted July 9, 2021 Posted July 9, 2021 Thing is... I already have that enabled on the Domain (not on this user or computer though - it is also best to have it disabled from what I've read, so that's what I'm aiming for. I've tried it enabled and it doesn't work here for some reason... no warning, no elevation needed... just installs the printer! I want to stop users being able to install printers.... Are you applying it on a computer level, or a user level? As there are settings for both IIRC?
Koldov Posted July 9, 2021 Author Posted July 9, 2021 Currently on the main domain it is set for both, for the test computer I have tried it set in Computer, then user, then both... Nothing works...
AliG Posted July 9, 2021 Posted July 9, 2021 Maybe this is the behavior of the current vulnerability?
AliG Posted July 9, 2021 Posted July 9, 2021 A slightly related question, if you are using GPP to deploy printers then do you need to have the point and print settings configured or can this be turned off? I understood the print and point setting was required so that general users are not prompted to install drivers.
Koldov Posted July 9, 2021 Author Posted July 9, 2021 (edited) Thing is... regardless of whether I have 'Point and Print' enabled on the client or the user, both or not at all, it seems standard users can just install printers from the server... That isn't right is it? Is there something I've done on the servers, or when installing the printers on the server, or is it something in a domain wide policy that applied on the servers that enables this behaviour...? I did try the first few attempts with a totally clean, no GPO computer and user, so client-side the 'Point and Print' settings shouldn't have any bearing (they weren't on in that case). But yes, I am trying to move away from having this enabled! Edited July 9, 2021 by Koldov
Koldov Posted July 9, 2021 Author Posted July 9, 2021 It is useful though sometimes for a user that didn't quite catch the GPP applying when they log-on, so they can just add the printer.
LeMarchand Posted July 9, 2021 Posted July 9, 2021 Click on 'The printer that I want isn't listed' and get to the 'advanced printer setup' dialogue box - 'select a shared printer by name', type \\server\... and the list comes up, select it and it installs... This do anything?
jthompson Posted July 9, 2021 Posted July 9, 2021 I've not been working in this here, but I'm wondering if there's a distinction between installing a printer driver, and adding a printer. If the client computer already has a driver available, it may not need to download and install a driver supplied by the print server when adding a printer.
jthompson Posted July 9, 2021 Posted July 9, 2021 What about User Configuration > Policies > Administrative Templates > Control Panel > Printers > Prevent addition of printers?
Koldov Posted July 9, 2021 Author Posted July 9, 2021 I do see in the dialogue that it looks for a driver and then downloads a driver and installs it. Thing is I don't want to rely on hiding anything... I want to stop the actual mechanism of them adding/installing a printer (which I thought was default). I have read that if a driver is installed it will just use that and if an admin has installed it previously it can be connected again. I'm just doing this on a fresh VM domain joined computer, with a standard user (no GPOs) apart from ones I have to add in trying to stop it... This can't be default behaviour can it? I didn't think standard users were allowed, what am I missing? I guess the question is does anyone else know if standard users can install printers in their environment - if not how did you stop it?! I'm not sure what method Print Nightmare actually uses (what code or scripts, python, powershell etc.), but I figure that hiding anything won't do much good.
Koldov Posted July 9, 2021 Author Posted July 9, 2021 What about User Configuration > Policies > Administrative Templates > Control Panel > Printers > Prevent addition of printers? Yeah, I think I did look at that but... " However, this setting does not prevent users from using the Add Hardware Wizard to add a printer. Nor does it prevent users from running other programs to add printers."
jthompson Posted July 9, 2021 Posted July 9, 2021 I wonder whether one solution might be modifying the ACL on the spooler folder (https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/). The problem you have there is when it comes to adding the printers that you actually want added.
Koldov Posted July 9, 2021 Author Posted July 9, 2021 Yeah I've already done most of the recommended mitigations. This was to be an over and above step, but one that I wouldn't mind having as a default behaviour (which I believed it was anyway)...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now