Printing Issues "Driver Update Needed"

[gshaw]

@Michael thanks, the prompt settings for User are surprising for the "updating drivers" i.e. asking for a UAC prompt but if it works it works

 

Just tried on my test machine, HKLM reg keys look fine but no dice on the driver update. What brands have you had working? I need to get HP Universal PCL6 and Konica MFD series

[r0cketbev]

Hi All, remove this update and you will find your printers are working KB5005112

 

RB

[KK20]

I wasnt happy with disabling the restriction via the reg edit (our point and print restriction had already been set in the past). So we are stuck with kyocera type 4 universal drivers. The problem with those is the lack of device control for things such as forced monochrone etc. That is where we are at for the moment.

 

I did try installing the type 3 driver locally first (via startup script), I can verify the type 3 driver is present in the print management->drivers page, however, if another printer is added (with the same driver) then the prompt appears and needs admin credentials. so it seems that even with a type 3 installed I still get the prompt.

[Michael]

@Michael thanks, the prompt settings for User are surprising for the "updating drivers" i.e. asking for a UAC prompt but if it works it works

 

Just tried on my test machine, HKLM reg keys look fine but no dice on the driver update. What brands have you had working? I need to get HP Universal PCL6 and Konica MFD series

 

Xerox, Kyocera, Ricoh, RISO & Toshiba.

[Fazza]

Yes!

 

Computer Config > Policies > Admin Templates > Printers > Point and Print Restrictions

 

Specify server.fqdn and the drop down menus as follows:

 

[ATTACH=CONFIG]62973[/ATTACH]

 

Create a GPP regedit:

 

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint

Value: RestrictDriverInstallationToAdministrators

Dword: 0

 

Registry on a workstation should look like this -

 

[ATTACH=CONFIG]62975[/ATTACH]

 

User Config > Policies > Admin Templates > Control Panel > Printers > Point and Print Restrictions

 

Specify server.fqdn and the drop down menus as follows:

 

[ATTACH=CONFIG]62974[/ATTACH]

 

All working with Type 3 drivers. As I say, Microsoft's solution of disable Point and Print just isn't viable. Specifying your print server's FQDN via GPO is the best you can do to secure connections, but I expect in coming months they'll revise the guidance/recommendations.

 

I've just tried this but we're still getting the UAC prompt asking for an admin user name or password.

 

 

We've got at least 120+ members of staff and a large fleet of printers and all members of staff have had a laptop software refresh so a nice new clean build on them and now we're getting inundated with people wanting an admin password just to install a printer!

 

[psydii]

I wasnt happy with disabling the restriction via the reg edit (our point and print restriction had already been set in the past). So we are stuck with kyocera type 4 universal drivers. The problem with those is the lack of device control for things such as forced monochrone etc. That is where we are at for the moment.

 

I did try installing the type 3 driver locally first (via startup script), I can verify the type 3 driver is present in the print management->drivers page, however, if another printer is added (with the same driver) then the prompt appears and needs admin credentials. so it seems that even with a type 3 installed I still get the prompt.

 

To avoid this use the powershell command:

Add-Printer -Name "WhatYouWantThePrinterToBeCalled" -DriverName "PrinterDriverName" -PortName "\\serverfqdn\printersharename"

 

Using the GUI calls the point and print system and with Type 3 drivers that will usually triggers Elevation/UAC.

[DavR]

I'm glad I've found this thread, it explained what madness was going on with a couple of our printers last week!

 

Just to confuse things further though, we found the "Driver update needed" message was only coming up for us on our HP M404 printers, the older printers running Ricoh or HP Universal print drivers installed just fine, even after the August update. Changing from the HP M404 driver to HP Universal on these printers fixed the problem for us, so I left it at that.

 

We have point and print settings enabled in Computer Config only, and don't have the RestrictDriverInstallationToAdministrators hack in use.

[gshaw]

To avoid this use the powershell command:

Add-Printer -Name "WhatYouWantThePrinterToBeCalled" -DriverName "PrinterDriverName" -PortName "\\serverfqdn\printersharename"

 

Using the GUI calls the point and print system and with Type 3 drivers that will usually triggers Elevation/UAC.

 

This in combination with the driver install script mentioned earlier has let me install a Type 3 Konica printer as a user without elevation, promising...

 

Write-Host $PSScriptRoot
$drivers = Get-ChildItem -Path $PSScriptRoot\YOURDRIVERFOLDERGOESHERE -Recurse *.inf | Select-Object -ExpandProperty FullName
foreach ($driver in $drivers){
Start-Process -Wait "C:\Windows\System32\pnputil.exe" -ArgumentList "/add-driver `"$driver`" /install /subdirs" -NoNewWindow
Add-PrinterDriver "YOURDRIVERNAMEGOESHERE" -Verbose}

Add-Printer -Name "PRINTERNAME" -DriverName "YOURDRIVERNAMEGOESHERE" -PortName "\\PRINTSERVER.FQDN\PRINTERSHARE"

Edited September 8, 2021 by gshaw

[4HeadDev]

I've managed to get a working fix in place for this finally, using GPO task scheduler as a kind of bypass for those who are Server Administrators.

 

Create the following .bat script and store it in a share or local location:

 

net stop Spooler

reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 0 /f

net start Spooler

timeout /t 30 /nobreak > NUL

reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f

 

Task GPO should be set up to Update, run as the NT AUTHORITY\System account, run whether the user is logged in or not and run with the highest privilages. The trigger being 'At Logon'. You should have 'Start a program' set in actions and then pop in the shared or local path you desire. I find it much easier to use a shared path that everyone can see but can't actually modify. The task can also be removed via Actions: Delete from computers after a few days once the initial driver installation is done.

 

Once the user logs on, their printers should be back and the task can only be viewed with administrative permissions on the device it ran. The only clunky thing about this script is that it doesn't work well on remote working servers that have multiple users logging in. I'm still testing to find a work around for this bit, so I'll post when I have any updates.

[Rob414]

Brill psydii!!

This worked a treat for me in a domain environment. Just had to also deploy the print queues in GPO under computer section and your script in user logon and worked a treat

 

Rab

[banditelvis721]

ty so much

[KK20]

I personally find powershell to be a bit heavy for startupscripts, I tend to use VBS which are a bit lighter and seem to execute quicker. If you want to add printers using VBS then

 

Set WshNetwork = CreateObject("WScript.Network")
WshNetwork.AddWindowsPrinterConnection "\\\"
WshNetwork.SetDefaultPrinter "\\\"
set wshnetwork=nothing

 

works quite well.

 

If you wish to delete printers or clear things out then:

 

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colInstalledPrinters =  objWMIService.ExecQuery ("Select * from Win32_Printer Where Network = TRUE")
For Each objPrinter in colInstalledPrinters    
   objPrinter.Delete_
Next

 

obviously this will not bypass the admin requirements as a "user" but you can execute these under whatever security context you choose. I simply find VBS to be quicker.

Edited September 9, 2021 by KK20

[psydii]

I personally find powershell to be a bit heavy for startupscripts, I tend to use VBS which are a bit lighter and seem to execute quicker. If you want to add printers using VBS then

 

Set WshNetwork = CreateObject("WScript.Network")
WshNetwork.AddWindowsPrinterConnection "\\\"
WshNetwork.SetDefaultPrinter "\\\"
set wshnetwork=nothing

 

works quite well.

 

If you wish to delete printers or clear things out then:

 

strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colInstalledPrinters =  objWMIService.ExecQuery ("Select * from Win32_Printer Where Network = TRUE")
For Each objPrinter in colInstalledPrinters    
   objPrinter.Delete_
Next

 

obviously this will not bypass the admin requirements as a "user" but you can execute these under whatever security context you choose. I simply find VBS to be quicker.

 

The example vbs quoted does not solve the problem described in this thread. These scripts call the Point and Print system which is what is now broken by the latest MS update.

 

However a VBS equivalent to the PowerShell listed previously does exist in: C:\Windows\System32\Printing_Admin_Scripts\en-US

 

More info here: https://ss64.com/nt/prnmngr.html

 

Again the key is to create a local printer whose PORT has the name of \\print_server_fqdn\PrinterShare

[Theldron]

To avoid this use the powershell command:

Add-Printer -Name "WhatYouWantThePrinterToBeCalled" -DriverName "PrinterDriverName" -PortName "\\serverfqdn\printersharename"

 

Using the GUI calls the point and print system and with Type 3 drivers that will usually triggers Elevation/UAC.

 

Thank you so much, this saved my a**.

 

Setup a powershell script to install the driver from a local folder (GPO copied) and add the printer queues via the Add-Printer command and it is now working.

 

That has taken so much pressure off me.

[gshaw]

Has anyone heard if the latest round of MS updates is making any progress on giving us a solution that actually works for Point and Print? Can't find anything on the MS pages or usual tech news about anything.

 

@psydii when adding the UNC path port object it doesn't quite seem to function the same as a normal Point and Print object e.g. you don't see the current list of jobs. Wondering if there's going to be any other knock-ons with that e.g. PaperCut, need to test further before I can roll it out to our machines

 

Edit: just had an email alert suggesting it's fixed in the September updates, interesting. Wonder whether Point and Print gets reverted to previous behaviour or if the Type 3 UAC prompt is here to stay.

 

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958

Edited September 15, 2021 by gshaw

[Fazza]

Has anyone heard if the latest round of MS updates is making any progress on giving us a solution that actually works for Point and Print? Can't find anything on the MS pages or usual tech news about anything.

 

@psydii when adding the UNC path port object it doesn't quite seem to function the same as a normal Point and Print object e.g. you don't see the current list of jobs. Wondering if there's going to be any other knock-ons with that e.g. PaperCut, need to test further before I can roll it out to our machines

 

Edit: just had an email alert suggesting it's fixed in the September updates, interesting. Wonder whether Point and Print gets reverted to previous behaviour or if the Type 3 UAC prompt is here to stay.

 

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958

 

I though the latest thing Microsoft said was that it was going to be left to the printer manufacturers to write type 4 drivers - type 4 drivers were introduced in 2012 so they've had 9 years to write them but I guess until now they've never had a reason to spend time writing them and have stuck with the old type 3 postscript drivers rather than the type for XPS drivers.

[Jaan]

I though the latest thing Microsoft said was that it was going to be left to the printer manufacturers to write type 4 drivers - type 4 drivers were introduced in 2012 so they've had 9 years to write them but I guess until now they've never had a reason to spend time writing them and have stuck with the old type 3 postscript drivers rather than the type for XPS drivers.

 

i agree with this.... Microsoft will just say "We did warn you and make you aware of the changes".

 

this unofficial source is from 2016 https://blog.thinprint.com/the-new-microsoft-v4-printer-driver-model/

[HarkNowHear]

Edit: just had an email alert suggesting it's fixed in the September updates, interesting. Wonder whether Point and Print gets reverted to previous behaviour or if the Type 3 UAC prompt is here to stay.

 

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958

 

Had the same email I think. What this means with regard the previously suggested mitigations I'm not quite sure.

[stkidlasaint]

Well we have got the problem today with KYOCERA printers .

 

Surely our security team not keen on regedit settings

 

Also I see KYOCERA printer models got Type4 universal Microsoft KX v4 Printer Driver . But the problem is type 4 driver does not provide advance features

 

Still thinking for ideal fix for this:confused:

 

 

 

[Fazza]

Well we have got the problem today with KYOCERA printers .

 

Surely our security team not keen on regedit settings

 

Also I see KYOCERA printer models got Type4 universal Microsoft KX v4 Printer Driver . But the problem is type 4 driver does not provide advance features

 

Still thinking for ideal fix for this:confused:

 

 

 

 

With a bog standard printer like a HP Colour LaserJet printer that have no special features a Type 4 driver would be OK but if you have a MFD with finishers on it such as hole punching and stapling then I believe it's those advanced features that are no available with a T4 driver.

[StephenPink]

Okay something has definitely changed with the September patches, just not sure what - we're getting a LOT of requests with UAC prompts now, that previously wasn't happening (having made the recommended tweaks/workaround) No clue what's going on! Sigh.

[Jaan]

I'm Still gonna wait to what microsoft's official response is post sept/21 cumulative update.... on my test enviro, "no printers installed". although i haven't made any reg changes as i dont want to be vulnerable, nor have i deployed type4 drivers (not that i have them)

[FN-GM]

Hello,

 

For other reasons we are a couple of months behind on patching. (I know!)

 

Anyway, on a freshly imaged test machine we have updated to 2021-09 Cumulative Update for Windows 10 Version 2004 for x64-based Systems (KB5005565).

 

Our printers are deployed to users from the print server. So I was expecting to have issues with the drivers installing once this update had been deployed.

 

However, everything on the test machines seems fine. The drivers hadn't previously been installed - it was a clean image.

 

Have I missed something?

 

Thanks

Edited September 16, 2021 by FN-GM

[stkidlasaint]

True that

[stkidlasaint]

With a bog standard printer like a HP Colour LaserJet printer that have no special features a Type 4 driver would be OK but if you have a MFD with finishers on it such as hole punching and stapling then I believe it's those advanced features that are no available with a T4 driver.

 

Yeah true that.