Printing Issues "Driver Update Needed"

[mullet_man]

Yep so after investigating my issue seems to be with some staff laptops that are still on 1809, it's a nightmare getting them back from staff to update. Not being able to print will mean they will have to bring their laptop in for an update.

[4HeadDev]

Just for awareness, the only way I've been able to fix the issues caused by the latest 14th September Microsoft patch are by outright uninstalling it. The affected patches for servers are:

 

KB5005568 (Windows Server 2019)

KB5005573 (Windows Server 2016)

KB5005613 (Windows Server 2012 R2)

KB5005627 (Windows Server 2012 R2)

KB5005623 (Windows Server 2012)

KB5005607 (Windows Server 2012)

KB5005606 (Windows Server 2008)

KB5005618 (Windows Server 2008)

KB5005565 (Windows 10 2004, 20H2, and 21H1)

KB5005566 (Windows 10 1909)

KB5005615 (Windows 7 Windows Server 2008 R2)

 

It's probably important to note that if you're using a WSUS, to decline the update you're about to remove or it WILL come back with a vengence...

 

Slightly worried as the issues with the current patch because it's outright denying access for clients when pulling the print packages from the print server... But will have to see how it goes. Cause' what microsoft have done at the moment completely prevents you from deploying printers normally.

Edited September 20, 2021 by 4HeadDev
Spelling

[Koldov]

I don't use WSUS for my servers for this exact reason luckily, but I saw the 'updates available' message last week.

 

I kept meaning to VPN in out of hours and do them (along with some other maintenance), but forgot about it and then this blew up and I was glad I didn't!

[NetworkServices]

Weirdly this issue has only affected our users who share their printers from their workstations rather than our main fleet of printers that are shared from a server. The "Cannot connect to printer" message was popping up on any machine that tried to connect to the printer share. Removing KB5005565 from the workstation that shares the printer seemed to do the trick but as I am not keen on leaving machines unpatched I discovered that I could leave KB5005565 in place and modify the registry instead. Adding the following key and then restarting the spooler service allowed other workstations to connect to the shared printer...

 

HKLM\System\CurrentControlSet\Control\Print

 

"RpcAuthnLevelPrivacyEnabled"=dword:00000000

Edited September 20, 2021 by NetworkServices

[Norphy]

Weirdly this issue has only affected our users who share their printers from their workstations rather than our main fleet of printers that are shared from a server. The "Cannot connect to printer" message was popping up on any machine that tried to connect to the printer share. Removing KB5005565 from the workstation that shares the printer seemed to do the trick but as I am not keen on leaving machines unpatched I discovered that I could leave KB5005565 in place and modify the registry instead. Adding the following key and then restarting the spooler service allowed other workstations to connect to the shared printer...

 

HKLM\System\CurrentControlSet\Control\Print

 

"RpcAuthnLevelPrivacyEnabled"=dword:00000000

 

Thanks, that's worked for me as well.

 

Now the question is, what does this key do?

 

/edit

 

https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25

 

hmph. Looks like this was planned.

Edited September 20, 2021 by Norphy

[Koldov]

Thanks, that's worked for me as well.

 

Now the question is, what does this key do?

 

And have we just exposed another hole in the 'patch'work quilt of Windows Security...

 

This is just for clients who are sharing printers to other clients, acting as a 'print server' but not really a 'Print Server'?

 

Would this still work if the client that is sharing the printer had already got the '“Allow Print Spooler to accept client connections” policy set to disabled?

 

EDIT: NOT exposed, as they already knew about it, but reversing the regedit leaves you vulnerable...?

 

EDIT 2: Hold on, so this another patch that only enforces if we add the regedit in manually ourselves...?

Edited September 20, 2021 by Koldov

[Norphy]

This is just for clients who are sharing printers to other clients, acting as a 'print server' but not really a 'Print Server'?

 

For what it's worth, my testbed is a pair of VMs, one running Server 2016 and the other running Windows 10. Both are on 2021-09 and before that registry key was put in, I was getting the "error 0x0000011b" error.

[4HeadDev]

The issue with this new patch seems to directly just affect the print server, I found once I uninstalled the patch from the print servers for our clients. The clients work fine after they sign back in.

 

Error code varies between 0x8007011b and 0x0000011b.

 

I've also had to use the wushowhide.diagcab tool to prevent the update from reinstalling when WSUS syncs so... there's that too.

Edited September 20, 2021 by 4HeadDev
Still can't spell...

[Koldov]

It is such a shame MS have made such a horribly confusing mess of this.

 

I know they were caught with their pants down due to the public exposure of the vulnerabilities and have really knee-jerked shutting down whole areas of functionality that we have relied on for years (with very little in the way of help apart from saying, 'yes you can get around it but then you are vulnerable - your call').

 

They must know that to completely cripple the printing system will just encourage (or force) a vast amount of sysadmins to just unistall the updates or work around the fixes they are trying to put in place!

 

Might have to dig out the old 'wushowhide.cab' myself as although I was feeling fairly smug at not having done the update, I have realised the servers are set to download it, just not install (set to just notify now after this)...

Edited September 20, 2021 by Koldov

[4HeadDev]

It may be worth hiding that update, I have a few of the servers we support that have downloaded it and are awaiting an install, and even then it appears to have broken their printers. Have had to restart, install the update, and then remove it from WSUS and the server itself.

 

It really is messy, and seeing some of the fixes that people are putting together is pretty scary because of the methods they're using. Half of them are just re-exposing their systems again. The lengths people are going to is extreme.

[NetworkServices]

And have we just exposed another hole in the 'patch'work quilt of Windows Security...

 

Quite possibly. However you'd have weigh up the acceptable level of risk by performing this registry modification. For us there are only three workstations on site that share their local printer so applying this to only those three machines was deemed acceptable. It wasn't necessary to apply it to all clients on the network.

 

There are other critical fixes included in KB500565 so uninstalling this was something that I preferred to avoid if possible.

[4HeadDev]

Out of curiosity, has anyone had luck with further updating their computers which fixes the network printer issues?

 

I have a client claiming that upon updating their computer with KB5005565 and KB5005699 (I think this is a new SSU as there are no hits for it on google) it fixed their printer issues. I've tried this one a few other devices and have had no luck.

[FN-GM]

Out of curiosity, has anyone had luck with further updating their computers which fixes the network printer issues?

 

I have a client claiming that upon updating their computer with KB5005565 and KB5005699 (I think this is a new SSU as there are no hits for it on google) it fixed their printer issues. I've tried this one a few other devices and have had no luck.

 

I missed a few patches. I installed the September batch on Windows 10 and had 0 issues.

 

Although I suspect patching the print server will cause the issue?

[Jaan]

I missed a few patches. I installed the September batch on Windows 10 and had 0 issues.

 

Although I suspect patching the print server will cause the issue?

 

I'd love to be in your senario right now

[gshaw]

If anyone is having issues with Konica drivers I've just managed to get a test machine to map a Point and Print shared printer by pre-installing the Universal driver 3.9.0.0 (rather than the model-specific one) Edited September 21, 2021 by gshaw

[Jaan]

If anyone is having issues with Konica drivers I've just managed to get a test machine to map a Point and Print shared printer by pre-installing the Universal driver 3.9.0.0 (rather than the model-specific one)

 

Interesting, Is this a actual Konica printer or Develop branded printer you have on site?

 

cheers

[gshaw]

Interesting, Is this a actual Konica printer or Develop branded printer you have on site?

 

cheers

 

All Konica branded MFDs, was using the C658PCL v11.1.2.0 previously but that won't deploy without UAC prompts even with it pre-installed on the machine. Been told there's certificate issues with that driver so perhaps that's why.

 

The Type 4 Universal also works but due to MS recent updates the client only gets the very basic "Microsoft enhanced Point and Print driver" which really doesn't give you many options

 

Pre-install script (obtained from earlier in the thread) goes like this

 

$drivers = Get-ChildItem -Path $PSScriptRoot\UPDPCL6Win_3900MU -Recurse *.inf | Select-Object -ExpandProperty FullName
foreach ($driver in $drivers){
Start-Process -Wait "C:\Windows\System32\pnputil.exe" -ArgumentList "/add-driver `"$driver`" /install /subdirs" -NoNewWindow
Add-PrinterDriver "KONICA MINOLTA Universal PCL" -Verbose}

[215HAN]

Having removed KB5005565, I'm still having issues connecting to the printer with code 0x0000011b. What further do I need to do to get this working again?

 

Sorry, if this is being repeated but having a little panic here as this is having a domino effect on staff at school I am at.

 

Please help!

[4HeadDev]

Having removed KB5005565, I'm still having issues connecting to the printer with code 0x0000011b. What further do I need to do to get this working again?

 

Sorry, if this is being repeated but having a little panic here as this is having a domino effect on staff at school I am at.

 

Please help!

You'll need to remove the patch on your print server, rather than the client machines. One of these will be the affected patches:

 

KB5005568 (Windows Server 2019)

KB5005573 (Windows Server 2016)

KB5005613 (Windows Server 2012 R2)

KB5005627 (Windows Server 2012 R2)

[Jaan]

You'll need to remove the patch on your print server, rather than the client machines. One of these will be the affected patches:

 

KB5005568 (Windows Server 2019)

KB5005573 (Windows Server 2016)

KB5005613 (Windows Server 2012 R2)

KB5005627 (Windows Server 2012 R2)

 

 

So not both?

[dfergusson]

The Type 4 Universal also works but due to MS recent updates the client only gets the very basic "Microsoft enhanced Point and Print driver" which really doesn't give you many options

[/code]

 

We are using Universal Type 4 drivers, but have also pushed these drivers out to the clients so they get the enhanced printing options.

[4HeadDev]

No. I currently support dozens of servers and I've found that only removing the problem patch from the print server works. The machines seem fine with the patch.

[Koldov]

I have Windows 10 clients that are fully updated with the September CU and have successfully pushed out printers via a computer GPP to them.

 

My servers (2012R2) have NOT updated to the to the September CU though.

 

I signed on to the laptop as a user who has never signed on to that laptop (as expected the user did not get any printers from the 'User' GPP) even though the drivers are on the machine... So to test this I deleted all the printers on the laptop and 'cleaned' out all the drivers from 'Print Management'. Moved the laptop to an OU with 2 'Computer' printer install GPPs, restarted and signed on as that user who now can see the 2 printers. Moved it back to its usual OU and restarted, user still sees the 2 printers.

@Jaan - as @4HeadDev says, it seems the September patch is removed just from your print server (at your own risk).

[Jaan]

The scenario i have here now.....

 

Server 2019 (1809)

Windows 10 (1809 ltsc)

 

Fully patched - inc Sept update (Servers and clients)

 

Just check this GPO on the Print server: "Allow Print Spooler to accept client connections"

found at: Computer---Policies---Admin Templates---Printers

mines set to "Not configured"

Start stop of spooler needed/or restart

 

I have the below set in GPO for clients and the print server;

 

Computer---Policies---Administrative Templates---Printers---

 

Package Point and print Approved servers - Enabled

Enter fully qualified server names - Printservername.domain.name

 

 

Point and Print Restrictions - Enabled

Users can only point and print to these servers - Enabled

Enter fully qualified server names separated by semicolons - Printservername.domain.name;

Users can only point and print to machines in their forest - Disabled

 

Security Prompts:

When installing drivers for a new connection: Do not show warning or elevation prompt

When updating drivers for an existing connection: Do not show warning or elevation prompt

 

I also Have the below Reg "Fix" that from what i understand, negates the need for any of the above needing to be define..... however i still have the above set up.

The below Reg entry "should" restore the printing ability, however it also makes you vulnerable to the Printnightmare vulnerability. Use at your own risk.

 

it's worth noting that the below reg entries are not currently present.... you are creating them. I have mine to "Remove this item when it is no longer applied - Yes" which changes the Action to "Replace". So dont be confused by that.

 

 

Computer---Preferences---Windows Settings---Registry

 

Hive: HKEY_LOCAL_MACHINE

Key path: SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint

Value name: RestrictDriverInstallationToAdministrators

Value type: REG_DWORD

Value data: 0x0 (0)

 

Edited September 22, 2021 by Jaan

[Koldov]

And that's the rub...

 

There will be some techs that may have done other 'fixes' that mean something won't work quite right... or will break the fixes!

 

EDIT: Mines a bit of a faff if you're trying to do per user and not everyone has the same network config or users and can't restart machines but we only have a few users so it works here without any Point and Print or regedits I think....