Printing Issues "Driver Update Needed"

[talksr]

Yes, it is the same process for 'Approve' and 'Approve for Removal' - after you choose 'Approve' the dialogue box in my previous post will come up and (if it has been approved previously I think) the option for removal (if it is possible - some aren't) will be available to select.

 

Hmmm... I don't have any choice but Window > Update Services...

 

You can close down the console and go into USER > APPDATA > MICROSOFT > MMC and rename wsus to wsus.bak to get a completely fresh console when reopening...

 

There's some good info on removing WSUS before reinstalling it here:

 

https://www.ajtek.ca/wsus/how-to-remove-wsus-completely-and-reinstall-it/

 

I would certainly fire up a print server on the 2019 box (if it isn't a DC) it can't hurt, I'm reasonably certain it is the server that should avoid the update (not recommended) the clients are OK with it. Depends on a lot of things still like drivers versions and such, some people are saying all updates installed and it is working, some need workarounds and reg tweaks... such a mess.

 

If you could do it in parallel and once created set only a test OU of devices up to connect to it?

 

 

Thanks again for your really helpful posts.

Ok, I got the WSUS view back so everything is showing. I located the update again within WSUS, Approved and then Approved for Removal just as you said. I then went back to the update in question and selected Deadline. I set the deadline to 14th Sep meaning that as soon as my server polls the WSUS server to check for updates, it should try and remove this update.

 

I went to Windows Updates on the server, it it picked up the exact update in question, was saying it was installing it, but left it to run and now have this.

 

 

So we are getting somewhere (thanks massively to your help), but still, this server is not playing ball.

Could it be to do with the fact I have re-created Software Distribution folder?

 

I am going to look in to the print server on the 2019 server as I am thinking this will work as a workaround, but just feel so close with this 2016 server, I may not need to go down that route if I can get this update removed (for now).

[FN-GM]

Does anyone have a method of exporting the print drivers from the server please? I intend to push them out via SCCM.

 

Export-WindowsDriver will probably print everything out.

 

I did export to file form the management console and they not in a format that is easy to work with.

 

We are using both Type 3 & 4 drivers.

 

Thanks

[MicrodigitUK]

Does anyone have a method of exporting the print drivers from the server please? I intend to push them out via SCCM.

 

Export-WindowsDriver will probably print everything out.

 

I did export to file form the management console and they not in a format that is easy to work with.

 

We are using both Type 3 & 4 drivers.

 

Thanks

 

On print server open printmanagement.msc

Browse down to drivers section

For the driver you need make a note of the column “Inf Path”

This will be in c:\windows\System32\DriverStore\…

If you copy the entire folder from this path that contains the “.inf” file, this will give you all the files needed to import the driver onto another system, or install via SCCM driver package.

[psydii]

I have just come across this little titbit: if your print servers are 2019+ then type 3 drivers work for GPP deployment of printers with point and print restrictions applied.

 

If they are 2016 or earlier, they do/might not.

 

 

Its buried in this blog post https://www.mdmandgpanswers.com/blogs/view-blog/the-ultimate-guide-to-printnightmare-and-overcoming-it

 

Apologies if this was already stated here, a quick forum search didn't indicate that is was.

[4HeadDev]

Over a dozen of the clients I manage have Windows 2019 Servers and Print Servers with Type 3 drivers, and P&P restrictions are correctly applied to these. Unfortunately one of these work following the August 10th and September 14th update. I can only get them to work by outright removing the September 14th patch from the Print Server and doing a workaround for the August 10th patch.

 

Has anyone else had any luck with this?

[4HeadDev]

Also just to add, papercut has stated that Type 4 Drivers dooes not work with them. Only Type 3 does.

[FN-GM]

On print server open printmanagement.msc

Browse down to drivers section

For the driver you need make a note of the column “Inf Path”

This will be in c:\windows\System32\DriverStore\…

If you copy the entire folder from this path that contains the “.inf” file, this will give you all the files needed to import the driver onto another system, or install via SCCM driver package.

 

Argh! That's going to be a lot of work! I was hoping there would be a bulk way of extracting these.

[DrCheese]

Also just to add, papercut has stated that Type 4 Drivers dooes not work with them. Only Type 3 does.

 

They do work with them, but you lose some of the features

https://www.papercut.com/kb/Main/WindowsType4PrintDrivers

 

They're going to have to sort it tho, unless they want to be telling their customers to put out unsecure setups

[Koldov]

This is so random....

 

Just had the one of the receptionists ring me and say the computer is asking her for a printer driver!

 

Client fully updated for weeks, Server still not had the update done, nothing has changed and apparently she was printing fine yesterday...

 

Applied the Point and Print GPO (with reg edit) and off she goes!

[ajs]

Argh! That's going to be a lot of work! I was hoping there would be a bulk way of extracting these.

 

There's a small section in the following link that covers exporting/importing printer drivers as a package through the use of two commands that may be useful: https://lakeforestconsulting.com/adminprintnightmare/

[kingoranks]

Is everyone back to 100% printing in their school? do you have a papercut running fine?

[Jaan]

Is everyone back to 100% printing in their school? do you have a papercut running fine?

 

We have the latest version of Papercut installed using TYPE3 drivers, deployed via GPO. Unfortunately i was asked by powers that be to deploy the reg fix to get us up and running again

[Michael]

Is everyone back to 100% printing in their school? do you have a papercut running fine?

 

Yes, no problems.

[Duke5A]

Argh! That's going to be a lot of work! I was hoping there would be a bulk way of extracting these.

 

Yeah, I don't know why you can't pipe 'Get-WindowsDriver' to 'Export-WindowsDriver'. The get cmdlet gives you the path to the driver in the driverstore folder, so at least we can work with that.

 

$Destination = ".\StuffGoHere"

$Drivers = Get-WindowsDriver -Online | Where-Object {$_.ClassName -eq "Printer"}

Foreach ($Driver in $Drivers) {

   $Source = (Get-Item $Driver.OriginalFileName).Directory.FullName

   Copy-Item -Path $Source -Destination $Destination -Recurse
   
}

[Duke5A]

This is what is working in most situations. Only catch is the client and server need to be at the same patch level. In my case everything has the September 2021 cumulative update.

 

 

In some situations though the driver doesn't want to update. If the printer still isn't showing up then browse the shares on the print server manually and try adding the printer by hand. If it errors out still then there is one more thing to try.

 

1. Stop print spooler service
   
2. Remove affected print driver keys from registry
    
   

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers

   
    
   

3. Start service
   
4. Remove print driver from driver store file repository
    
   You'll need to take ownership and give yourself write access to delete the folder
   

   C:\Windows\System32\DriverStore\FileRepository

   
    
   

5. Attempt adding printer by hand again
   

 

On the few problem teacher workstations I have that refuse to add printers after the GPO fix the above works every time.

 

Cheers.

Edited October 8, 2021 by Duke5A

[4HeadDev]

Update:

 

Have now managed to resolve this on some servers by upgrading to Windows 10 21H1 on the clients alongside the following updates on the Print Server:

KB5005568 (Windows Server 2019)

KB5005573 (Windows Server 2016)

KB5005613 (Windows Server 2012 R2)

KB5005627 (Windows Server 2012 R2)

 

Most of the clients that we support weren't upgrading automatically because WSUS hadn't picked the upgrade yet. Only about 20% of the print servers we support have picked it up, which makes this 'fix' sort of unreliable. I'm also hearing that 20H2, KB5005031 and KB5005033 can also fix this but I have yet to find any actual proff, as I was testing the 20H2 upgrade on several clients and had very varied results.

[liamrobinson]

eejy - My DC didn't have the \Printers\PointAndPrint subkeys after the Windows NT in Regedit (Possibly because no printers installed). When using the browser to find the reg key location i couldn't go any further than Windows NT, i typed the full path into the box instead of using the browser but that didn't seem to work on my clients.

 

After manually creating the \Printers\PointAndPrint subkeys on my DC, the using the location browser, the regkey now applies to the clients and the printers are deploying via GPO again.

 

It's a shame there's no real fx without compromising security, lets see what they bring tomorrow, my guess is more issues!

[StephenPink]

So I spotted this one in Patch Tuesday's list: CVE-2021-36970

 

More details here: Microsoft’s October 2021 Patch Tuesday Addresses 74 CVEs (CVE-2021-40449) - Blog | Tenable® but still no real explanation as to what the patch fixes/does that I can find. Chances of this making things better or worse? Anyone care to take some bets?

 

Cheers,

Stephen

[Michael]

Interesting -

 

Implements a Group Policy setting for the following registry value:

 

Registry location: HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint

 

Value name: RestrictDriverInstallationToAdministrators

 

Value data: 1

 

Taken from here. Looks like this registry entry is here to stay!

[DavR]

Interesting -

Taken from here. Looks like this registry entry is here to stay!

 

Does anyone know if that registry entry has made it into an update ADMX yet?

 

The above link suggests it is being formalised as a group policy option, but I can't see any updated ADMX files to download for Windows 10 (we're on 20H2).

 

We've found that this has become an issue for us just with the October update, so we are about to deploy this reg key, with P&P policy restrictions as mitigations.

[ITGuyNW]

Just tested the October CU (5006667) on a client and bang "Do you trust this printer?"

[TwistedHelixis]

Sorry, I am getting so confussed by all this.

 

I have created the following reg edit key in group policy...

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint

 

Value name: RestrictDriverInstallationToAdministrators

 

Value type: REG_DWORD & Value data: 0

 

Do I need to do anything else to allow admins & non admins to print?

[Michael]

See next post! Edited October 20, 2021 by Michael

[Michael]

Edit: That looks correct to me.

 

All details you need are in a previous post I wrote here.

 

Works with August/September/October updates in my testing.

[TwistedHelixis]

@Michael

On the page you have linked to you have both...

 

Computer Config > Policies > Admin Templates > Printers > Point and Print Restrictions

 

User Config > Policies > Admin Templates > Control Panel > Printers > Point and Print Restrictions

 

Are you deploying both on your domain or just the one that matches how your printers are deployed?