Printing Issues "Driver Update Needed"

[Dungas1337]

I do not know what guys are doing different. I followed Microsoft practices for configuring security settings. Then, i connected to all available printers published on printerserver which will then download neccessary drivers, of course with local admin. Then use builtin export drivers powershell function to a folder. Removed all non-printerdrivers. Then use this exported folder to deploy once with SCCM for example to all devices. Now when that is all done, users can connect to any printershare without admin. So long as client has same driver as printerservers (assuming you do not update printerdriver on the serverside to another version of course) all will work flawelessly.

 

Now when a new printerdriver is published, repeat steps above and only published the delta to endpoints and you are good to go.

[Darylrese]

Well today i realise tha most TCT/IP deployed printers show but dont actually print. Printers deployed via group policy from our print server dont appear in the list of printers on workstations for admin or for standard users. I am a bit stumped. Its not a driver issue as it doesnt ask for one as admin and i injected all our print drivers into the wim.

 

If user explores the print share and connects to the printer it works fine it just wont deploy it automatically through gpo or script.

 

Works well with papercut deploy but it is expensive and i need to work out if it can allocate to workstations rather than IP ranges.

 

I have updated all workstations to 21H2, fully patched the print server, made all the recommended changes to point and print gpo

 

You had any luck @talksr

Edited April 5, 2022 by Darylrese

[talksr]

Well today i realise tha most TCT/IP deployed printers show but dont actually print. Printers deployed via group policy from our print server dont appear in the list of printers on workstations for admin or for standard users. I am a bit stumped. Its not a driver issue as it doesnt ask for one as admin and i injected all our print drivers into the wim.

 

If user explores the print share and connects to the printer it works fine it just wont deploy it automatically through gpo or script.

 

Works well with papercut deploy but it is expensive and i need to work out if it can allocate to workstations rather than IP ranges.

 

I have updated all workstations to 21H2, fully patched the print server, made all the recommended changes to point and print gpo

 

You had any luck @talksr

 

Hello, sorry for the slow reply, my school is closed over Easter so I was unable to see if it was still not working.

 

**Update.... still not working, same problem as before. I have tried to contact Microsoft several ways and I have had no responses which as always is really, really helpful - thanks Microsoft, I would wholeheartedly not recommend your software to any schools I work with moving forwards, Google Workspace Admin FTW.**

We have had issues with WSUS not working - again, massive thank you to Microsoft, a month and a half later and guess what, WSUS is....still not working. They are now asking me to remove it and re-install it all over again, even though we have already done that twice. I was worried that the client computers would not be getting the latest updates thanks to Microsoft's non working WSUS solution, so I took some out of their OU and placed them in one with no WSUS configurations in Group Policy, so they are now fully up to date and still cannot print.

 

1.We don't have SCCM here, just Server 2016 with print server installed. We ensured to add the PointAndPrint registry changes as per the Microsoft guidance that said you shouldn't do this (for security), but if you need to, make this registry change. - Still not working.

2.We added the Point and Print Restriction GPO configurations such as 'Users can only point and print to these server' enabled and then the print server. - Still not working.

3.We added the 'printer connections' in the print GPO as paths such as \\printserver\Printer1 - Still not working.

4.Print server fully updated, still the problem is there. So we added a second print server, moved over all of the GPOs to point to that. - Still not working.

5.Updated the printer drivers - Still not working.

6. Ensured client computers are fully updated - You've guessed it, still not working.

 

The only thing that is working here is me and my colleagues, double time so once again, thank you to Microsoft for leaving so many schools in this dire situation.

[Chockster]

Have you tried this one? Managing deployment of Printer RPC binding changes for CVE-2021-1678

 

That was the final piece in the jigsaw for us, may be worth a look at.

[talksr]

Have you tried this one? Managing deployment of Printer RPC binding changes for CVE-2021-1678

 

That was the final piece in the jigsaw for us, may be worth a look at.

 

Hi everyone,

 

Update from my end. Thanks for this, I did work though it, but most of the guidance on those KBs for the SHA-2 update were showing as for Windows server 2008 or 2012 in the Microsoft Update Catalogue. We have Windows Server 2016 so they would not install on.

 

 

The current situation is was we have just two computers that were able to print as of this morning. I had advised the users not to do any windows updates just in case. For the head and other senior members of staff, we have had no choice but to manually install the printer on their system as an administrator, directly and not via a print server. So we have added the printer by it’s respective IP address and ensured that the correct Canon drivers are installed as their computers had already stopped printing. This solution has worked very well for them.

 

 

To try and resolve this whole nightmare, tried to update the GPOs within our AD and made a few changes today.

 

Currently, we have a small number of around 4-5 printers, and 4 offices, so it is nothing too complicated. I have ensured that each OU has it’s own specific printer GPO, which has been more work, but gives for greater control at least and means when a user logs into a specific location, they only get hose printers.

 

 

I have checked and gone through each OU giving it the following:

 

Under Computer Config>Policies>Administrative Templates>Printers>Point & Print Restrictions, I have configured the following:

 

Users can only point and print to these servers: Enabled

 

Enter fully qualified server names separated by semicolons: all three FQDN server names included here.

 

 

Users can only point and print to machines in their forest: Disabled.

 

Security Prompts:

 

When installing drivers for a new connection: Do not show a warning or elevation prompt.

 

When updating drivers for an existing connection: Do not show a warning or elevation prompt.

 

 

In addition to this, I have made the following changes under Computer Config>Preferences>Windows Settings>Registry>New reg policy: RestrictDriverInstallationToAdministrators.

 

Action: Create

 

Hive: HKEY_LOCAL_MACHINE

 

Key path: SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointandPrint

 

Value name: REG_DWORD

 

Value data: 0x0 (0)

 

 

Since doing this, we now appear to have lost the ability to print from any device. Even the head’s which was a manually installed printer. This makes no sense whatsoever. How can a system with a directly installed printer lose the ability to print just because of the above. We are now in an even worse position and I have a furious head unable to print, she can’t delegate her print jobs to anybody else in the office as they too cannot print.

 

 

Does anyone have any advice on what we can do next?

 

I remember a while back, guidance on updates we should insure do not get installed to the server or Windows 10 client stations. Is this still the case and if it is, what were these updates so I can double check they are not present on the 2016 server or Windows 10 client stations. That still does not explain to me why it would be that a system with a locally installed printer on it cannot print. There are no warning messages, no errors, it just isn’t printing anything.

 

 

Contrary to Darylrese’s last post, we have printers listing on client systems, they are just printing nothing. We have ensured we have all of the latest Canon print drivers, but have never had issues with printers not listing that are deployed via GP. All printers on the print server are added based on their IPs, all of which are static. Before the print nightmare situation came along, we never had any issues.

 

 

I am so, so fed up with all of this.

[Koldov]

I'm not quite sure what you mean here:

 

Hi everyone,

 

Update from my end. Thanks for this, I did work though it, but most of the guidance on those KBs for the SHA-2 update were showing as for Windows server 2008 or 2012 in the Microsoft Update Catalogue. We have Windows Server 2016 so they would not install on.

 

 

RpcAuthnLevelPrivacyEnabled was a manual (GPP) reg entry for us. Not sure if it was necessary but I did it on both the server and the clients (WIN 10 clients, yes we have a 2012R2 print server but the change is to every edition I thought).

 

Computer Configuration (Enabled)
Policies
Administrative Templates
Policy definitions (ADMX files) retrieved from the central store.
Printers
Policy Setting Comment 
Package Point and print - Approved servers: Enabled  
Enter fully qualified server names 
[b][i]print.server.com[/i][/b] 


Policy Setting Comment 
Point and Print Restrictions Enabled  
Users can only point and print to these servers: Enabled 
Enter fully qualified server names separated by semicolons [b][i]print.server.com [/i][/b]
Users can only point and print to machines in their forest Enabled 

Security Prompts: 
When installing drivers for a new connection: Do not show warning or elevation prompt 
When updating drivers for an existing connection: Do not show warning or elevation prompt 
This setting only applies to: 
Windows Vista and later 


Preferences
Windows Settings
Registry
RestrictDriverInstallationToAdministrators (Order: 1)
General
Action Create 
PropertiesHive HKEY_LOCAL_MACHINE 
Key path Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint 
Value name RestrictDriverInstallationToAdministrators 
Value type REG_DWORD 
Value data 0x0 (0) 

Common
OptionsStop processing items on this extension if an error occurs on this item No 
Remove this item when it is no longer applied No 
Apply once and do not reapply No 

RpcAuthnLevelPrivacyEnabled (Order: 2)
General
Action Update 
PropertiesHive HKEY_LOCAL_MACHINE 
Key path SYSTEM\CurrentControlSet\Control\Print 
Value name RpcAuthnLevelPrivacyEnabled 
Value type REG_DWORD 
Value data 0x0 (0) 

Common
OptionsStop processing items on this extension if an error occurs on this item No 
Remove this item when it is no longer applied No 
Apply once and do not reapply No 

[talksr]

I'm not quite sure what you mean here:

 

 

 

RpcAuthnLevelPrivacyEnabled was a manual (GPP) reg entry for us. Not sure if it was necessary but I did it on both the server and the clients (WIN 10 clients, yes we have a 2012R2 print server but the change is to every edition I thought).

 

Computer Configuration (Enabled)
Policies
Administrative Templates
Policy definitions (ADMX files) retrieved from the central store.
Printers
Policy Setting Comment 
Package Point and print - Approved servers: Enabled  
Enter fully qualified server names 
[b][i]print.server.com[/i][/b] 


Policy Setting Comment 
Point and Print Restrictions Enabled  
Users can only point and print to these servers: Enabled 
Enter fully qualified server names separated by semicolons [b][i]print.server.com [/i][/b]
Users can only point and print to machines in their forest Enabled 

Security Prompts: 
When installing drivers for a new connection: Do not show warning or elevation prompt 
When updating drivers for an existing connection: Do not show warning or elevation prompt 
This setting only applies to: 
Windows Vista and later 


Preferences
Windows Settings
Registry
RestrictDriverInstallationToAdministrators (Order: 1)
General
Action Create 
PropertiesHive HKEY_LOCAL_MACHINE 
Key path Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint 
Value name RestrictDriverInstallationToAdministrators 
Value type REG_DWORD 
Value data 0x0 (0) 

Common
OptionsStop processing items on this extension if an error occurs on this item No 
Remove this item when it is no longer applied No 
Apply once and do not reapply No 

RpcAuthnLevelPrivacyEnabled (Order: 2)
General
Action Update 
PropertiesHive HKEY_LOCAL_MACHINE 
Key path SYSTEM\CurrentControlSet\Control\Print 
Value name RpcAuthnLevelPrivacyEnabled 
Value type REG_DWORD 
Value data 0x0 (0) 

Common
OptionsStop processing items on this extension if an error occurs on this item No 
Remove this item when it is no longer applied No 
Apply once and do not reapply No 

 

Thanks for your post,

 

I added mine manually too, but I see you have:

Key path Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint

But also: Key path SYSTEM\CurrentControlSet\Control\Print

 

What does the second one do? I have never seen this one before? We have only ever had the Software\Policies path, not a System\CurrentControlSet path.

 

 

I cannot understand what is going wrong here as I am not even able to print to a printer if it is installed on a machine locally. It makes no sense as locally installed printers have never ever been an issue in the past and would prove to be a really helpful workaround whilst I spend yet more time on this issue.

Edited April 28, 2022 by talksr

[Koldov]

That's just where the Microsoft link in the post from @Chockster (and others) says to put it.

 

https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25#:~:text=Step%202%3A%20Enable%20Enforcement%20mode

 

The first REGEDIT is for the 'RestrictDriverInstallationToAdministrators' (Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint)

 

The second REGEDIT is for the 'RpcAuthnLevelPrivacyEnabled' (SYSTEM\CurrentControlSet\Control\Print)

[Chockster]

As @Koldov said, that's regedit locally on your print server; we didn't need to apply it to our clients for our printing to come back.

 

One other thing to note is for the group policy mentioned:

Computer Config>Preferences>Windows Settings>Registry>New reg policy: RestrictDriverInstallationToAdministrators.

 

Action: Create

 

Hive: HKEY_LOCAL_MACHINE

 

Key path: SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointandPrint

 

Value name: REG_DWORD

 

Value data: 0x0 (0)

 

I pretty much use Action:update in cases like this, as it will create the entry if it's not there and update with any changes if it is there.

[talksr]

That's just where the Microsoft link in the post from @Chockster (and others) says to put it.

 

https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25#:~:text=Step%202%3A%20Enable%20Enforcement%20mode

 

The first REGEDIT is for the 'RestrictDriverInstallationToAdministrators' (Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint)

 

The second REGEDIT is for the 'RpcAuthnLevelPrivacyEnabled' (SYSTEM\CurrentControlSet\Control\Print)

 

Thank you. I have managed to get it working and all I did was update the printer driver which was only recently updated anyway.

We had a several Canon iR-ADV C5560 and also a few iR-ADV C256. I noted that the current driver was Canon Generic Plus PLC6 version 2.30.0.0. I downloaded the latest from the Canon site and now they have Canon Generic Plus PCL6 V260 version 2.60.0.0. Immediately, the printing has worked and I have not even rebooted the server yet.

Never know a situation where a simple driver update would solve things. Clearly a recent Microsoft update has meant that we have needed the very latest drivers.

 

Thanks for your help. I am going to continue going through the GPOs as different OUs have different configs now where I have been testing but all OUs are able to print regardless.

[Koldov]

How did you get the client drivers and did they match the server? There was a mention of print drivers must match on both server and client (especially for 'Point and Print') I presume you are still using V3 drivers?

 

Not sure how that would affect IP/printing directly to the printer though...

 

So are you saying you don't need the Privacy regedit at all?

[talksr]

How did you get the client drivers and did they match the server? There was a mention of print drivers must match on both server and client (especially for 'Point and Print') I presume you are still using V3 drivers?

 

Not sure how that would affect IP/printing directly to the printer though...

 

So are you saying you don't need the Privacy regedit at all?

 

All I did in the end was downloaded the latest driver from the Canon site, ran the setup wizard on the print server, it found all of the printers we have and identified that they needed a driver update. I deselected all but one to test, updated and it started working straight away. Did a few more, then a few more until all were working.

I have not made any driver changes on client systems, just on the print server.

Driver type is showing as Type 3 - Usermode.

 

On the first printer I driver updated, I had also changed the Printer Properties>Advanced from 'Spool print documents so program finishes printing faster' to 'Print directly to the printer'. But found that on other printers, they still worked with this mode not changed, so it doesn't seem to make any difference for my setup.

 

In terms of the Privacy Regedit, I had never had it before in any of my OUs. When this problem kicked off on Wednesday, I added it in the first OU I tested with, and it made no difference. Since I have established that the print drivers being out of date was the cause, I have not added the Privacy regedit to other OUs and they are all printing no problem so the Privacy reg edit was not needed for this particular setup. But I do however have the RestrictDriverInstallationToAdministrators regedit on all machines as well as the Point and Print Restrictions setting enabled and configured.

 

We have other servers on this site for other parts of the school on different networks and different but identical model number Canons, they are running the old printer drivers, but server 2012 rather than 2016, with no issues at all. So maybe server version also has something to do with this, maybe not, maybe it is moon phase, weather conditions or outside temperature as this whole saga seems to differ from server to server, place to place.

 

So far, everything all working. Unbelievable that all of a sudden, all printers would need a driver update.

[Darylrese]

Well i still havent sorted mine 100%. Some printers deploy fine, others are showing but dont print when you press print and some just dont deploy via GPO or script atall. All use the same drivers so it cant be a driver issue and those with issues work OK using Papercut Deploy.

 

I have resorted to eother buying papercut deploy to handle printer deployment or PrinterLogic which i am currently requesting a demo of. I kind of want to explore the options of ditching a print server altogether...

[talksr]

Well i still havent sorted mine 100%. Some printers deploy fine, others are showing but dont print when you press print and some just dont deploy via GPO or script atall. All use the same drivers so it cant be a driver issue and those with issues work OK using Papercut Deploy.

 

I have resorted to eother buying papercut deploy to handle printer deployment or PrinterLogic which i am currently requesting a demo of. I kind of want to explore the options of ditching a print server altogether...

 

I feel your pain. Must be so frustrating. I am sure you have already checked but if you compare a working computer that can print with one that is not, do they both have the same Windows versions?

When I first started encountering issues some time back, I found that some were running 21H2 and others were on 21H1 or even 20H2 & 1909. The 1909 ones were on RM and wouldn't get higher than that at the time. But from my vanilla selectin, I did find that getting them all to the same version helped.

[psydii]

I feel your pain. Must be so frustrating. I am sure you have already checked but if you compare a working computer that can print with one that is not, do they both have the same Windows versions?

When I first started encountering issues some time back, I found that some were running 21H2 and others were on 21H1 or even 20H2 & 1909. The 1909 ones were on RM and wouldn't get higher than that at the time. But from my vanilla selectin, I did find that getting them all to the same version helped.

 

anecdata, but I concur. Every time we've had a machine break after monthly updates recently, its because it hasn't taken a 21hx Feature update and is on a 20hx or 19xx build. Everything on 21hx has been absolutely fine.

[Darylrese]

I feel your pain. Must be so frustrating. I am sure you have already checked but if you compare a working computer that can print with one that is not, do they both have the same Windows versions?

When I first started encountering issues some time back, I found that some were running 21H2 and others were on 21H1 or even 20H2 & 1909. The 1909 ones were on RM and wouldn't get higher than that at the time. But from my vanilla selectin, I did find that getting them all to the same version helped.

 

Yep, everything is running 21H2 now. I bought Papercut Deploy bolt on which is deploying printers perfectly now, but i still get a UAC pop-up when adding some printers through this.

 

It is really odd because i have one printer that doesnt display a UAC box and installs fine, and another that does but they are the same model printer and using the exact same driver!! Driver is packaged but Type 3. Luckily i only have a couple of that model so i am logging onto every workstation as admin and allowing install, then it works for all users, but what a pain when you have to rebuild a workstation and cant get back to it straight after

Edited May 12, 2022 by Darylrese

[talksr]

Yep, everything is running 21H2 now. I bought Papercut Deploy bolt on which is deploying printers perfectly now, but i still get a UAC pop-up when adding some printers through this.

 

It is really odd because i have one printer that doesnt display a UAC box and installs fine, and another that does but they are the same model printer and using the exact same driver!! Driver is packaged but Type 3. Luckily i only have a couple of that model so i am logging onto every workstation as admin and allowing install, then it works for all users, but what a pain when you have to rebuild a workstation and cant get back to it straight after

 

Good to know you are also running 21H2. The UAC issue makes no sense particularly as you say you have two identical printers and one is fine, the other is not.

This really has been the takeaway for me from this Printer Nightmare is the fact that nothing seems to make any sense at times.

The only thing you could maybe try is taking drivers off and back on if that is possible? It sounds like your workaround as logging in as admin might be easier than messing with drivers but still a headache.

What a mess this whole thing has been for so many.

[Ertech]

Our printers are managed using Windows Print Server - it was deployed at the user as well as computer level.

 

It use to work fine and still is for the computers that has the printer drives but new computers are not getting the printers anymore - It will ask for an Admin password if I try to manually pull it down the printer from the print server.

 

I would really appreciate if you could share your permanent solution for the issue?

 

Thanks

Edited October 17, 2022 by Ertech

[Sonic007]

I've done all the fixes but printers are still only deploying to domain admins. Anyone have ay ideas?

 

Thankyou

[Dungas1337]

It is strange i havent read anybody talking about certificates. Some printer (setup) installs selfsigned certificates and more and more lately to remediate the printer nightmare their customers facing. Monitor added certificates in Trusted Publishers folder e.g. If this is true, export it and deploy those certs to your endpoints before installing the core drivers.