New AD users not picking up Printers GPO

[Sonic007]

Hi all,

Anyone know what may be happening?

 

New AD users are not picking up the printers that are set via GPO.

 

If I login with a user that has been here a long time, they get all the correct printers come up.

 

I tried it again this morning with a freshly imaged machine. Logged in with a new user, no printers.

Logged is as someone who's been here years, and they get all the printers showing up.

 

 

Any ideas?

 

Thankyou.

[clareq]

Does running a Group Policy results scan show anything?

[Oaktech]

Screams like a group membership missing to me...

[Sonic007]

Thanks for your replies.

 

I've just checked and they are indeed members of the correct groups. Just compared them with a working user account and all looks correct there.

 

Not at the machine at the moment but will do a GP results scan later.

 

 

I was wondering if it could be due to Windows. Wasn't there an update recently that messed up deployed printers?

Edited September 1, 2022 by Sonic007

[Oaktech]

 

I was wondering if it could be due to Windows. Wasn't there an update recently that messed up deployed printers?

 

That seems unlikely if others are working on the same machine.

 

best do a resultant set of policy and see what's different.

[Davit2005]

What profiles are you using, is it possible if using roaming that printers are moving with original users? Edited September 1, 2022 by Davit2005

[Sonic007]

What profiles are you using, is it possible if using roaming that printers are moving with original users?

 

Roaming Profiles are turned off.

[TechMonkey]

Any event viewer warnings?

[pantscat]

What does RSOP show?

 

There's not anything in terms of Group Policy Preferences in place? or permissions on the print queue itself?

[round2it]

it sounds like the printers are not being installed because of possibly uac, the older accounts have already added the printer thats why it works,so i would check for windows update issues.

[SayLHP]

I've got the same, set up 6 new laptops, 4 were Lenovo E14's, 2 were Lenovo E495's.

 

All pick up the printers bar 1 E495 and I can't figure it out. It's picking up all the group policies, deployed all the same PDQ package to each machine.

 

Just this one is refusing.

[Sonic007]

Just resurecting this as still stuck.

 

 

Newly imaged Windows 10 desktops, Login with a new user. No printers being picked up via GPO.

 

Login on the same machine with someone who was created several months ago and they pick up all the printers fine.

 

So this makes me think I can rule out Windows and instead it is some sort of user issue.

 

GP Result shows Mapped Ptrinters as one of the GPO's applied.

 

Any ideas anyone? Thankyou.

[Katy]

GP Result shows Mapped Ptrinters as one of the GPO's applied.

 

Any ideas anyone? Thankyou.

Does the event log on the machine show why the printers failed to appear? Will most likely just be an error code but there should be an entry specifically saying it's to do with Group Policy printers. Have a look and paste in the error details and I'll see if it sounds familiar as I had a nightmare with GPP printers a few years back.

[StephenPink]

I had something similar when I took over a site - turned out a predecessor had set specific permissions on each printer object on the print server; so although the GPO was applying, not all users had permission to access the printer object, so it wouldn't appear. Worth a quick check!

 

Cheers,

Stephen

[Sonic007]

Thanks all.

 

I'll take a look.

 

I'm just wondering....Was there a previous version of Windows that possibly didnt have any issues pulling printers. maybe a UAC issue I read about ages ago and it wasnt a problem back then?

But then actualluy what I'm sayng doesn't add up as old users log on to the new Windows machines and are getting the printers.

[TechMonkey]

Event viewer will give you some clue. Check Item-Level Targetting isn't somehow excluding them. Check share permissions.

[MatthewL]

I think a recent update has possibly caused issues, got similar issues here as nothing else has changed.

[round2it]

sounds sily but take the pc off the domain and then add it back on then do a gpupdate force

 

i just did a mdt image on a laptop and it would not apply all the policies until i took it off then back on

[Sonic007]

sounds sily but take the pc off the domain and then add it back on then do a gpupdate force

 

i just did a mdt image on a laptop and it would not apply all the policies until i took it off then back on

 

 

 

Hadn't thought of this. Will give it a go.

[Sonic007]

Here is what I've found in Event Viewer...

 

[round2it]

Try adding this registry entry on a test pc:

 

Registry Location: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint

 

DWord: RestrictDriverInstallationToAdministrators

 

Value: 0

 

 

i think the issue is that the driver can not be installed but previous users have already gone through the installation process before a dodgy windows update try the above on a test pc

 

https://support.microsoft.com/en-us/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872

Edited October 5, 2022 by round2it

[Sonic007]

Thankyou. I was just reading about that now. I'm going to see if this works. Edited October 5, 2022 by Sonic007

[Koldov]

Me: Deploy printer please

GP: No

Me: Why?

GP: Error description: ...........

 

Classic!

 

So on a newly imaged machine an existing AD user account logs-in and gets the printer, but on a newly imaged machine a new AD user account logs in and gets nothing (presuming both users are in the same OU and users are members of all the same 'groups').

 

Still seems like some kind of 'Permission/Security' issue somewhere because GP obviously tries to deploy the printer at least (as it appears as an error in Event Viewer).

 

Back to basics...

 

Do all the other GPOs apply correctly?

 

How are these printers deployed (in user configuration I presume)?

 

Start-up script in GPO?

 

Group policy (as in 'Print Server > Right-Click > Deploy with Group Policy')?

 

GPP 'Preferences > Control Panel Settings > Printers?

 

Nothing funny going on with Loopback or Security/WMI Filtering?

 

Did you apply any of the 'Print Nightmare' workarounds to any of the users/computers?

[round2it]

give it ago on a test pc worth a shot

[Sonic007]

So on a newly imaged machine an existing AD user account logs-in and gets the printer, but on a newly imaged machine a new AD user account logs in and gets nothing (presuming both users are in the same OU and users are members of all the same 'groups').

All in the same OU. All other policies being applied.

 

Still seems like some kind of 'Permission/Security' issue somewhere because GP obviously tries to deploy the printer at least (as it appears as an error in Event Viewer).

 

Back to basics...

 

Do all the other GPOs apply correctly?

Yes

 

How are these printers deployed (in user configuration I presume)?

Yes, they apply to the user via User Configuration > Policies > Windows Settings > Deployed Printers