[22h2] Azure Joined Clients - Sharing Printers

[Manny-Tech]

Hi,

 

We have a Windows 11 client that is Azure AD joined only, this particular device has a card printer attached to it and prior to going Azure AD joined was able to share this device with others to make use of. Now domain joined devices are unable to authenticate onto this device to add the card printer.

 

Initially I couldn't even ping the device but soon realised this was related to firewall rules on the client, as well as the file and print sharing being enabled on a private profile.

 

The thing I'm really struggling with is trying to add a printer by UNC \\clientname\printername and auth'ing, even if I allow everyone access through the share permission of the device.

 

Has anyone else come up against this when going from domain joined to Azure AD joined?

[DalekSec]

To put it lightly. AAD Only PCs and printer management is the worst. Find a way of networking the printer without the use of the PC is my recommendation!

[free780]

You can add AzureAD as a domain controller for Kerberos auth. This can be used in a hybrid environment. I guess in a pure AAD world you want to eliminate printing or need some connector.

[MicrodigitUK]

3 options:

 

1) Hybrid join Win 11 PC with the card printer connected. So it is both on local domain and AzureAD joined.

 

2) Use a Raspberry Pi running CUPS to publish a None Authenticating SMB(UNC) or IPP print queue. The reason for the Linux box being Windows is almost impossible to create and non-authenticating print queue, without hacking the registry to pieces. Please note this option is not for the faint hearted, and will require a bit of faffing around with CUPS config and basic Linux setup knowledge.

 

3) Get a new card printer with direct ethernet or Wi-Fi connection capabilities.

Edited January 5, 2023 by MicrodigitUK