Non-VBScript print queue deployment methods?

[LRSFC_DanJ]

Now that VBScript is going end-of-life, we are once again having to look at how we make print queues available to users.

 

Currently we have a logon script for students (and student-like accounts, such as exam accounts) that runs a VBScript that connects to the appropriate print queues, based on the AD computer object’s Location attribute. It also has logic around retrying if the connection isn’t successful the first time.

 

 

• We’ve tried GPO deployment in the past and found it to be too unreliable. It’s not good enough for it to work every other login, it needs to work every time consistently or we can’t use it. GPO deployment has no mechanism to enable retrying the printer connection if it doesn’t work the first time.
  
• We block PowerShell for students, so we can’t just turn the script into a PowerShell script, unless there’s a way to block PowerShell except for logon scripts
  
• PaperCut Print Deploy is out, as we’d have to pay an additional fee to have more than one Zone, and maintaining the Zones would be a nightmare as it doesn’t have any functionality around looking at the computer object’s Location attribute
  

 

Given the above limitations, can anyone suggest a method we can use for print queue deployment to students in place of our existing VBScript?

[dmj]

python, c#, rust, java - I could go on...

 

or fix the GPO issues?

[DGardiner]

have you added domain computers the the gpo security filtering?

 

have you implemented all the print nightmare stuff to make the servers allowed point and print destinations?

[Davit2005]

At a previous place had no issues with GPP (Group Policy Preferences)

 

In our scenario we had a Computer OU structure that incorporated buildings with OU in that for floors and finally another OU for each Room. As long as PCs were then put in the correct room OU it jus worked.

If we wanted to deploy a printer to a specific room or even floor when it came to Follow me printers. We'd create a Group Policy with Loopback processing set to merge then push the printers as shares using User based Group Policy Preferences. Worked flawlessly for us.

Edited May 24, 2024 by Davit2005

[LRSFC_DanJ]

or fix the GPO issues?

 

We don't have a support contract with Microsoft so we don't have a way to get them to fix their Group Policy Preferences not working every time.

[dmj]

We don't have a support contract with Microsoft so we don't have a way to get them to fix their Group Policy Preferences not working every time.

 

It be fair, it's probably a configuration issue as to why they are not deploying consistently.

If you don't want to use GPO then there are plenty of free and open source windows configuration tools that will centrally deploy printers:

Ansible module: https://github.com/daBONDi/ansible-role-win-printer-driver

puppet: https://forge.puppet.com/modules/dsc/xprintermanagement/readme

[pklump]

Are there reasons why you're blocking Powershell for students? Perhaps you can review why you're doing this, then look into ways to limit students using PowerShell while replacing your VBScript printer scripts with PowerShell.

 

Another option: adding a scheduled task that runs a script on login to add the printers, running as an account that has the proper permissions to add the printer(s). I personally haven't done this, but according to the info here, it looks fairly straightforward:

 

https://www.tenforums.com/tutorials/173596-how-create-task-run-app-script-logon-windows-10-a.html

[LRSFC_DanJ]

Are there reasons why you're blocking Powershell for students? Perhaps you can review why you're doing this, then look into ways to limit students using PowerShell while replacing your VBScript printer scripts with PowerShell.

 

We block PowerShell for students because they can use it to access things they should not be able to access, such as the computer's C: drive. The GPO setting that blocks "command prompt" use does not block PowerShell. I would love to replace the VBScript printer script with PowerShell, but since it needs to run in the user context I don't see how you can block it for interactive use but allow it for noninteractive use without the student also being able to create and use their own .ps1 scripts. Is there a way to tell PowerShell to only run scripts through logon scripts or Group Policy?

Another option: adding a scheduled task that runs a script on login to add the printers, running as an account that has the proper permissions to add the printer(s). I personally haven't done this, but according to the info here, it looks fairly straightforward:

https://www.tenforums.com/tutorials/173596-how-create-task-run-app-script-logon-windows-10-a.html

We'd need to impersonate the logged on user in order for this to be successful, otherwise the connection to the printer would not have the correct permissions (for example, students are not permitted to cancel jobs or clear the print queue as this can allow them to bypass print charging).

[Steve21]

Is there a way to tell PowerShell to only run scripts through logon scripts or Group Policy?

 

If you mean just scripts you could block them via AppLocker (Under Script Rules as it affects ps1/bat/cmd/vbs/js) then add an allow/whitelist rule for \\DOMAIN\NETLOGON\* etc and host it via there. We do the same for VBS anyway so individual user tries to run scripts from their area it'll block but login scripts run from NETLOGON still

 

Steve

[LRSFC_DanJ]

If you mean just scripts you could block them via AppLocker (Under Script Rules as it affects ps1/bat/cmd/vbs/js) then add an allow/whitelist rule for \\DOMAIN\NETLOGON\* etc and host it via there. We do the same for VBS anyway so individual user tries to run scripts from their area it'll block but login scripts run from NETLOGON still

 

Steve

 

This is a good step forward, but how do we do this and also block student access to the PowerShell prompt? We currently use User Policies -> Administrative Templates -> System -> Don't run specified Windows applications to block powershell.exe and powershell_ise.exe.

 

EDIT: this https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/script-rules-in-applocker says that PowerShell scripts will still run, just in Constrained Language Mode, when blocked in the way you describe? The description of this says "All cmdlets in Windows modules are fully functional and have complete access to system resources, except as noted. All elements of the PowerShell scripting language are permitted. All modules included in Windows can be imported and all commands that the modules export run in the session." so this doesn't really seem like enough to properly block it.

Edited May 30, 2024 by LRSFC_DanJ

[ckedu-local]

have you added domain computers the the gpo security filtering?

 

have you implemented all the print nightmare stuff to make the servers allowed point and print destinations?

 

+1 with this

 

- Apply the reg keys / point & print restrictions

- Put the FQDN when adding printers via GPO (ie, \\print-server.domain\Photocopier)

- Item target it & loopback if required

 

Worked fine and had no complaints over multiple schools I cover

[LRSFC_DanJ]

+1 with this

 

- Apply the reg keys / point & print restrictions

- Put the FQDN when adding printers via GPO (ie, \\print-server.domain\Photocopier)

- Item target it & loopback if required

 

Worked fine and had no complaints over multiple schools I cover

 

We did all that and it still only worked every second login instead of every login.

 

In the end I've finally gotten around to writing a little C# console app that does what our printers script currently does, I'll be testing that on our test user account and then if it works I think we'll just go with that.

[pete]

With regards to preventing students running powershell scripts, set your execution policy (Get-ExecutionPolicy/Set-ExecutionPolicy) to AllSigned on OUs with computers that students can use, then use a copy of the script signed by your inhouse certificate authority.

 

Note that if any of your remote management (or other) tools use powershell scripts stored on the local PC (assuming RemoteSigned), it'll break their functionality.

 

Could the students get a publicly-trusted code-signing cert via something like Sigstore*? Sure, if they're sufficiently motivated or skilled and willing to provide identifying information to Sigstore for a malicious purpose. But simply marking the Fulcio CA as distrusted via a GPO solves that and ultimately the cert can be linked back to a verified person.

 

 

*https://docs.sigstore.dev/signing/quickstart/

Edited May 31, 2024 by pete

[CTRLP]

If you use PaperCut, you can switch MF to the subscription license FOC and get 5 zones for Print Deploy included - avoids all the print nightmare stuff.