Printing Issues "Driver Update Needed"

[smarties11]

Hi All,

 

We're seeing today issues printing, whereby printers all say "driver update needed" on clients. If they go ahead and print, it asks them if they trust the print server, and then they are prompted for admin credentials. If I provide these, printing continues no problem.

 

We deploy all printers by user GPP.

 

I have all the relevant point and print settings / restrictions set by GPO, and nothing has changed on this front.

 

Two things have changed, yesterday

 

- I have applied August windows updates to both servers and clients

- I renewed our CA root certificate as it is due to expire soon

 

I'm about to begin troubleshooting the above, but thought I'd ask here to see if anyone else was having the same issues?

 

Thanks!

[psydii]

https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872

 

http://www.edugeek.net/forums/security/222800-printnightmare-cve-2021-1675-a-5.html#post1911401

[MartinByard]

I'm gonna blame the August windows updates ...

 

https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872

[RLR]

Anyone can give me a run down on how to deploy printers to users via GPO? Our current setup has been broken by this update and would rather not use the reg key to bypass the security issue.

 

Do I need to install drivers on computers now a different way or can this still be done by GPO/GPP?

 

Edit: Does Packaged Point and Print still work? Does this only affect Point and Print?

Edited August 12, 2021 by RLR

[psydii]

Not looked into it yet, but I'd say: no. you have to use the reg key as it is officially the only way as per the article.

[psydii]

As per article:

 

"If you set RestrictDriverInstallationToAdministrators as not defined or to 1, (i.e. the default after installing this update) depending on your environment, users must use one of the following methods to install printers:

 

* Provide an administrator username and password when prompted for credentials when attempting to install a printer driver.

 

* Include the necessary printer drivers in the OS image.

 

* Use Microsoft System Center, Microsoft Endpoint Configuration Manager, or an equivalent tool to remotely install printer drivers.

 

* Temporarily set RestrictDriverInstallationToAdministrators to 0 to install printer drivers.

 

Note If you cannot install printer drivers, even with administrator privilege, you must disable the Only use Package Point and Print Group Policy."

 

So yes packaged point and print is impacted.

 

Hoping someone pulls together a guide on how to deploy printer drivers via SCCM so they are used by default when connecting to printer shares.

[smarties11]

Thanks all. Very surprised by this change, I'd imagine there's a high proportion of enterprise using point and print?

 

I've put the 0 reg key in place for now, but I hate putting workarounds in place which are against advice.

 

I already have PaperCut Print Deploy on my to-do list, looks like it just moved up higher!

[ZeroHour]

There is a group policy setting which I think can get around the need for admin.

 

Package Point and print - Approved servers

User Configuration > Administrative Templates > Control Panel > Printers > Package Point and Print – Approved Servers.

[FragglePete]

There is a group policy setting which I think can get around the need for admin.

 

Package Point and print - Approved servers

User Configuration > Administrative Templates > Control Panel > Printers > Package Point and Print – Approved Servers.

 

This didn't work for me - just had to do the registry tweak for now. Bit of a bodge but it get's thing working. All a bit of clusterf**k at the mo.

 

Pete

[DrCheese]

Well done Microsoft for essentially giving up on this & just forcing you to be an admin to connect to printers, but not providing an alternative solution to deploy to restricted users. Well done. You've outdone yourself this time.

 

I think I'll have to put the reg bypass in for now & hope this kicks vendors up the backside to make proper user mode 4 drivers that get around this...

[andy_b]

Looking at Papercut print deploy, it seems that I need to purchase the "PaperCut Print Enablement Pack" to be able to target printers to specific users?

 

Am I reading this correctly?

 

Any idea how much it costs?

[Guest Guest]

Looking at Papercut print deploy, it seems that I need to purchase the "PaperCut Print Enablement Pack" to be able to target printers to specific users?

 

Am I reading this correctly?

 

Any idea how much it costs?

Yeah that's right. I was quoted £1,470 last year

[smarties11]

Looking at Papercut print deploy, it seems that I need to purchase the "PaperCut Print Enablement Pack" to be able to target printers to specific users?

 

Am I reading this correctly?

 

Any idea how much it costs?

 

Ah poo. I hadn't realised this. Most of our print deployment is done based on PC name/OU, however we do deploy some based on user. I've e-mailed our supplier for a quote of the advanced enablement pack.

[free780]

I wouldn't fallback to the registry setting as you will be vulnerable to the latest CVEs.

 

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34483

 

The print nightmare could go on for quite some time.

 

Ok after much pain. Tried on a standalone VM with the latest patches. Years ago I did this to improve GPP mapping of printers.

This can be contained in a SCCM package.

 

$drivers = Get-ChildItem '$PSScriptRoot\HP Universal Print Driver' -Recurse *.inf | Select-Object -ExpandProperty FullName
foreach ($driver in $drivers){
Start-Process -Wait "C:\Windows\System32\pnputil.exe" -ArgumentList "/add-driver `"$driver`" /install /subdirs" -NoNewWindow
Add-PrinterDriver "HP Universal Printing PCL 6" -Verbose}

 

Package contents would be

 

Script - deploy.ps1

Directory - "HP Universal Print Driver"

 

Then Create a package in sccm with command line

 

powershell.exe -ExecutionPolicy Bypass deploy.ps1

 

The default for Driver Isolation is Shared so all users should be able to use the driver. It may not be necessary to go through every inf file. The HP Universal Driver is a type 3 so not sure where the type 4 requirement has come from.

 

1. Add to driver store using pnptuil.

2. Add as a Printer Driver using Add-PrinterDriver

[eejy]

Caused right chaos here for me today! I still can't get the ruddy printers to map from GP and I'm not quite sure what I'm doing wrong. I've tested the registry key entry (on a workstation I presume) but it's still not working. The reg key has a DWORD of 'restricted', not the actualy one it says on the article so I don't know if they're one and the same? If anyone has any basic instructions they can share I'd be grateful, just tearing what's left of my hair out here!

[eejy]

Incidentally, I get a 'there's more...you need to install a driver' dialogue box that pops up instead of a blank no?

[free780]

During testing I got a UAC box. If you have point and print restricted to admin only you get a ‘do you trust this printer?’ Box.

[dubsdj]

Thank goodness that I have removed most printers. However, reading the article it says install the drivers on the workstations? Because the users roam, the network printers are removed from their profiles on log off to prevent them having printers all over the building appearing.. How would I install the driver on the workstation so it stays without it being removed when the users log off? Do I log in as a local admin and install the printer manually so that the driver is installed? Office users, I could probably stop the delete network printers on log off because they stay at their desk.. It's the roamers that I am most concerned about.

 

It's been so long since I've dealt with printer scripts that I have forgotten

Edited August 13, 2021 by dubsdj

[siuko]

Caused right chaos here for me today! I still can't get the ruddy printers to map from GP and I'm not quite sure what I'm doing wrong. I've tested the registry key entry (on a workstation I presume) but it's still not working. The reg key has a DWORD of 'restricted', not the actualy one it says on the article so I don't know if they're one and the same? If anyone has any basic instructions they can share I'd be grateful, just tearing what's left of my hair out here!

 

You actually have to add the RestrictDriverInstallationToAdministrators REG_DWORD into HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint and set to 0

 

This can be done via GPP on your workstation OU

 

Worked ok for me

 

As others have said though... its a security risk

[dubsdj]

You actually have to add the RestrictDriverInstallationToAdministrators REG_DWORD into HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint and set to 0

 

This can be done via GPP on your workstation OU

 

Worked ok for me

 

As others have said though... its a security risk

 

 

If you specify the print server in point and print settings (to reduce the risk), can you still have 'do not elevate' so they don't get a pop up?

Edited August 13, 2021 by dubsdj

[psydii]

In the same boat as you @dubsdj. It seems either we all figure out how to deploy drivers via Group Policy/Endpoiont Manager, or we have to use the registry key that disables the fix and leaves you vulnerable.

 

Thankfully we only need three drivers, and potentially we might be able to move to the papercut Global Print Driver so we only have to deploy one driver for the entire estate.

 

 

Has anybody had a play/success with the Microsoft print management scripts found in C:\Windows\System32\Printing_Admin_Scripts\en-US or their PowerShell equivalents ( get-command *printer* )?

Edited August 14, 2021 by psydii

[Mustang]

I think there seems to be a bit of confusion around this.

 

Setting the “Users can only point and print to these servers” and “Package Point and Print - Approved servers” group polices will not stop the UAC prompt when mapping a printer and allow non admins to map network printers that require drivers to be installed.

This does not matter if the Printers are deployed by group policy, group policy preferences, script or mapping the manually, setting these polices have no effect and just define the list of servers where users are allowed to map printers from.

 

These group polices should be used to help mitigate some of the security risk if you decide to set the RestrictDriverInstallationToAdministrators registry value to 0 (BAD IDEA) and protect against the newly announced CVE-2021-36958 for which there is currently no patch.

 

 

I have tried installing our current Type 3 printer drivers locally using pnputil or add-printerdriver as recommend by Microsoft but this did not work for me, non admins still can’t map network printers that use Type 3 drivers.

The only way I can allow non admins to map a network printer is by updating to the newer Type 4, in the case of the HP Universal driver I had to stop using it as I can’t find a Type 4 driver and switch to model specific driver.

[dubsdj]

I've been looking at this on a test workstation this evening. I seem to have been able to make it work without changing any registry keys. In group policy > computer configuration I have added a tcp-ip printer to the OU that contains the non admin workstations. I logged in as a test pupil and the printers are added without any pop up prompts to install drivers etc. So, I can create OU's with the classroom PC's and assign those printers using the GPO preferences, and it avoids the admin pop ups because it is under computer config GPO.

 

It appears that I can also delete the network printers via the GPO preferences, so that also deals with that problem of roaming users stacking up printers.

 

I'm going to test a bit more as I might be getting ahead of myself or misinterpreting what I am seeing. However, I have made sure latest updates were on the test pc.

 

Edited August 14, 2021 by dubsdj

[Mustang]

I guessing if your adding a TCP-IP Printer then your printing directly to the printer and not via a print server?

 

The print will still map if Windows already has a driver for that printer that it trusts or its using a generic Type4 driver. So the user is not installing any new drivers.

 

You can check the printer driver running the following Powershell command get-printerdriver

[dubsdj]

I guessing if your adding a TCP-IP Printer then your printing directly to the printer and not via a print server?

 

The print will still map if Windows already has a driver for that printer that it trusts or its using a generic Type4 driver. So the user is not installing any new drivers.

 

You can check the printer driver running the following Powershell command get-printerdriver

 

When adding the TCIP printer, I have to specify the location of the printer which is \\myprintserver\printername