0

I've set up two printers to be deployed via GPO (using "Deployed Printers" option under "Policies").

On my laptop only one actually shows up. In other words - the GPO clearly is being applied (and I confirmed this much via gpresult /h)... but somehow only partially?

Any idea how to debug this to figure out what's going on or what could be the reason?

PS. All printer drivers are package-aware, according to the print server, so AFAIK this shouldn't be a driver issue. I think...?

Improve this question
7
  • Look into the print nightmare updates and fixes. The recent print nightmare patches have basically completely broken group policy printer deployments that rely on point-and-print driver installations. You either have to disable the security updates, or pre-stage the drivers on the endpoints. I think v4 drivers aren’t an issue but those drivers often cause numerous other problems because you can’t get to the printer’s custom properties without installing additional manufacturer provided software on the endpoint anyways, and it’s not always available.
    – Appleoddity
    Aug 2, 2022 at 6:36
  • @Appleoddity I think you're right. I've set up that registry entry permitting non-admins to install printer drivers (as well as limited via an enforced GPO print servers to the one print we actually have) and printers started to magically appear. I still don't really know how to "debug" issues with deployed printers, since there's nothing in the logs as far as I can tell... :/
    – MBender
    Aug 2, 2022 at 9:27
  • as mentioned, there is no foolproof way to use point and print without exposing yourself to print nightmare. That unfortunately is now an obsolete functionality or you have to accept the risk. If you want it to be secure, then the drivers have to be staged to the endpoints first. For instance, I created a startup script that transfers the drivers from a central store and installs them on the local machine using pnputil if I remember correctly. Some forum discussions talk about this in relation to the print nightmare fixes. I’m pretty sure you’ll see these errors in the windows event log.
    – Appleoddity
    Aug 2, 2022 at 12:52
  • @Appleoddity Wait... Shouldn't explicitly specifying print servers that clients can connect to protect against PrintNightmare? As for the event log - I've checked and double-checked and found nothing, sadly.
    – MBender
    Aug 2, 2022 at 13:14
  • 1
    I honestly can’t remember all of the details of this now, but I thought the same thing. But with further research, the answer is no. There are 4 different print nightmare vulnerabilities (3 and 1 revised). Hence the reason Microsoft specifically says there is no combination of settings to be completely protected from print nightmare, short of the full solution they pushed out which disables the point and print function. I asked the same here: security.stackexchange.com/questions/259656/…
    – Appleoddity
    Aug 2, 2022 at 13:23

0

Reset to default

You must log in to answer this question.