- Workstation: Windows 7 (x64) [Install target for printer]
- Server: Windows Server 2012 R2 (x64) [Active Directory, Print Server]
I have been bashing my head on the desk trying to get this printer to be installed via group policy! For some reason, I simply can NOT get this printer deployed with GPO. I have tried setting it up to deploy via
Computer Configuration->Policies->Windows Settings->Deployed Printers, as well as
Computer Configuration->Preferences->Control Panel Settings->Printers and
User Configuration->Preferences->Control Panel Settings->Printers. I have also tried going through my Print Server Management console to add it via user and/or computer targeting. I have tried ALL KINDS of ways and nothing is working. I followed a bunch of tutorials and watched a bunch of videos just to make sure I was not missing something but it really is a simple task (in theory)... It just will not work.
In trying to debug the issue I found that if I went to
\\myserver\ and double clicked on the printer it would try to install the printer and then prompt me to install the drivers with a UAC type prompt.
I have tried everything I can think of to get that message box to stop popping up. I dug into it and found that if I was to edit a GPO called
Point and Print Restrictions located at
Computer Configuration->Policies->Administrative Templates->Printers and was as at
User Configuration->Policies->Administrative Templates->Control Panel->Printers you could try setting the policy to
Enabled and choose
Do not show warning or elevation prompt for the two Security Prompts listed at the bottom of the policy settings.
Well that was a bust too...
I did find that if I tried to manually install the printer by going to the unc and typing in my Administrator credentials it would download the drivers from the server and install the printer (as expected). If the user tried to remove the printer and was successful somehow as soon as they would log off and back on the GPO would do what I want and add the printer back. But it required me to add it manually the first time on EVERY PC.
After testing this and then removing the printer from the GPO, then logging off and on again. I could run the command
printui /s /t2 to bring up a GUI that would allow me to remove the installed drivers with ease to put the PC back to it's original state (asking for Administrator credentials). Also something else I learned was the printers were stored in the registry located at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections. When I was trying to remove a printer and it told me I couldn't, I just went to that registry key and removed the GUID key of the printer I was trying to delete. Then just restarted the Print Spooler service and boom it was gone. This was no help getting me get to where I wanted but it was helpful in removing the printer during debugging the issue.
I read somewhere that maybe the cause is some type of windows security update that changed something. It was released because of some article showing how you could pwn an entire network if you were able to pwn a single printer. Something about when users connected to the printer and downloaded the drivers it would install injected software and run on the machine, etc...
My main goal is to be able to deploy this printer to a set of users in this OU with the GPO I'm using. But everything I try requires an Administrator to be logged on to do it (at least the first time). Does anyone have any idea why my printer will not automatically add itself via the GPO and also how do I get that dang "Do you trust this printer?" message to go away?