Can't remove printers previously deployed by Group Policy Printer Deployment

Question

Back in the good old days, before PrintNightmare patches in 4Q21, we pushed printers out by Group Policy Printer Deployment. (Clarifying: Not with Preferences, but with Policies, using the Print Management MSC.) At the site I'm working on now, they were all per-computer, but the same thing applies to per-user printers elsewhere.

PrintNightmare patches, as most admins know, thoroughly broke GPPD.

Now, all workstations have zombie printers hosted by now-decommissioned print servers, and we can't get rid of them. Even brand-new user profiles inherit them.

They are removed from the printer GPOs via Print Management MSC. But because the print CSE doesn't work anymore, neither does the printer removal.

PowerShell Get-Printer doesn't even list them.

Standard users can't remove them (and never could, which is by design). Admin users can remove them, but they return.

I'm guessing that resetting Windows would get rid of them, since there's no trace left of them in Policy. But that's pretty extreme.

There are dozens or maybe 100s of references to the old print servers in the Registry, but I'm hoping only 1 or 2 of them, or flags in the printer settings, actually need to be removed. I can probably come up with some PowerShell magic to get rid of all of them--if that will address it. But I'm hoping there's a simpler way.

Anyone know a surgical way to get rid of them?

Answer 1

Hi all

I'm having a similar problems and I have thrown everything at it, I'm not sure what/if is working yet but below is what I am trying....

Oh, one thing what has worked, 'fax' has been removed on all the computers I checked :)

GPO with identical settings for both User and Computer:

powershell script containing all the printer names and sharenames, e.g:

Remove-Printer -Name "EPSON WF-C869R Series - Sales"

Remove-Printer -Name "clientservices (WF-C869R Series)"

Remove-Printer -Name "Fax"

Answer 2

Here is what I did:

I look at which printers are there for a logged in user by running

wmic printer get name

Then I stop the print spooler (need to be elevated)

net stop spooler

Then I delete a couple registry entries per printer:

REG DELETE "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices" /v "\\PRINTSERVER\Office Copier" /f

REG DELETE "HKCU\Printers\Connections\,,PRINTSERVER,Office Copier" /f

Then I start the print spooler (need to be elevated)

net start spooler

Then I confirm that those printers are gone by using the above WMI command

Answer 3

JRV, did you ever find an answer to this issue. I'm experiencing the same problem.

Answer 4

Use psexec to launch registry editor as local system user. Delete offending entries within HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\PRINTENUM

Persists through sign in / out, but does not persist through reboot.

Source: https://serverfault.com/questions/604161/deleted-printers-keeps-coming-back-and-multiply