UPDATE #4: I have heard rumor that a fix is supposed to be released on Tuesday for this issue. I hope that is the case.
After the update, we were having an issue where long established installed printers al of a sudden said they needed driver updates. Nothing had changed printer-wise, only the installation of KB5005031 & KB5005033. Users were being prompted to install the driver update, and it looked like it was installing, but at the very end would fail with an error code of 0x0000011b or 0x00000bbb. Implementing the PointAndPrint workaround from Microsoft didn't fix the issue for us.
Found a solution on Reddit; BRAVO to who figured this out. This uses the registry setting that negates the patch, which allows Windows to update the printer drivers, and then flips the switch back to enable the new protection. We are not sure how the patch is going to affect us with new employees and new machines, but at least we can get people printing again.
This is the part of the fix that we used: (REQUIRED a REBOOT to fully work)
How do yall manage the issues presented with the latest PrintNightmare mitigation patch? (KB5005033) : sysadmin (reddit.com)
Here are the steps required to deploy printers and print drivers via GPO, while still following Microsoft's recommended practices.
Note that not all of these steps may be necessary, but these are the changes I made in our environment to get this working again. Feel free to correct me if I've made a mistake.
The Microsoft article is here
- In your GPO navigate to User > Preferences > Registry and add the new registry key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" RestrictDriverInstallationToAdministrators as a DWORD value of 0
- In your GPO navigate to User > preferences > Control Panel > Scheduled Tasks > New Immediate task Windows 7 or later
Set the task to run as SYSTEM. Action = Start a program
program is cmd
/c reg add "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f
What this does is temporarily set the registry key to 0 to allow the printer drivers to be installed, then the immediate task runs immediately after GPOs are applied and sets the registry key back to 1. These settings align with Microsoft's support article that states:
If you set RestrictDriverInstallationToAdministrators as not defined or to 1, depending on your environment, users must use one of the following methods to install printers: Temporarily set RestrictDriverInstallationToAdministrators to 0 to install printer drivers.
UPDATE #1: We had a user that this didn't work for, but it did work for other users in the office. Not sure if maybe the switch flip was too fast for Windows to download the updated drivers. I say this because I used a more manual method to grant the admin level access. Made the user a member of the local Administrators group. Had user sign out and sign back in to make Admin level access active. Checked the printers to see if they were showing Needed Update or not. One was showing update but the other 4 were now showing as Ready. Within a few moments, that last printer showed as Ready. Removed user from Local Administrators group, and signed them out. That delay is why I wonder if maybe the above solution was to fast for this machine or maybe the network drop wiring or whatever.
UPDATE #2: This solution only works for printers already showing as installed in Windows. Not that I fully understand how printing works in Windows, but we have users that have been using printers for years and showed as a printer they could pick, but now the printer doesn't show installed. That requires a local admin level to install.
UPDATE #3: Had a user where we are using this GPO that had her printers go back to a a Need Update state. Ended up doing the make user local admin, login, issues fixes itself, remove from local admin, logout and log back in.