Print server and Print Nightmare update

Question

Hi All,

I'm having issues with some Print Servers after running Windows Updates and installed

2021-08 Cumulative Update for Windows Server 2019 for x64-based Systems (KB5005030)

After the update installation I'm getting the error "Connect to printer Windows cannot connect to the printer. Operation failed with error 0x0000011b" and the printer fails to install.

Is there any workaround to keep Print Severs up and running?

I cannot permanently remove the August update, because the Print Nightmare update will come again in Sept Cummulative Update.

I also tried to revert the configurations using:
* “Allow Print Spooler to accept client connections” policy
* HKEY_LOCAL_MACHINE \Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint.

Nothing worked. I will appreciate any advice.

Thanks,

Manuel

Answer 1

For our personal experience with over 11000 computers environment. Using a method where we don't do change the security enforced by 2021-08 patch (like HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint" RestrictDriverInstallationToAdministrators = 1) is random.

If we revise 4 options that Microsoft give:

1. Provide administrator username and password when prompted -> This solution is just totally ridicul.
2. Include drivers in Windows image / preinstall drivers on the computer -> Work at 60% of the time. Some driver react properly and the are no more prompting to be required at user logon (HP, Ricoh or native driver like Generic Text). But some drivers, even if they are already on the machine, ask to be reinstalled at each opening session time (Minolta and some Ricoh). It very random and trying different/newer drivers not seem to fix it.
3. Use SCCM or Endpoint Manager to remotely install printer driver. -> It's exactly the same situation enumerated at point #2. This solution is working RANDOM depending of the driver/printer used.
4. Temporarily set RestrictDriverInstallationToAdministrators to 0 and install printer drivers... Again "Temporarily" could be "Permenantly" due to issue where some drivers asking to be reinstalled at each reopenig session.

Finally, the only working solution is to use RestrictDriverInstallationToAdministrators to 0 "permanent". Then add a mitigation where you need to add another strategy to secure which printer servers are allowed.

Answer 2

Wow! Microsoft didn't release Out-of-Band update for 2021-08 yet and didn't include this issue in Known issue list. It's been 10 days.

https://support.microsoft.com/en-us/topic/august-10-2021-kb5005043-os-build-14393-4583-709d481e-b02a-4eb9-80d9-75c4b8170240

Always, install at least 2 month old updates.

Answer 3

Hey Folks,

I realize this is somewhat of an older thread, but I figured I'd chime in as I have YOUR ANSWERS!

We require setting the following keys to mitigate print nightmare

• HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\NoWarningNoElevationOnInstall = 0
• HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\UpdatePromptSettings = 0
• HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators = 1

We deploy our printers using the user side of GPO under User Configuration > Control Panel Settings > Printers

This, obviously, was not working once we made our print nightmare mitigation changes, HOWEVER, I discovered that acquiring Type 4 (V4) User Mode drivers and replacing the Type 3 (V3) drivers on the print server allows for devices to install printers once again wtih our existing GPO configuration and Print Nightmare mitigation in place!

I also added the print servers to the GPO for these 2 policy settings: (Not sure if these were necessary, but i did it anyway)

• Computer Configuration> Administrative Templates > Printers > Package Point and Print - Approved Servers
• Computer Configuration > Administrative Templates > Printers > Point and Print Restrictions
• - Added print servers (semicolon separated) to the list of "Enter Fully Qualified Server Names Separated by semicolons" field.

Hope this helps all of you out there!

Thanks!
~Rick

Answer 4

RickoT, we've added type-4 drivers but still see issues. For example, we have a Ricoh printer, on the print server, with the Ricoh provided type-4 driver but the clients install the Microsoft default type-4 driver even though the Ricoh type-4 driver is available. We also have, on the print server, an HP M401dne installed with its provided HP type-4 driver. The client fails to install any driver even though the HP type-4 driver is available. We were able to get the M401dne to work using a universal driver. One last one, printers that have been working for months, started to prompt for admin credentials to install the driver but even after providing credentials, the driver will not install. Very painful.

Thus far the only thing consistent, is randomness. Microsoft's PrinterNightmare patch has basically deprecated the print manager.

The above printers are deployed per machine not per user.

Answer 5

"Thus far the only thing consistent, is randomness."

That is what I told my supervisors. The only consistent thing about this patch is its inconsistency.

I'm fearful the Microsoft solution is the only one provided.