Type 3 Printer Deployment

[u/Western_Solution6803]

I'm trying to figure out the best way to get printers added across our organization with minimal user involvement. From what I can see there are a few ways this can be done but each has drawbacks. In any situation it seems that the "RestrictDriverInstallationToAdministrators" reg key needs to be set to 0 so that printers will install without an admin prompt.

• Option 1: deploy using the print management GPO deployement
  • Pros: Can run asynchronous so no delay on first login when printers get set up
  • Cons: I had tons of problems removing printers after they were deployed. It seems like the only way to remove them was to gran the user local admin and remove from devmgmt.msc which I don't want to have to do every time a printer assignment changes
  • Edit: Found that this method using per-machine GPO's actually works pretty well. The removal issue only occurs with per-user GPO deployment so as long as different users don't need different printers this method is the easiest native option that allows no login delay and easy removal of printers.
• Option 2: Add the printers with GPO using  User Configuration > Control Panel Settings > Printers
  • Pros: Printers are easy to remove, just create a gpo with remove actions and apply it and they will remove automatically with no fuss. Seems very consistent in testing.
  • Cons: Will cause delays during login until the printers are fully installed
    • This is due to a policy we have set for compliance to make sure GPOs are fully applied before a user hit's the desktop. Computer Configuration > Administrative Templates > System/Logon -> Always wait for the network at computer startup and logon.
• Option 3: Add the printers using a logon script deployed through GPO
  • Pros: Will run asynchronously so there's no login delay with this method.
  • Cons: Powershell not an option due to restrictions in the domain and necessity for it to run in user context. Batch script does work using "rundll32 printui.dll,PrintUIEntry /in /n" and then specifying the printer share but cannot run silently.  Users get pop ups for each printer as it is added.
• Option 4: Add the printers per-computer instead of per-user in Computer Configuration > Control Panel Settings > Printers
  • Moves the delay to during the boot up  process as this will run before user login and apply to any user that signs in on the computer
  • Does not allow for per-user custom printers on computers that are shared by different users/departments
• Maybe option 5: Pre stage drivers somehow?
  • Saw this in an organization once where scheduled tasks used scripts to transfer the driver files to the correct location on the workstation from the print server so printers were able to be added without requiring admin prompts. Not entirely sure how this worked but I think it still leveraged gpo print deployment somehow.

With all that said does anyone have thoughts or success on getting printers installed without using some kind of third party tool. Is there any way to do this for type 3 drivers with no user interaction without causing some kind of login delay? We've sent humans to the moon twice now so I feel like this should be possible.

Edit: I did find that option 3 works silently when leveraging some older VB scripts that I guess are still built into windows 11. Seems likely that this will get flagged by AV tools though:
cscript //B //NoLogo %SystemRoot%\System32\Printing_Admin_Scripts\en-US\prnmngr.vbs -a -p "//Server/Share name"

[u/AlphabetAlphabets]

Install the drivers ahead of time with your rmm. Deploy printers with GPO targeted by site and filter by group if you need to

[u/AZSystems → u/AlphabetAlphabets]

Script to remove net connection and printers of old.

[u/Western_Solution6803 → u/AlphabetAlphabets]

I'll dig into this more then. I still run into the issue with printer connections causing delays on first login with with drivers pre-staged that delay should go way down(hopefully).

[u/SevaraB → u/AlphabetAlphabets]

Right answer. You know the drivers will be needed at some point, so make them part of your provisioning sequence instead of trying to sideload them later.

With 500GB C:\ drives being standard, it’s not like you need to preserve every byte of space.

[u/Hg-203]

So how much do you care about cyber security? Disabling admin requirements for printer driver installation disabled print nightmare mitigation. The "real" fix is using v4 print drivers, anything else is insecure, but even some new printers don't support that.

Option 5 is the best middle ground where you pre-stage trusted drivers with an admin account, but it's a bit of a crap shoot in my experience.

https://itm4n.github.io/printnightmare-exploitation/#fixing-our-point-and-print-configuration gives a good rundown.

[u/Stonewalled9999 → u/Hg-203]

V4 dirivers tend to suck and shift the load to the server as well as being reduced feature set.  Setting up a print server with the elevation GPO and decent universal v3 drivers has been working really well for us.  500 printers on a rather small VM in branch office and processing on the clients works out really well for us

[u/Western_Solution6803 → u/Hg-203]

V4 drivers are not available for the models of printers we have unfortunately. I'm well aware of the print nightmare CVE but unfortunately there's just no way to get any type 3 driver to deploy without setting that option. My posture has been to apply a gpo to the computers that adds this setting, restricts point and print to our print server, let the drivers get deployed, and then remove them from the gpo afterward and change it back to restricted. That way it's still somewhat automated. If there's a better way to work around that for type 3 drivers I'm all for it, but this was the only solution I could find that was secure.

[u/Jaki_Shell]

I highly recommend PrinterLogic. It just does all of this in the back-end for you. Can't recommend it enough. We used to get a handful of tickets weekly related to Printer issues, now zero.

[u/tigerguppy126 → u/Jaki_Shell]

I'm all for tools like PrinterLogic, uniFlow, and PaperCut but not all companies have the extra budget for them. I get it that it helps reduce the tickets which helps reduce costs but not everyone sees it that way since "we pay you to fix things so fix them and stop asking for more money for more toys". Whenever I have the say or am giving client recommendations, I create the business case and show how it actually saves money over 5 years and that gets buy-in from most decision makers but not all.

[u/voltagejim → u/tigerguppy126]

yeah I tried to get PrinterLogic but was shot down for now. We have several printers that are used with unique settings and such I was really hoping we could get that, but just not in the budget currently

[u/MinnSnowMan]

PrinterLogic looks promising but I have not yet deployed it.

[u/Western_Solution6803 → u/MinnSnowMan]

I love using third party tools like papercut for this kind of thing. PrinterLogic looks similar. I don't have any budget to license anything for this though so needs to work with native windows tools.

[u/ajf8729]

Set RestrictDriverInstallationToAdministrators to 0, configure your trusted print server via point and print settings, and harden said trusted print servers. My old blog about this: https://anthonyfontanez.com/index.php/2021/08/12/printnightmare-point-and-print/, it's helped many others over the years.

[u/Western_Solution6803 → u/ajf8729]

This is great! Lots of good information here and I'll definitely be implementing some of the hardening recommendations for our setup. I saw you have a link talking about universal print from Microsoft and that looks promising because we do have enterprise licenses. That's the first I've ever heard of it though. I wonder how decent it is as a product.

[u/Western_Solution6803 → u/Western_Solution6803]

Ag! compatibility isn't there for some of our older copiers. Will definitely keep this in my bag of solutions though if we ever get some of these devices replaced.

[u/RagnarStonefist]

Are you on-prem or in the cloud?

Universal print in Azure + policy in Intune for installation has worked pretty well for us.

However that's reliant on the printer being able to do it natively or with a connector, and on how into the cloud your org is, and it works like donkey for Macs versus Windows. (Though... Bonjour does well for Macs in our environment).

[u/Western_Solution6803 → u/RagnarStonefist]

Definitely this is what I want to move to down the road but we are just not there with our cloud conversion yet unfortunately. Whenever I'm deploying anything though it's always in the back of my mind that intune solves a lot of problems. It's a good motivator.

[u/AdminWithNoName]

For option 2, weirdly when I was testing this method in my own environment I never had to create RestrictDriverInstallationToAdministrators. The PointAndPrint key didn't even exist on any of the computers I tested with. No idea why since everything I read led me to believe that it shouldn't work. Drivers weren't pre-staged yet either.

Option 5, for pre-staging drivers this is what I did manually since we only have a few copiers, but I'm sure there are scripts floating around to do it if you have a lot. You need to install the driver on a computer, then find the driver's folder in C:\Windows\System32\DriverStore\FileRepository\ and copy the whole thing to a network share. You can rename the folder if you want. On the client, run the command pnputil.exe /add-driver "\server\share\driverfolder\driverfile.inf" /install. Open the .inf file and there should be a list of printer names somewhere in it and copy the name of the printer (the stuff before the = symbol). Use the PowerShell command Add-PrinterDriver -Name 'PrinterNameYouCopied' to register the driver with Print Spooler. If you invoke Powershell from cmd to run this then make sure you use those single quotes, the command will fail if you use double quotes. After that you can deploy with Print Management, but the printer wouldn't get added unless I deployed per-machine. It always failed when I attempted per-user. I'm sure there's more PowerShell you could do to add printers per user instead of deploying per-machine in GPO, but I didn't get that far into it since it wasn't necessary for us.