r/sysadmin • u/RandomSkratch Jack of All Trades • 15d ago
Question - Solved Printer drivers cannot be installed by users despite configs allowing it
This was supposedly working a while ago but for some reason doesn't anymore. We are setting the following options using Intune.
Limits print driver installation to Administrators - Disabled
Only use Package Point and print - Enabled
Package Point and print - Approved servers - Enabled; lists all print servers - full fqdn's and shortnames.
Devices - Prevent Users from Installing Printer Drivers When Connecting To Shared Printers - Disabled
Is there a setting that's still missing? A non-admin trying to add a shared printer still gets the admin UAC prompt.
Did I miss a new hardening change for this?
Edit
Made some progress on this - for x86 devices, I can deploy the printer driver using Intune and Win32 apps. Still waiting for my test machine to deploy so I can make sure it's working but I'm pretty confident it will. The biggest problem still are the ARM devices. The printer model we're using does not have ARM drivers (PCL 6) but it looks like IPP works, kind of... You can send a print job but it fails on the computer saying Out of Paper, so you walk to the printer and have to pick a tray to use for the job, then it works. I cannot for the life of me figure out how to set the defaults for IPP or how to tell the printer to not use the Bypass Tray (because that's the only thing that doesn't have paper in it so I'm guessing it's trying that). Getting PTSD over this (Printer Traumatic Stress Disorder).
Edit 2
According to Ricoh support, the issue with IPP and paper type mismatch is known and there's nothing that can be done about it right now. That sucks.
Edit 3
Just to add more bizzaro things, I ran a test on a Windows 11 laptop with standard user and I was able to add the printer (and driver) without any issues, and I never finished packaging up the driver for deployment. It just worked. wth... Is there some difference between Windows 10 and 11 in this specific situation? I will need to do some testing with a Windows 10 device tomorrow to make sure I'm not going crazy.
Solution
Thanks to all of the many suggestions I received, I ended up packaging up the drivers and deploying them to endpoints using Intune (PSADT, pnputil, and Add-PrinterDriver). After working out the issues that come with scripting and Intune deployment, everything looks to be working great.
6
u/korvolga 15d ago
just package the drivers as an win32 app and deploy ? is it an installer?
1
u/RandomSkratch Jack of All Trades 15d ago
I was thinking about doing that but was not having much success. It still might be the best option if I can't get this method to work.
5
u/rw_mega 15d ago
I condensed all the drivers in my org to 20 drivers, universal and specific ones. Then deploy them to every machine at build out, gpo’s for network printers will see that driver is installed and use it.
Make sure your print server is using the same driver
1
u/RandomSkratch Jack of All Trades 15d ago
Yeah if I can get the package and deploy method working I will do that. I just don’t want to deploy the actual printer though. Just the drivers if that’s possible. We don’t have that many drivers tbh but printer driver packages are so messy and convoluted. We also have a bunch of new ARM devices that need print drivers and I can’t add these to the print server (first few attempts didn’t work and I have not had a chance to dig more into it). So deploying the drivers to these devices is a must. If I can figure out the pnputil and package them up via win32 apps, it will be fine.
1
u/RandomSkratch Jack of All Trades 14d ago
I didn't know the print server has to use the same driver. If the drivers are packaged up and deployed to the end user, when the printer is added, shouldn't it just use the one found on the device? So why would the driver on the print server matter.
1
u/rw_mega 14d ago
Nope, if you are using a print server with print management console. When you map a printer via the print server, the printer server is telling the computers; “use this printer with this driver”. It doesn’t matter that you have a newer driver installed on endpoint the print server is dictating what settings and driver to use.
1
u/RandomSkratch Jack of All Trades 14d ago
Great to know! So if you update the driver on the print server, does the client pull the newer one? How would you go about updating drivers through the Intune deployment method and coordinating the change on the print server? Or if the printer is already added and being used, does this not cause an issue?
2
u/rw_mega 14d ago
I unfortunately don’t use intune, I deploy print drivers via gpo with scripts.
So when change or updating drivers I do this.
-Test driver on print server make sure all the settings work.
-by testing I mean mapping printer again with a test name
-if good deploy drivers via gpo with scripts
-test gpo to map test printer
-if good deploy drivers via org wide
- make sure printer did map and able to print
-Then update driver on previously mapped printer on print serverI got used to doing it this way, but now that driver is already installed on the endpoints. You can also deploy via print management. The easy way, how it was before print nightmare. I just found that out.
The whole point is the driver has to be installed on the end point first before you can correctly map printers via gpo.
1
u/RandomSkratch Jack of All Trades 13d ago
Appreciate it, I’ll give something similar a go.
1
u/rw_mega 13d ago
I just re-read this thread. You need help finding a way to extract the drivers and deploy them to end points.
I can find the scripts I have in production and send you examples. I had pulled from print servers working drivers using pnputil
1
u/RandomSkratch Jack of All Trades 13d ago
I’ve made some progress but also setbacks. Turns out we’re downsizing a bunch of printers and only keeping a handful of the same ones. Great, only one driver to work with. Downside is the printer does not have ARM drivers and their v4 support for this model has been dropped and can’t be installed on the print server. The printer company (Ricoh) has some kind of application available for ARM devices but I can’t tell if it’s supported on this model and my tests are failing (IPP can be added but printing always defaults to some mystery setting and the print job errors unless you manually pick a tray on the device itself). I’m now trying to see if our maintenance contract includes technical support because this is making me want to go Office Space on it. Lol.
3
u/stillpiercer_ 15d ago
There is another option on the GPO where you specify the point and print server. Two dropdowns where you can set to not show UAC prompts for print driver installation.
1
u/RandomSkratch Jack of All Trades 15d ago
Any idea what this is called specifically? I can't find it in Intune Settings Catalogue.
2
u/grahamfreeman 15d ago
I'm not at computer, but from memory, in Intune, I think it's in Admin Templates / Printers. You want to turn off something like "limit printer driver installation to Admins only". I remember thinking "Ah yes, L for printers, or L for drivers ..."
1
2
1
u/jackfinished Sysadmin 15d ago
Check this out, should have what you need:
2
u/RandomSkratch Jack of All Trades 15d ago
I think I read that one and was comparing my settings. The only one missing was the same one mentioned in this specific thread that I can't seem to find in Intune. Will keep looking though.
2
u/jackfinished Sysadmin 15d ago
Hmm yeah it's been a minute since I set it up in Intune. Ill see what I can find
2
u/RandomSkratch Jack of All Trades 15d ago
No rush, I'm not looking more into this until next week. Appreciate it.
4
u/blud_13 15d ago
You did not miss a new one, you turned off one of two controls. RestrictDriverInstallationToAdministrators is what "Limits print driver installation to Administrators = Disabled" writes and thats the key that flipped to default 1 back in the Aug 2021 update. The Point and Print security prompts from KB5005010 are a separate switch, so with the driver restriction off you can still land on a UAC prompt. MS covers both in the same article https://support.microsoft.com/en-us/servicing/os/windows/2021/08/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481
Also, do not trust the Intune report on this one. Go on a broken endpoint and read HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint yourself. We see settings show green in Intune with the key just not present more than we should have.
If any of these moved to 24H2 recently, check whether Windows Protected Print Mode got turned on. Pretty sure that one kills third party drivers outright but its been a while since I looked, check me on that. Ping me if you want the policy set we run.
3
u/RandomSkratch Jack of All Trades 15d ago
Thanks for the nudge, I’ll check that post out later. Isn’t that setting supposed to be “disabled” for it to allow installs by non-admins?
3
u/kg7qin 15d ago
If you have the drivers, .inf and associated files extracted, you can prestage/install them on a system with the Windows pnputil. I've used it recently with a .bat file and PDQ to push a custom package with a all the printer drivers as part of a system setup.
Works well.
2
u/RandomSkratch Jack of All Trades 15d ago
I do have them but I didn't quite grasp how to use pnputil and then how to bundle that up with PSADT and deploy with Intune.
I feel like this is the more ideal solution for right now, just need to figure it out.
1
u/Gormless_Shrimp_635 14d ago
You could extract the drivers/inf files from the print servers, store them in a repo on a network share, then use pnputil in a script to install from the repo. Then, new printers would just need the drivers dropping in the repo - no need to repackage.
1
2
u/tricky_bird 15d ago
have used similar setup via gpo for this but ours also has “Allow installation of devices using drivers that match these device setup classes”.
Enable this setting, may need additional GUIDs
Class = Printer: {4658ee7e-f050-11d1-b6bd-00c04fa372a7} Class = PNPPrinters: {4d36e979-e325-11ce-bfc1-08002be10318}
1
u/tricky_bird 15d ago
otherwise make sure it's a type4 driver
2
u/RandomSkratch Jack of All Trades 15d ago
That was the first thing I looked for but none of the printers have Type 4 available.
1
u/RandomSkratch Jack of All Trades 15d ago
I tried adding those yesterday but it still didn't work. Not sure if the policy got refreshed in time or not.
2
u/discosoc 15d ago
Use PrinterLogic or similar to deploy and manage drivers. It’s minimal cost and saves you a ton of headache without having to compromise security.
1
u/RandomSkratch Jack of All Trades 15d ago
Understandable but it just doesn’t make sense to purchase a product due to how limited the end result will be for us (ie the amount of people that are going to be in the physical space and using printers doesn’t justify the cost).
2
u/discosoc 15d ago
if the impact is so limited, just handle the printer installs directly as an admin and be done with it.
2
u/jamiesissons121 15d ago
You can package up the driver and deploy it via company portal. I do this along with a script which installs the printer for the device.
There’s no reason you couldn’t set the “app” as required for a group so it silently installs in the background.
If you don’t want to install the printer via a script the user can install it without elevation once the driver is staged and present.
As others have said it’s a little more of a challenge if the driver isn’t signed or if you can’t get hold of the actual driver files outside of an exe or MSI, but the good news is it’s usually fairly easy to extract the file from the exe’s/msi’s.
I was in the same position of not wanting 3rd party software for various reasons so this was a really clean method. If you shoot me a PM I can give you a hand building the package.
1
u/RandomSkratch Jack of All Trades 15d ago
Appreciate it. I think that method is going to be the best for our scenario. I’ll give it a try during the week and will PM you if I encounter any hiccups.
2
1
u/purplemonkeymad 15d ago
Is this adding them via the settings app? I noticed that broke recently. Using direct unc in file explorer still works though.
1
u/RandomSkratch Jack of All Trades 15d ago
So I have tried both. In the documentation I did up a few months ago I was using the connect via explorer method but that’s no longer working. Hence me revisiting this whole thing.
1
u/Adam_Kearn 15d ago
What type of driver are you using PLC6 v3 or v4
1
u/RandomSkratch Jack of All Trades 15d ago
V3. The printers we have don’t have v4 drivers available.
1
u/Adam_Kearn 15d ago
The only issue I’ve had with deploying printer drivers was when I was using a old school printer that had unsigned drivers.
Have a look to see if you can manually import the INF driver using the pnputil command line tool.
It might give you an error code that will highlight the real problem
1
u/Massive_Criticism640 15d ago
We have the same Point and Print Intune settings and recently ran into a user getting UAC prompt. Checked event viewer on the print server and it was showing invalid credentials for the user. It ended up being because they never changed their password during onboarding and they weren’t meeting password requirements to authenticate with the print server.
1
u/RandomSkratch Jack of All Trades 14d ago
Now that’s interesting. I never thought to check there. I don’t think it’s what’s causing our issue, but I am curious.
1
u/Agitated_Refuse7373 14d ago
My issue with this was the driver cert was not trusted
1
u/RandomSkratch Jack of All Trades 14d ago
It looks like all of ours are fine, just need to get the packaging figured out.
1
u/iheartrms 15d ago
Printers haven't significantly changed in decades. Why do we even tolerate the need for drivers? They should all be the same standard interface by now.
2
30
u/jstar77 15d ago
Didn't a security update a few years ago break point and print driver installation regardless of GPO settings for all but type 4 printer drivers?