Microsoft update KB3159398 breaks gpo printer mapping

[dotdeas]

Hi,

Just wanted to give a heads-up for kb3159398 that breaks printers mapped up by gpo. After this patch was installed printers was not mapped up correctly, uninstalled the update and all worked well.

Br,
Andreas Persson
Teleservice Skåne AB
Sweden

[habik]

Thanks

Byting on bits.

[ApeosMan]

KB3170455 is another bastard of an update...

[tonnerboy]

KB3170455 is another bastard of an update...

Did someone manage this update?
One of my costumers are calling me with this issue. He tells me that it is related to the Digital Signature of the driver

Can same one help me with it? He is using a Ricoh MP6000 PCL6 driver

[rthonpm]

Did someone manage this update?
One of my costumers are calling me with this issue. He tells me that it is related to the Digital Signature of the driver

Can same one help me with it? He is using a Ricoh MP6000 PCL6 driver

Here's Microsoft's mitigation for this issue: https://support.microsoft.com/en-gb/kb/2307161 If it's a small customer you could just have them turn off Point and Print restrictions entirely.

[amos.kaplan]

I had this one stop smb to folder...

Security Update Capicom KB931906 2.1.0.2

[tonnerboy]

Here's Microsoft's mitigation for this issue: https://support.microsoft.com/en-gb/kb/2307161 If it's a small customer you could just have them turn off Point and Print restrictions entirely.

Hi.
This is not a smaller customer and change the group policy restrictions it's out of the question.
This is related to the digital signature. How can I put a digital signature in printer driver?

[rthonpm]

Unless you have a digital signature recognised by Microsoft, you can't. Just have the customer change the GPO to allow point and print printing from their specific print servers if possible, or at least let them know that it's a Windows issue. Have you checked for a newer print driver as well?

[emujo]

KM drivers are digitally signed, this update add something called "driver package aware". I just went through this with another customer. They were able to go onto the print server and manually change the setting on the driver to "package aware".

From Google...

This tweak will get your Canon, Sharp or KonicaMinolta printers up and running again by making the drivers Package Aware.



Edit the register on your print server(s). If you change the
value of the key PrinterDriverAttributes under
HKLM\System\CurrentControlSet\Control\Print\Enviro nments\Windowsx64\Drivers\...\Driver
name\ and restart the print server, you are able to make
Windows treat the driver as packaged, and it will install unattended
with gpo. The hex number has to be odd.
To keep the original settings for the printer driver and only
make it Package aware you should add 1 to the original value of
PrinterDriverAttributes. In my print environment the original attribute
had the value 4, so I changed it to 5 and that made it
Package aware. Different versions of the driver (and different vendors)
might need other values.


Restart server .


According to MS the 1 flag for PrinterDriverAttributes stands for
PRINTER_DRIVER_PACKAGE_AWARE. This will treat the driver as package
aware, which means a CAB package will be created, including the inf and
the catalog. The package will be installed through
setupapi.dll when installing the driver, validating that the catalog is
trusted, and that hashes for all files are included in the catalog.



BTW: This is not a Microsoft problem, but a printer vendor problem!
Two lines of code in the *.inf file will make the driver Package aware
and fix the problem properly! Solution for vendors posted by Microsoft
here: https://msdn.microsoft.com/en-us/library/windows/hardware/ff559698(v=vs.85).aspx

[tonnerboy]

KM drivers are digitally signed, this update add something called "driver package aware". I just went through this with another customer. They were able to go onto the print server and manually change the setting on the driver to "package aware".

Ernujo, Thank you so much for your info. Learn a lot.
I saw that the Ricoh MP6000 PCL6 Driver for Universal Print is Package-Aware since Version 3.8.0.0.
I do not know if it will solve the problem of this patch (KB-3170455) because this version has been released a long time ago... I will wait for the reply from costumer.
Once again thank you so much.