Registration changed by customer's IT company remotely

[patterson70]

Customer called about a Ricoh SP C840DN I sold and service that had an SC899 that indicates a driver issue.
Found that one user there had tried to print a 98 page document and somehow the printer got confused and threw this code.
I could not delete the job because the user had left with his laptop.
I could not clear the que from another PC and even starting and stopping the printer spooler in Services did nothing.
So the customer called their IT company that manages their network to get some more help.
Well even though they denied it I think they tried to download a new driver.
And they may have remoted into Web Image Monitor and changed some settings.
Immediately after they got it printing the registration went suddenly bad and was printing a second color behind the first in text and images. It was not doing this before this stuck print job happened.
I went out and performed the registration adjustment and voila it was ok again.
Question: how the heck can this happen? Can someone remote in and change the registration? Or did they at first download an incorrect driver and it did this?
I'll never know what they did because they are playing games with me on what they did. I know they know they did something, but what?
Anyone have an idea?

[copier tech]

Re: Registration changed by customer's IT company remotely

Customer called about a Ricoh SP C840DN I sold and service that had an SC899 that indicates a driver issue.
Found that one user there had tried to print a 98 page document and somehow the printer got confused and threw this code.
I could not delete the job because the user had left with his laptop.
I could not clear the que from another PC and even starting and stopping the printer spooler in Services did nothing.
So the customer called their IT company that manages their network to get some more help.
Well even though they denied it I think they tried to download a new driver.
And they may have remoted into Web Image Monitor and changed some settings.
Immediately after they got it printing the registration went suddenly bad and was printing a second color behind the first in text and images. It was not doing this before this stuck print job happened.
I went out and performed the registration adjustment and voila it was ok again.
Question: how the heck can this happen? Can someone remote in and change the registration? Or did they at first download an incorrect driver and it did this?
I'll never know what they did because they are playing games with me on what they did. I know they know they did something, but what?
Anyone have an idea?

Firstly disable bonjour AND WSD via the WIM this will prevent the SC899 issue happening again or when they laptops off site return.

Next update the firmware this will also help prevent SC899.

After SC899 you can get strange issues, run ACC or forced line position this will resolve that issue.

[slimslob]

Re: Registration changed by customer's IT company remotely

Customer called about a Ricoh SP C840DN I sold and service that had an SC899 that indicates a driver issue.
Found that one user there had tried to print a 98 page document and somehow the printer got confused and threw this code.
I could not delete the job because the user had left with his laptop.
I could not clear the que from another PC and even starting and stopping the printer spooler in Services did nothing.
So the customer called their IT company that manages their network to get some more help.
Well even though they denied it I think they tried to download a new driver.
And they may have remoted into Web Image Monitor and changed some settings.
Immediately after they got it printing the registration went suddenly bad and was printing a second color behind the first in text and images. It was not doing this before this stuck print job happened.
I went out and performed the registration adjustment and voila it was ok again.
Question: how the heck can this happen? Can someone remote in and change the registration? Or did they at first download an incorrect driver and it did this?
I'll never know what they did because they are playing games with me on what they did. I know they know they did something, but what?
Anyone have an idea?

If a full power cycle of the printer does not dump the job and the SC899 comes up immediately after the restart, then the laptop being gone is not the problem. The job is in queue on a print server. The IT most likely merely logged in to the print server as a network administrator and deleted the job. What ever was in the document that caused the SC899 most likely also cause the loss of color registration. I have a feeling that the laptop user tried to print something from a malicious website.

[patterson70]

Re: Registration changed by customer's IT company remotely

Firstly disable bonjour AND WSD via the WIM this will prevent the SC899 issue happening again or when they laptops off site return.

Next update the firmware this will also help prevent SC899.

After SC899 you can get strange issues, run ACC or forced line position this will resolve that issue.

Many thanks for this, I will effect these changes!

[patterson70]

Re: Registration changed by customer's IT company remotely

If a full power cycle of the printer does not dump the job and the SC899 comes up immediately after the restart, then the laptop being gone is not the problem. The job is in queue on a print server. The IT most likely merely logged in to the print server as a network administrator and deleted the job. What ever was in the document that caused the SC899 most likely also cause the loss of color registration. I have a feeling that the laptop user tried to print something from a malicious website.

Also thank you slimslob for this as well!
It just shocks me that the registration can change that drastically from a print job!

[CopyBats]

Re: Registration changed by customer's IT company remotely

Also thank you slimslob for this as well!
It just shocks me that the registration can change that drastically from a print job!

I am willing to bet that while you were not there, the machine was unplugged several times in an attempt to clear the code. 99% of these users do not know how to turn off the machine properly. This sudden and repetitive power loss could have caused the machine to loose the ACC.

Disabling WSD does almost nothing. Usually issues are not from bonjour as the mac's auto install method is far better than the windows WSD protocol. I also disable SSDP so that the printer never shows up on windows users as a printer to automatically add.

You may also run into a situation with SC 899 Appearing even after the ethernet cable is unplugged. In that case turn off the printer, unplug the cable and then turn on the printer in order to disburse any residual charge in capacitors. Leave it alone for 30 minutes and turn it back on without the ethernet cable working.

If this still does not work then you'll have to clear printer memory and NCS.

Unfortunately I have my fair share of SC 899 on a regular basis. Firmware updates have helped 0%

[anothertech]

Re: Registration changed by customer's IT company remotely

Unfortunately I have my fair share of SC 899 on a regular basis. Firmware updates have helped 0%

Funny you say that, because firmware updates help me about 99% of the time.

[Ricoh-ono]

Re: Registration changed by customer's IT company remotely

Don't forget to disable IPP. I've had some SC899s and print issues even after WSD was disabled. After looking at the print driver I found Windows using IPP instead of TCP/IP. Once I disabled IPP, in addition to WSD, the problems never came back.

[anothertech]

Re: Registration changed by customer's IT company remotely

Don't forget to disable IPP. I've had some SC899s and print issues even after WSD was disabled. After looking at the print driver I found Windows using IPP instead of TCP/IP. Once I disabled IPP, in addition to WSD, the problems never came back.

The latest firmware solves the issues with IPP.

[patterson70]

Re: Registration changed by customer's IT company remotely

I am willing to bet that while you were not there, the machine was unplugged several times in an attempt to clear the code. 99% of these users do not know how to turn off the machine properly. This sudden and repetitive power loss could have caused the machine to loose the ACC.

Disabling WSD does almost nothing. Usually issues are not from bonjour as the mac's auto install method is far better than the windows WSD protocol. I also disable SSDP so that the printer never shows up on windows users as a printer to automatically add.

You may also run into a situation with SC 899 Appearing even after the ethernet cable is unplugged. In that case turn off the printer, unplug the cable and then turn on the printer in order to disburse any residual charge in capacitors. Leave it alone for 30 minutes and turn it back on without the ethernet cable working.

If this still does not work then you'll have to clear printer memory and NCS.

Unfortunately I have my fair share of SC 899 on a regular basis. Firmware updates have helped 0%

Great information. Yes, it is very possible someone unplugged in like you said. Will make note of this and inform the customer not to do that.

[dalewb74]

Re: Registration changed by customer's IT company remotely

i will bet that the IT did not use the ricoh driver, as they should in the beginning.

[slimslob]

Re: Registration changed by customer's IT company remotely

i will bet that the IT did not use the ricoh driver, as they should in the beginning.

I have had to work with good IT people and bad ones. The good ones always wanted the driver CD that came with the equipment, or in the case where they were getting multiple machines at least one. The bad ones let Windows install the printers automatically.