1

Recent (2021-08-10) KB5005033 Windows update actually brings this issue back to life by forcing admins only to install printer drivers (and thus, not allowing printer distribution via User Configuration GPO), quote:

...Updates the default installation privilege requirement so that you must be an administrator to install drivers when using Point and Print...

Suddenly, our users get these popups (only on computers having KB5005033 update installed):

Do you trust this printer? issue

To make it (deploying shared printers in Windows domain via User Configuration GPO) work again...

There are some prerequisities first in Computer Configuration - Policies - Administrative Templates - Printers (we used to have these enabled a long time ago already):

  1. Point and Print Restrictions:
  • must be ENABLED
  • Do not show warning or elevation prompt must be set for both When installing drivers for a new connection and When updating drivers for an existing connection. The Enter fully qualified server names separated by semicolons must be filled with proper nameservers (e.g. myPrintserver.mydomain.com;myOtherprintServer.mydomain.com)
  1. Package Point and print - Approved servers:
  • is ENABLED
  • contains list of same servers as above

GPO prerequisities

The actual workaround* for KB5005033 issue:

  1. HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators is set to 0 on affected machines - can be done easily via GPO, too:

The workaround to bypass KB5005033

* This is a workaround, not a fix, because it makes your printservers vulnerable again (which is what KB5005033 tries to "fix" in the first place) - but we do need to print, right... ?

Anybody knows how to fix this properly? (without making printesrvers vulnerable)

Thanks a lot.

Related issues:

crysman
  • 151

2 Answers2

2

Microsoft published a summary of various solutions we can use to manage the new behavior.

Specifically:

Install print drivers when the new default setting is enforced

If you set RestrictDriverInstallationToAdministrators as not defined or to 1, depending on your environment, users must use one of the following methods to install printers:

  • Provide an administrator username and password when prompted for credentials when attempting to install a printer driver.

  • Include the necessary printer drivers in the OS image.

  • Use Microsoft System Center, Microsoft Endpoint Configuration Manager, or an equivalent tool to remotely install printer drivers.

  • Temporarily set RestrictDriverInstallationToAdministrators to 0 to install printer drivers.

[...]
Important There is no combination of mitigations that is equivalent to setting RestrictDriverInstallationToAdministrators to 1.
[...]

I recommend you to deploy the printer drivers to your computers, then, remove all deployed Point and Print Group Policies and Package Point and Print Group Policies, as they are not required anymore, and do not set the RestrictDriverInstallationToAdministrators registry value because this will allow a vulnerability on your clients/servers.

Don't forget that each Windows device where the Print Spooler is enabled is vulnerable if you set the RestrictDriverInstallationToAdministrators registry value to 0, it's not about the Print Servers only, clients computers and other Windows servers are impacted too!

Be aware that there is another vulnerability in the Print Spooler at the moment, patch is still pending: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36958

Disabling the Print Spooler wherever possible is a good rule of thumb...

Swisstone
  • 7,063
2

I've found out two possible solutions, both of them do not provoke any UAC/admin rights prompt:

  1. Switch to Computer Configuration deployment instead (CC -> Pr -> Control panel -> Printers -> New -> TCP/IP). Note that printer driver Type 3 is required on printserver in order to work. Printserver is used only to deploy the printer, after that, affected machines are able to print independent on printserver (e.g. when switched off or unavailable).

  2. Reinstall the printer on printserver with Type 4 driver and continue in using User Configuration deployment (if Type 4 driver is available). I use printmanagement.msc console. How I did it? First, removed all the old drivers to the printer like so: enter image description here

Then plugged the printer in directly (not via our Repotec TCP/IP printserver box) via USB and let MS Windows install the drivers themselves - it installed the "Class" driver, Type 4:

enter image description here

IMPORTANT! Registry hacks like RestrictDriverInstallationToAdministrators are NOT needed, as well as Point and Print Group Policies and Package Point and Print Group Policies - not needed either, if you had them ever applied, follow the Microsoft's official mitigation guide. Also, if you had removed the update KB5005033 as a workaround, install it and get protected.

Good luck!

crysman
  • 151