samba - Feb 2023 - Unable to add Point and Print printers to clients with Windows 8.1 and up

Did you setup all needed GPOs? Take a look at:

https://www.gruppenrichtlinien.de/artikel/printnightmare-3-richtlinien-werden-benoetigt

Using these GPOs works for me.



Am 26.02.23 um 16:08 schrieb Thomas Keppler via samba:
> Hello everyone,
> 
> I can finally ditch Windows 7 in my Samba AD DC based setup. unfortunately,
adding printers from my Samba-based print server (separate server, member in the
domain) does not work.
> 
> My print server shows up fine on Windows 8.1[1] and Windows 10, all
printers are there and even copying the driver seems to complete successfully.
> However, right in the very last step when it configures the print queue,
I'm getting this error:
> 
> 	A policy is in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator.
> 
> Now, I _am_ the systems administrator and I can't remember setting any
such policy :^)
> 
> Joking aside, of course, I've followed the GPO recommendations the
Samba Wiki provides[2]. I've also tried a more recent driver[3] and adding
the requested policy to the default domain policy to aid in application.
> 
>  From what I can see in the client's registry[4], the GPO is applied as
desired. No obvious errors are present anywhere. Searching the Samba mailing
list brought me to other fitting entries[5] with Sharp printers, but those hints
couldn't resolve my problems. I've double checked my DNS settings and
I've confirmed to have proper Forward and Reverse Lookup Zones.
> 
> I'm using Samba 4.13.13-Debian on Debian 11.6 on all Samba systems.
> 
> Any help, pointers or experiences that could help me resolve this issue (or
at the very least, to understand what's actually going on) would be deeply
appreciated.
> 
> Thank you.
> 
> --
> Sincerely
> Thomas Keppler
> 
> P.S. My setup is still almost the same as it was in 2017[6], except that I
followed Louis' advice[7] and my fileserver is doing WINS now.
> 
> --
> [1] Don't worry, I want to move to Windows 10/11, the Windows 8 one was
just a "last resort test installation" because that used to work circa
2018. All installations have been fully patched.
> [2]
https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients#Creating_a_GPO_for_Trusting_the_Print_Server
> [3] SHARP MX-3060V, "PCL6/PS/PPD Printer-Driver for Windows, version
2103a, WIN 64":
https://apps.sharp.de/cps/rde/xbcr/documents/documents/Service_Information/Drivers/MX_D54_PCL6_PS_2103a_German_64bit.exe
> [4] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\Printers\PointAndPrint
> [5] https://marc.info/?l=samba&m=163819340601616&w=2 and following
> [6] https://marc.info/?l=samba&m=150775735717432&w=2
> [7] https://marc.info/?l=samba&m=150780992230169&w=2

Hi Stefan,

thanks for the idea! Indeed, I didn't have the third GPO[1] of the bunch,
just the two present in the Samba Wiki.
However, applying the third to the client doesn't change the situation.

I've also resorted to use a Domain Admin and Local Admin account to conduct
these tests to rule out any permission problems in the first place.

--
Sincerely
Thomas Keppler

--
[1] HKLM\Software\Policies\Microsoft\Windows
NT\Printers\PointAndPrint\RestrictDriverInstallationToAdministrators = 0

P.S. This is a double post to Stefan, I've missed to reply to the mailing
list as well in my original reply... Sorry for the noise.