samba - Aug 2017 - KB3163912 breaks Point and Print Restrictions GPO settings for non-packaged-aware printer drivers

Has anyone found a workaround for Samba print servers?

https://social.technet.microsoft.com/Forums/en-US/030ee94a-047d-460a-bc39-52351a199364/kb31639
12-breaks-point-and-print-restrictions-gpo-settings

If I set the GPOs as stated on the WIKI
(https://wiki.samba.org/index.php/Setting_up_Automatic
_Printer_Driver_Downloads_for_Windows_Clients) Windows 10 refuses to install the
driver with
"a policy forbids the installation" (translated from german). If I
remove the policy I can
install everything fine (after the security prompt). 
This all works with Windows 7 as expected.

Regards

Christian

-- 
Dr. Christian Naumer
Research Scientist
Plattform-Koordinator Bioprozesstechnik

B.R.A.I.N Aktiengesellschaft
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.de, homepage www.brain-biotech.de
fon +49-6251-9331-30  /   fax +49-6251-9331-11

Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Dr. Juergen Eck (Vorsitzender), Frank Goebel
Aufsichtsratsvorsitzender: Dr. Ludger Mueller

Yes/maybe, 

Try this : 
https://support.microsoft.com/en-au/help/3170005/ms16-087-security-update-for-windows-print-spooler-components-july-12
Read :
https://www.systemcenterdudes.com/windows-10-point-and-print-printer-installation-prompt-uac/

Still not working, then... 
What is the exact problem ( please include windows event ids) , printer and
driver version your trying.
Samba version + smb.conf 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Christian Naumer via samba
> Verzonden: donderdag 24 augustus 2017 11:36
> Aan: samba at lists.samba.org
> Onderwerp: [Samba] KB3163912 breaks Point and Print 
> Restrictions GPO settings for non-packaged-aware printer drivers
> 
> Has anyone found a workaround for Samba print servers?
> 
> https://social.technet.microsoft.com/Forums/en-US/030ee94a-047
> d-460a-bc39-52351a199364/kb31639
> 12-breaks-point-and-print-restrictions-gpo-settings
> 
> If I set the GPOs as stated on the WIKI 
> (https://wiki.samba.org/index.php/Setting_up_Automatic
> _Printer_Driver_Downloads_for_Windows_Clients) Windows 10 
> refuses to install the driver with "a policy forbids the 
> installation" (translated from german). If I remove the 
> policy I can install everything fine (after the security prompt). 
> This all works with Windows 7 as expected.
> 
> Regards
> 
> Christian
> 
> --
> Dr. Christian Naumer
> Research Scientist
> Plattform-Koordinator Bioprozesstechnik
> 
> B.R.A.I.N Aktiengesellschaft
> Darmstaedter Str. 34-36, D-64673 Zwingenberg e-mail 
> cn at brain-biotech.de, homepage www.brain-biotech.de
> fon +49-6251-9331-30  /   fax +49-6251-9331-11
> 
> Sitz der Gesellschaft: Zwingenberg/Bergstrasse 
> Registergericht AG Darmstadt, HRB 24758
> Vorstand: Dr. Juergen Eck (Vorsitzender), Frank Goebel
> Aufsichtsratsvorsitzender: Dr. Ludger Mueller
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Hello Christian,

Am 24.08.2017 um 11:36 schrieb Christian Naumer via
samba:
> Has anyone found a workaround for Samba print servers?
> 
>
https://social.technet.microsoft.com/Forums/en-US/030ee94a-047d-460a-bc39-52351a199364/kb31639
> 12-breaks-point-and-print-restrictions-gpo-settings
> 
> If I set the GPOs as stated on the WIKI
(https://wiki.samba.org/index.php/Setting_up_Automatic
> _Printer_Driver_Downloads_for_Windows_Clients) Windows 10 refuses to
install the driver with
> "a policy forbids the installation" (translated from german). If
I remove the policy I can
> install everything fine (after the security prompt). 
> This all works with Windows 7 as expected.
Last time I verified the procedure was when I wrote the documentation
last January. It worked on 7/8.1/10 with all available updates applied.
I can re-check the procedure tonight.

What Samba and Win10 version are you using?

Which of the 2 GPOs do you refer to when you say "If I remove the policy
I can install everything fine"?

Regards,
Marc

Hello Louis, hello Marc,
thanks for you replies.
First of all some more Info:

Samba version is 4.6.7 Sernet on Centos7. Printing part of smb.conf is as
described in the
samba wiki. As it works on Windows 7 and Windows Server 2008R2 I don't think
it is a samba
Problem.

I am using Windows 10 Pro 1703. The kb3194798 is only for 1607 Systems and
won't install. But
as I understand it it should already be included in the 1703 Build?

The Problems are the exact problems described in kb3194798. I don't see
anything in the event
log on windows. I have set the GPOs as stated in the samba wiki. And I see no
difference to
the way described in kb3194798.

To answers Marcs question which policy I removed. It was both policies not just
one.

But after removing all printers restarting the machine some more times it now
works. Could be
that gpupdate and testing got mixed up or because some printers were installed
from a windows
print server I dont know. 

So sorry for the noise but thanks for the help.



Regards

Christian




Am Donnerstag, den 24.08.2017, 13:57 +0200 schrieb Marc Muehlfeld via
samba:
> Hello Christian,
> 
> Am 24.08.2017 um 11:36 schrieb Christian Naumer via samba:
> > Has anyone found a workaround for Samba print servers?
> > 
> >
https://social.technet.microsoft.com/Forums/en-US/030ee94a-047d-460a-bc39-52351a199364/kb3
> > 1639
> > 12-breaks-point-and-print-restrictions-gpo-settings
> > 
> > If I set the GPOs as stated on the WIKI
(https://wiki.samba.org/index.php/Setting_up_Autom
> > atic
> > _Printer_Driver_Downloads_for_Windows_Clients) Windows 10 refuses to
install the driver
> > with
> > "a policy forbids the installation" (translated from
german). If I remove the policy I can
> > install everything fine (after the security prompt). 
> > This all works with Windows 7 as expected.
> 
> Last time I verified the procedure was when I wrote the documentation
> last January. It worked on 7/8.1/10 with all available updates applied.
> I can re-check the procedure tonight.
> 
> What Samba and Win10 version are you using?
> 
> Which of the 2 GPOs do you refer to when you say "If I remove the
policy
> I can install everything fine"?
> 
> Regards,
> Marc
> 
-- 
Dr. Christian Naumer
Research Scientist
Plattform-Koordinator Bioprozesstechnik

B.R.A.I.N Aktiengesellschaft
Darmstaedter Str. 34-36, D-64673 Zwingenberg
e-mail cn at brain-biotech.de, homepage www.brain-biotech.de
fon +49-6251-9331-30  /   fax +49-6251-9331-11

Sitz der Gesellschaft: Zwingenberg/Bergstrasse
Registergericht AG Darmstadt, HRB 24758
Vorstand: Dr. Juergen Eck (Vorsitzender), Frank Goebel
Aufsichtsratsvorsitzender: Dr. Ludger Mueller

On 24/08/17 12:57, Marc Muehlfeld via samba wrote:
> Hello Christian,
> 
> Am 24.08.2017 um 11:36 schrieb Christian Naumer via samba:
>> Has anyone found a workaround for Samba print servers?
>>
>>
https://social.technet.microsoft.com/Forums/en-US/030ee94a-047d-460a-bc39-52351a199364/kb31639
>> 12-breaks-point-and-print-restrictions-gpo-settings
>>
>> If I set the GPOs as stated on the WIKI
(https://wiki.samba.org/index.php/Setting_up_Automatic
>> _Printer_Driver_Downloads_for_Windows_Clients) Windows 10 refuses to
install the driver with
>> "a policy forbids the installation" (translated from german).
If I remove the policy I can
>> install everything fine (after the security prompt).
>> This all works with Windows 7 as expected.
> 
> Last time I verified the procedure was when I wrote the documentation
> last January. It worked on 7/8.1/10 with all available updates applied.
> I can re-check the procedure tonight.
> 
> What Samba and Win10 version are you using?
> 
> Which of the 2 GPOs do you refer to when you say "If I remove the
policy
> I can install everything fine"?
I can confirm that I seem to be experiencing the same problem. A few 
days ago, printers published from Samba AD and installed via GPO refused 
to install any more. This has been working fine for 6 months or so, 
since I setup the AD, until a few days ago - all according to 
instructions here: 
https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients.


In the Event viewer on the Windows client I get the following:

EventID: 4098
Source: Group Policy Printers
Level: Warning
The user '<printer_name_on_samba_server>' preference item in the 
'<my_printer_installation_gpo_name>' Group Policy Object did not
apply
because it failed with error code '0x800704ec'. This program is blocked 
by group policy. For more information contact your system administrator. 
This error was suppressed.

Trying to browse for the printer directly on the Samba AD (from Windows 
workstation) I can see it, but when I double-click on it, I get the 
following error:

"A policy is in effect on your computer which prevents you from 
connecting to this printer queue"

or:

"Operation could not be completed (error 0x00000bc4). No printers are
found"

(the error message varies from machine to machine).

My setup is:

Samba ADC + print server: Samba 4.6.2
Clients: Windows 10 Pro x 3
A Samsung and a Brother printer shared on the Samba print server


Disabling the "Legacy printer driver policy" completely seems to get 
everything working properly, and the printers are installed correctly 
again by the printer installation gpo.


Follow-up: After more tests, it would appear that a recent Windows 10 
update has modified the behaviour of the two print server trust GPO's. 
When I amended them to use the *non* FQDN name of my print server, they 
started working again.

Has anyone else experienced similar issues? Or maybe my findings are 
incorrect and the issue is somewhere else?