samba - Nov 2021 - Point and Print Nightmare ? Samba4 ? or a simple driver issue ?

Hi friends, 

I jump on the PrintNightmare topic because we still
encounter an issue with SHARP PCL6 print driver.

We've kindly followed
all the recommandations about the 3 GPOs. We've updated to Samba 4.15.2
and Windows to 21H2. 

But no way, when the driver is downloaded by the
client, at the "Installing driver" step, the following error raise :


"A POLICY IS IN EFFECT ON YOUR COMPUTER WHICH PREVENTS YOU FROM
CONNECTING TO THIS PRINTER QUEUE" 

With the driver we use (we tried
many differents versions), it occurs only on Samba4 print server (tried
with a Windows 2012 - ok), and only with the SHARP driver 

In fact,
with others drivers brands, for instance Kyocera, point and print works
perfectly. Driver is downloaded and printer successfully installed. So
my guess is that Point and print is not the cause. BUT the message above
tells about a policy, and furthermore it probably appeared after a bunch
Windows updated. That's confusing. 

Does anybody already encountered
and solved this ? 

Thanks !

--

Olivier

https://docs.microsoft.com/en-us/troubleshoot/windows-server/printing/cannot-install-shared-network-printer-locally#:~:text=A%20policy%20is%20in%20effect,connecting%20to%20this%20print%20queue.&text=The%20printer%20driver%20is%20not,administrator%20about%20disabling%20this%20policy.

Which shows... 

This issue may also occur if the following conditions are true:

DNS reverse zone lookup isn't configured.
DNS is configured incorrectly on the print server.
DNS issues on the print server.

Its not for nothing i hammer on, make sure you have A and PTR for you servers..


Verify this. 

Greetz, 

Louis
 
> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Olivier BILHAUT via samba
> Verzonden: maandag 29 november 2021 14:17
> Aan: samba
> Onderwerp: [Samba] Point and Print Nightmare ? Samba4 ? or a 
> simple driver issue ?
> 
> Hi friends, 
> 
> I jump on the PrintNightmare topic because we still
> encounter an issue with SHARP PCL6 print driver.
> 
> We've kindly followed
> all the recommandations about the 3 GPOs. We've updated to 
> Samba 4.15.2
> and Windows to 21H2. 
> 
> But no way, when the driver is downloaded by the
> client, at the "Installing driver" step, the following error
raise :
> 
> 
> "A POLICY IS IN EFFECT ON YOUR COMPUTER WHICH PREVENTS YOU FROM
> CONNECTING TO THIS PRINTER QUEUE" 
> 
> With the driver we use (we tried
> many differents versions), it occurs only on Samba4 print 
> server (tried
> with a Windows 2012 - ok), and only with the SHARP driver 
> 
> In fact,
> with others drivers brands, for instance Kyocera, point and 
> print works
> perfectly. Driver is downloaded and printer successfully installed. So
> my guess is that Point and print is not the cause. BUT the 
> message above
> tells about a policy, and furthermore it probably appeared 
> after a bunch
> Windows updated. That's confusing. 
> 
> Does anybody already encountered
> and solved this ? 
> 
> Thanks !
> 
> --
> 
> Olivier 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

And look at these. 

User Configuration\Administrative Templates\Control Panel\Printers\

Point and Print Restrictions >> Disable
Prevent addition of printers >> Disable
Prevent deletion of printers >> Disable


Local Computer Policies\Administrative Templates\Printers\
Allow print spooler to accept client connections  >> Enable
 
( can also be found in the Gpo Editor. ) 
https://admx.help/  a search here helps. 

Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Olivier BILHAUT via samba
> Verzonden: maandag 29 november 2021 14:17
> Aan: samba
> Onderwerp: [Samba] Point and Print Nightmare ? Samba4 ? or a 
> simple driver issue ?
> 
> Hi friends, 
> 
> I jump on the PrintNightmare topic because we still
> encounter an issue with SHARP PCL6 print driver.
> 
> We've kindly followed
> all the recommandations about the 3 GPOs. We've updated to 
> Samba 4.15.2
> and Windows to 21H2. 
> 
> But no way, when the driver is downloaded by the
> client, at the "Installing driver" step, the following error
raise :
> 
> 
> "A POLICY IS IN EFFECT ON YOUR COMPUTER WHICH PREVENTS YOU FROM
> CONNECTING TO THIS PRINTER QUEUE" 
> 
> With the driver we use (we tried
> many differents versions), it occurs only on Samba4 print 
> server (tried
> with a Windows 2012 - ok), and only with the SHARP driver 
> 
> In fact,
> with others drivers brands, for instance Kyocera, point and 
> print works
> perfectly. Driver is downloaded and printer successfully installed. So
> my guess is that Point and print is not the cause. BUT the 
> message above
> tells about a policy, and furthermore it probably appeared 
> after a bunch
> Windows updated. That's confusing. 
> 
> Does anybody already encountered
> and solved this ? 
> 
> Thanks !
> 
> --
> 
> Olivier 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> 
>

Mandi! L.P.H. van Belle via samba
  In chel di` si favelave...
> Its not for nothing i hammer on, make sure you have A and PTR for you
servers..
I have NO PTR addresses... this topic come back sooner or later... i've had
just in place a DNS/DHCP infrastructure, and i prefere to keep that.

Can i simply create the reverse zone for my clients and 'override' the
main
one, or i need to reconfigure also the DHCP server?

Speaking from a different point of view: i need the PTR only for servers, or
all the clients need PTR?

-- 
  Solo una sana e consapevole libidine
  salva il giovane dagli SCOUT e dall'Azione Cattolica!
						(Zucchero, circa O;-)

Mandi! L.P.H. van Belle via samba
  In chel di` si favelave...
> And look at these. 
Seems the same i've set at 'Computer Configuration'...

-- 
  Alla fiera dell'est, per due soldi
  un topolino mio padre compro`				(A. Branduardi)

On Mon, 2021-11-29 at 14:17 +0100, Olivier BILHAUT via samba
wrote:
> Hi friends, 
> 
> I jump on the PrintNightmare topic because we still
> encounter an issue with SHARP PCL6 print driver.
> 
> We've kindly followed
> all the recommandations about the 3 GPOs. We've updated to Samba
> 4.15.2
> and Windows to 21H2. 
> 
> But no way, when the driver is downloaded by the
> client, at the "Installing driver" step, the following error
raise :
> 
> 
> "A POLICY IS IN EFFECT ON YOUR COMPUTER WHICH PREVENTS YOU FROM
> CONNECTING TO THIS PRINTER QUEUE" 
> 
> With the driver we use (we tried
> many differents versions), it occurs only on Samba4 print server
> (tried
> with a Windows 2012 - ok), and only with the SHARP driver 
> 
Eventually someone is going to need to do a proper network trace and
deep dive on the Samba code to follow exactly what happens against both
servers and see how our responses differ from Windows.

Showing that Samba negotiates different network protocols, protection
levels etc would be a good start.

I've seen so many mails on this topic, so this isn't going to resolve
itself by just users chatting with users.  I suggest someone engages
one of our fine Samba Commercial Support providers familiar with this
area to get to the bottom of this.

Andrew Bartlett

-- 
Andrew Bartlett (he/him)       https://samba.org/~abartlet/
Samba Team Member (since 2001) https://samba.org
Samba Team Lead, Catalyst IT   https://catalyst.net.nz/services/samba

Samba Development and Support, Catalyst IT - Expert Open Source
Solutions

On 2021-11-29 at 14:17 +0100 Olivier BILHAUT via samba sent
off:
> We've kindly followed
> all the recommandations about the 3 GPOs. We've updated to Samba 4.15.2
> and Windows to 21H2. 
> 
> But no way, when the driver is downloaded by the
> client, at the "Installing driver" step, the following error
raise :
we've analyzed the problem, it happens if you have the print server running
on
a AD DC Samba server only. Microsoft is running RPC via SMB with the printer
nightmare patches now. On a Samba print server, which is running as a member
server the problem did not show up.  The patch for master, which makes it work
in a AD DC also is here:
https://gitlab.com/samba-team/samba/-/merge_requests/2343.patch

Best regards
Bj?rn
-- 
SerNet GmbH - Bahnhofsallee 1b - 37081 G?ttingen
phone: +495513700000  mailto:contact at sernet.com
AG G?ttingen: HR-B 2816 - https://www.sernet.com
Manag. Directors Johannes Loxen and Reinhild Jung
data privacy policy https://www.sernet.de/privacy