samba - Nov 2022 - Adding a Samba shared printer fails - Windows 11 22H2

Hello,

I am trying to install a printer on a non-domain joined computer which is shared
from our Samba server (running 4.16.6). As a side note, I ran into the same
problem with Samba 4.15.11, hoping upgrading to 4.16.x would help.

When I attempted to add printer "\\sambaserver1.xxx.ca\printer1" on
Windows 11 22H2, I am presented with the standard Windows dialog box,
"Connecting to printer1 on sambaserver1.xxx.ca", followed by another
dialog box asking for my user name and password.

I enter my credentials in the form AD-DOMAIN\paulg and my password. After a
while, I get another dialog box which says,  "The credentials supplied are
not sufficient to access this printer. Do you want to specify new
credentials?" If I enter the credentials again, I am presented with the
same dialog box.." "The credentials supplied are not sufficient to
access this printer. Do you want to specify new credentials?". Round and
round we go. I can mount my home directory from the same server, so what gives?

I was able to capture the session with tcpdump. Looking at the dump, I see that
the "NTLMSSP_AUTH, User:" packet contains ".\paulg" and not
"AD-DOMAIN\paulg" as I would expect.
I wonder if the problem is related to
https://bugzilla.samba.org/show_bug.cgi?id=15197 ?

In my testing, Windows 10 21H2 and Windows 11 21H2 function as expected. What
did MS do in Windows 11 22H2?

We are running Samba 4.16.6  (self-compiled) on Rocky Linux 8.6

Any hints on how I should proceed?

Thank you,
Paul

> In my testing, Windows 10 21H2 and Windows 11 21H2 function as expected.
What did MS do in Windows 11 22H2?
They've really mullered it! I've been getting loads of weird printer
issues since the new Windows updates, including the ones you describe, and after
ages of Googling all the different error codes Windows was throwing up, the
easiest and quickest solution was to just re-deploy Windows to the affected
machine. My Windows image has the printers attached to the new print server
already and all the drivers installed.
> Any hints on how I should proceed?
Interesting things I've learnt from the error message Googling is that 22H2
has a new authenticated RPC:
https://support.microsoft.com/en-us/topic/managing-deployment-of-printer-rpc-binding-changes-for-cve-2021-1678-kb4599464-12a69652-30b9-3d61-d9f7-7201623a8b25

There is an option to enable 'rpc named pipes', but my GPO's
didn't have the option listed for me to try:
https://www.ghacks.net/2022/11/02/windows-11-22h2-network-printing-switched-to-rcp-over-tcp/

And that the official MS guidance in light of their 'printnightmare' is
to install the printers into your Windows deployment image(!)

Good luck - let me know how you get on..

Tim