samba - Feb 2023 - Unable to add Point and Print printers to clients with Windows 8.1 and up

Hello everyone,

I can finally ditch Windows 7 in my Samba AD DC based setup. unfortunately,
adding printers from my Samba-based print server (separate server, member in the
domain) does not work.

My print server shows up fine on Windows 8.1[1] and Windows 10, all printers are
there and even copying the driver seems to complete successfully.
However, right in the very last step when it configures the print queue, I'm
getting this error:

	A policy is in effect on your computer which prevents you from connecting to
this print queue. Please contact your system administrator.

Now, I _am_ the systems administrator and I can't remember setting any such
policy :^)

Joking aside, of course, I've followed the GPO recommendations the Samba
Wiki provides[2]. I've also tried a more recent driver[3] and adding the
requested policy to the default domain policy to aid in application.

From what I can see in the client's registry[4], the GPO is applied as
desired. No obvious errors are present anywhere. Searching the Samba mailing
list brought me to other fitting entries[5] with Sharp printers, but those hints
couldn't resolve my problems. I've double checked my DNS settings and
I've confirmed to have proper Forward and Reverse Lookup Zones.

I'm using Samba 4.13.13-Debian on Debian 11.6 on all Samba systems.

Any help, pointers or experiences that could help me resolve this issue (or at
the very least, to understand what's actually going on) would be deeply
appreciated.

Thank you.

--
Sincerely
Thomas Keppler

P.S. My setup is still almost the same as it was in 2017[6], except that I
followed Louis' advice[7] and my fileserver is doing WINS now.

--
[1] Don't worry, I want to move to Windows 10/11, the Windows 8 one was just
a "last resort test installation" because that used to work circa
2018. All installations have been fully patched.
[2]
https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients#Creating_a_GPO_for_Trusting_the_Print_Server
[3] SHARP MX-3060V, "PCL6/PS/PPD Printer-Driver for Windows, version 2103a,
WIN 64":
https://apps.sharp.de/cps/rde/xbcr/documents/documents/Service_Information/Drivers/MX_D54_PCL6_PS_2103a_German_64bit.exe
[4] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\Printers\PointAndPrint
[5] https://marc.info/?l=samba&m=163819340601616&w=2 and following
[6] https://marc.info/?l=samba&m=150775735717432&w=2
[7] https://marc.info/?l=samba&m=150780992230169&w=2

On 26/02/2023 15:08, Thomas Keppler via samba wrote:
> Hello everyone,
> 
> I can finally ditch Windows 7 in my Samba AD DC based setup. unfortunately,
adding printers from my Samba-based print server (separate server, member in the
domain) does not work.
> 
> My print server shows up fine on Windows 8.1[1] and Windows 10, all
printers are there and even copying the driver seems to complete successfully.
> However, right in the very last step when it configures the print queue,
I'm getting this error:
> 
> 	A policy is in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator.
> 
> Now, I _am_ the systems administrator and I can't remember setting any
such policy :^)
> 
> Joking aside, of course, I've followed the GPO recommendations the
Samba Wiki provides[2]. I've also tried a more recent driver[3] and adding
the requested policy to the default domain policy to aid in application.
> 
>  From what I can see in the client's registry[4], the GPO is applied as
desired. No obvious errors are present anywhere. Searching the Samba mailing
list brought me to other fitting entries[5] with Sharp printers, but those hints
couldn't resolve my problems. I've double checked my DNS settings and
I've confirmed to have proper Forward and Reverse Lookup Zones.
> 
> I'm using Samba 4.13.13-Debian on Debian 11.6 on all Samba systems.
I suggest you use Samba from backports, this will get you a Samba 
supported version (4.17.5)
> 
> Any help, pointers or experiences that could help me resolve this issue (or
at the very least, to understand what's actually going on) would be deeply
appreciated.
> 
> Thank you.
> 
> --
> Sincerely
> Thomas Keppler
> 
> P.S. My setup is still almost the same as it was in 2017[6], except that I
followed Louis' advice[7] and my fileserver is doing WINS now.
Windows seems to be having a lot of problems with printers at the moment 
and it seems to be suggested you remove printer drivers etc and 
reinstall everything again.

Rowland

Did you setup all needed GPOs? Take a look at:

https://www.gruppenrichtlinien.de/artikel/printnightmare-3-richtlinien-werden-benoetigt

Using these GPOs works for me.



Am 26.02.23 um 16:08 schrieb Thomas Keppler via samba:
> Hello everyone,
> 
> I can finally ditch Windows 7 in my Samba AD DC based setup. unfortunately,
adding printers from my Samba-based print server (separate server, member in the
domain) does not work.
> 
> My print server shows up fine on Windows 8.1[1] and Windows 10, all
printers are there and even copying the driver seems to complete successfully.
> However, right in the very last step when it configures the print queue,
I'm getting this error:
> 
> 	A policy is in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator.
> 
> Now, I _am_ the systems administrator and I can't remember setting any
such policy :^)
> 
> Joking aside, of course, I've followed the GPO recommendations the
Samba Wiki provides[2]. I've also tried a more recent driver[3] and adding
the requested policy to the default domain policy to aid in application.
> 
>  From what I can see in the client's registry[4], the GPO is applied as
desired. No obvious errors are present anywhere. Searching the Samba mailing
list brought me to other fitting entries[5] with Sharp printers, but those hints
couldn't resolve my problems. I've double checked my DNS settings and
I've confirmed to have proper Forward and Reverse Lookup Zones.
> 
> I'm using Samba 4.13.13-Debian on Debian 11.6 on all Samba systems.
> 
> Any help, pointers or experiences that could help me resolve this issue (or
at the very least, to understand what's actually going on) would be deeply
appreciated.
> 
> Thank you.
> 
> --
> Sincerely
> Thomas Keppler
> 
> P.S. My setup is still almost the same as it was in 2017[6], except that I
followed Louis' advice[7] and my fileserver is doing WINS now.
> 
> --
> [1] Don't worry, I want to move to Windows 10/11, the Windows 8 one was
just a "last resort test installation" because that used to work circa
2018. All installations have been fully patched.
> [2]
https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients#Creating_a_GPO_for_Trusting_the_Print_Server
> [3] SHARP MX-3060V, "PCL6/PS/PPD Printer-Driver for Windows, version
2103a, WIN 64":
https://apps.sharp.de/cps/rde/xbcr/documents/documents/Service_Information/Drivers/MX_D54_PCL6_PS_2103a_German_64bit.exe
> [4] HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows
NT\Printers\PointAndPrint
> [5] https://marc.info/?l=samba&m=163819340601616&w=2 and following
> [6] https://marc.info/?l=samba&m=150775735717432&w=2
> [7] https://marc.info/?l=samba&m=150780992230169&w=2