3

I have an Active Directory server (Windows Server 2019) with Print Server Enabled and a GPO for each section of the office to deploy the correct printer. All clients are windows 10 or 11.

The GPO is:

Computer Configuration

Policies > Administrative Templates > Printers:

  • Limits print driver installation to Administrators -> Disabled

  • Only use Package Point and print -> Enabled

  • Package Point and print - Approved servers -> Enabled
    Enter fully qualified server names: here I have all the printers like \\DC\printer1 (I have added all the printers here)

    and

User Configuration

  • Policies > Administrative Templates > Control Panel > Printer:
    Turn off Windows default printer management -> Enabled
  • Preferences > Control Panel Settings > Printers
    Shared Printer (Name: \DC\printer-i-want)
    printer-i-want (Order: 1)

For some printers it works fine - the printer is added to the printers list and is selected as default. For some other printers Event Viewer on the pc records error

The user 'printername' preference item in the 'MY-GPO-NAME' Group Policy Object did not apply because it failed with error code '0x800704ec This program is blocked by group policy. For more information, contact your system administrator.' This error was suppressed.

what i've done:

  1. check to see if kb5005652 or KB3170455 exist on client pcs (link)
  2. fully updated the test pc
  3. changed the GPO with different printer to see if it works
  4. tried to find the Type 4 - User Mode printer driver for all of my printers

The printer HPM426-C works in all of the cases. it is Type 4
The printer HPM426-M did not work - had type 3 - changed it to type 4 and now it works
The printer OKI-MC342 did not work - is type 4
The printer OKI-MC363 did not work - is type 3 but cannot find the type 4 driver.

How can I fix this? any help would be apreciated!

Also is there any way to remove other printers from the client pc's to avoid confusion?

UPDATE when i was logged in as administrator the printer was added.

4
  • I had the same issue with OKI and just ended up deploying the driver first. Once the driver is present on the system, the printers will work. If its not many computers, you can just manually add the OKI's once (with admin privileges) and it will work for every user after that.
    – Silbee
    Apr 24 at 12:32
  • the printer was previously installed to the pc before the active directory installation - the problem was that on every user login brought back all the printers from other machines and users didn't know what printer to choose. that is why they chose to deploy them with GPOs
    – athskar
    Apr 24 at 12:48
  • @athskar I just updated my post with further "user configuration" level tips that may also help. Ensure to refresh my post to see the latest revision. Apr 24 at 18:31
  • FYI: Neither kb5005652 or KB3170455 are applicable to any supported version of Windows 10 or Windows 11. They would have long been superseded by more recent updates.
    – Ramhound
    Apr 24 at 18:47

1 Answer 1

3

See the screen shot of the GPO and settings within at the Computer Configuration level to ensure the printers are able to be added when the user logs onto the computer.

  • Computer Configuration > Administrative Templates > Printers
  • Computer Configuration > Preferences > Windows Settings > Registry

Note: Ensure that the AD computer object is in an OU that this GPO is applied and that Domain Computers and Domain Users (and/or Authenticated Users) is in the Security Filtering for permission to Apply.

enter image description here

I do not believe this applies to your case, but as a bonus, if you use a DNS A or CNAME record type for your print server, you will need to add a regkey on the print server called DnsOnWire, and then reboot the server.

  • reg add HKLM\SYSTEM\CurrentControlSet\Control\Print /v DnsOnWire /t REG_DWORD /d 1

enter image description here


Furthermore, regarding User Configuration level settings ensure that there is a Group Policy Preference to Update the printer via the GPP to map it for the user (and update if current named printer already exists). Ensure within the Common tab that the option is checked for Run in logged-on user's security context (user policy option) too.

  • User Configuration > Preferences > Control Panel Settings > Printers

Note: Ensure that the AD user object is in an OU that this GPO is applied and that Domain Computers and Domain Users (and/or Authenticated Users) is in the Security Filtering for permission to Apply too. If it is user explicit, ensure that you also include Domain Computers plus the user account or its group.

enter image description here


Lastly, if you have policies set to block MS Store app, you might need to undo those policies and/or check the correlated registry settings are purged from the workstations with the issue.

I have never had this issue with printers not installing due to blocking the MS Store, but that specific error is what is indicated, so undoing these restrictions might help in your case, but check these last perhaps if the other things mentioned does not resolve.


Supporting Resources

1
  • @athskar... Also, you can set the GPP to delete printers as well. In the bottommost screen shot of my post, from the General tab and the Action section, you just need to drop that down to Delete and have the \\printserver\printersharename in the shared path section, and that will delete the printer. You also want to ensure run in user's context is selected. If you are trying to remove, test both with and without use's context created though to see which is needed for which printers based on how they are defined. Apr 26 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .