[Samba] Windows 10 point and print restriction

L.P.H. van Belle belle at bazuin.nl
Mon Aug 15 07:01:26 UTC 2016


Ok you probely have hit : KB3163912 and KB3172985 problems. ( win 10 ) 
For win 7 you can have trouble due (KB3170455) 

Some good info here.
http://blog.vectranetworks.com/blog/microsoft-windows-printer-wateringhole-attack

Here are some tips to fix this also. 

- Remove the KB ( start with KB3172985) , but thats not my advice.

- Setup the point and print restrictions as followed. 

Computer Configuration > Policies > Admin Templates > Printers > Point and Print Restrictions

AND 

User Configuration > Policies > Admin Templates > Control Panel > Printers > Point and Print Restrictions

Set both the security prompt to "Dont show waring or elevation prompt" 
And if needed set the FQDN for the server names if you apply also that restriction. 

For the rights, or set Authenticated users 
Or set for your users "your chosen group" + "Domain Computers" 

I can already tell 
- Kyocery is comming with an new (samba+cups point and print) compatible driver.  If you want i have the new one here. Tested it last week. 
It will be released in short time, they are getting the driver signed now at MS. 

- Bother, that one i dont know anything about. 

- HP, update 6.(0-1).x to 6.2.1 can give some problems. 
One fix is clear the print spooler and clear the drivers from the systems
And install the latest new one. 
I had problems here with upgradeing. One systems updated ok, other not possible, not even as Admin. 

And last, in all scripts settings etc. use : \\<servername.your.domain.tld\printer-share  


Hope this all helps a bit. 
Let us know. 


Best regards, 

Louis




> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens Vogel, Sven via
> samba
> Verzonden: zondag 14 augustus 2016 22:24
> Aan: 'samba at lists.samba.org'
> Onderwerp: Re: [Samba] Windows 10 point and print restriction
> 
> Hi L.P.H,
> 
> the following printers:
> 
> Brother MFC-J6920 DW
> Brother MFC-8380 DN
> Kyocera ECOSYS M2535DN
> Kyocera ECOSYS M2535dn
> Kyocera ECOSYS P7035cdn
> Kyocera TASKalfa 3501i
> Canon iR3235
> HP LaserJet 2100
> HP OfficeJet Pro 8100
> 
> Drivers:
> Brother MFC-8380DN Printer	Windows x64	1.6.0.6
> Brother MFC-8380DN Printer	Windows x64	1.6.0.6
> Canon iR3235/iR3245 PCL6	Windows x64	14.2.0.2
> Kyocera Classic Universaldriver PCL6	Windows x64	3.0.531.0
> HP Officejet Pro 8100	Windows x64	9.84.0.84
> HP Universal Printing PCL 5	Windows x64	61.180.1.180
> 
> Does this help?
> 
> Thanks
> 
> Sven
> 
> 
> -----Ursprüngliche Nachricht-----
> Von: samba [mailto:samba-bounces at lists.samba.org] Im Auftrag von L.P.H.
> van Belle via samba
> Gesendet: Sonntag, 14. August 2016 17:09
> An: samba at lists.samba.org
> Betreff: Re: [Samba] Windows 10 point and print restriction
> 
> which printer brand/model and which driver?
> 
> 
> > Op 14 aug. 2016 om 13:25 heeft Vogel, Sven via samba
> <samba at lists.samba.org> het volgende geschreven:
> >
> > Hi,
> >
> > it seems there is a problem/bug in windows 10 that point and print
> restriction dont work and gpo are ignored. I don't know. When I use
> windows 7 there o problems. technet article they speak about packaged
> driver. I think that will not solve the problem. what I see it will affect
> all drivers also changed like these link
> http://serverfault.com/questions/573411/why-cant-i-upload-drivers-to-my-
> samba-print-server
> >
> >
> https://wiki.samba.org/index.php/Configuring_Point'n'Print_automatic_print
> er_driver_deployment
> >
> > https://social.technet.microsoft.com/Forums/office/en-US/030ee94a-047d-
> 460a-bc39-52351a199364/kb3163912-breaks-point-and-print-restrictions-gpo-
> settings?forum=winserverGP
> >
> > There are any information from the samba team about the problem? In
> >
> > Sven Vogel
> > Senior Systemingenieur
> >
> >
> > --
> > To unsubscribe from this list go to the following URL and read the
> > instructions:  https://lists.samba.org/mailman/options/samba
> >
> 
> 
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba





More information about the samba mailing list