Windows administrators are reporting large-scale network printing issues after installing this week’s September 2021 Patch Tuesday security updates.
Microsoft released sixty security updates and fixes for many bugs as part of its monthly Patch Tuesday updates on Tuesday, including a fix for the last remaining PrintNightmare vulnerability tracked as CVE-2021-36958.
This vulnerability is critical to fix as it is used by many ransomware gangs and threat actors to immediately gain SYSTEM privileges on vulnerable devices as shown below.
However, many Windows system administrators are now reporting [1, 2] that their computers can no longer print to network printers after installing PrintNightmare patches on their print servers.
Some real network printers can no longer be installed after the Tuesday patch.
Screenshot of someone in Brazil, pic.twitter.com/RuGkuV0aP6
– Brute Bee (@BruteBee) September 16, 2021
In conversations with several Windows admins dealing with these issues, they all told BleepingComputer that updates interrupt their network printing and that they can only fix them by removing the updates.
“The problem occurred for us at different sites. The print servers were 2012R2 and 2016. All were working fine before the update,” an administrator told BleepingComputer.
“After yesterday’s Windows update, none of the computers on the network can print to the Windows 10 computer we use as a print server,” another administrator told BleepingComputer.
“As far as I know this affected both printers with v3 and v4 drivers, but I’m not 100% sure (this issue was different from the issue that appeared with the previous update that broke v3 printers) . After uninstalling the patch on the server, everything is back to normal, “another administrator told us yesterday.
Although all users have problems with network printing, they do not see the same errors.
For example, one person told us that their devices were showing a 4098 warning in the app event logs. This error indicates that the preference item “User” in “GPO did not apply because it failed with error code” 0x8007011b “This error has been suppressed. “
Another administrator told us that their Printer Ports tab was blank, while another said they received “Access Denied” errors.
These issues also appear to affect all network printers, including HP, Canon, Konica Minolta, and Label printers, as well as Type 3 and Type 4 printer drivers.
Those who have USB printers connected directly to their computers have no problem.
The updates associated with the new PrintNightmare security update and resulting network printing issues are:
PrintNightmare fixes causing significant issues
Unfortunately, to fix the vulnerabilities in PrintNightmare, Microsoft has had to make significant changes over the past two months to Windows Point and Print functionality and the way drivers can be installed from a print server.
These changes include the requirement for administrator privileges to install a printer driver through the Point and Print feature.
After Microsoft made these changes, Windows users started receiving errors when trying to print, or Windows asked for an administrative password to update printer drivers.
While Microsoft has introduced new registry settings that allow you to control these changes, disabling them will again leave a Windows device vulnerable.
According to a security researcher Benjamin Delpy, this week’s PrintNightmare patch also introduced new changes that automatically block the print driver function of the CopyFiles directive.
Administrators can configure this change through the Windows registry CopyFilesPolicy value under HKLM Software Policies Microsoft Windows NT Printers key. When set to “1”, CopyFiles will be enabled again.
If other printer drivers are used in your organization that uses the CopyFiles directive, they will no longer work, resulting in further conflicts.
BleepingComputer has contacted Microsoft with questions about these issues, but has not received a response yet.