Can't remove printers previously deployed by Group Policy Printer Deployment

Question

Back in the good old days, before PrintNightmare patches in 4Q21, we pushed printers out by Group Policy Printer Deployment. (Clarifying: Not with Preferences, but with Policies, using the Print Management MSC.) At the site I'm working on now, they were all per-computer, but the same thing applies to per-user printers elsewhere.

PrintNightmare patches, as most admins know, thoroughly broke GPPD.

Now, all workstations have zombie printers hosted by now-decommissioned print servers, and we can't get rid of them. Even brand-new user profiles inherit them.

They are removed from the printer GPOs via Print Management MSC. But because the print CSE doesn't work anymore, neither does the printer removal.

PowerShell Get-Printer doesn't even list them.

Standard users can't remove them (and never could, which is by design). Admin users can remove them, but they return.

I'm guessing that resetting Windows would get rid of them, since there's no trace left of them in Policy. But that's pretty extreme.

There are dozens or maybe 100s of references to the old print servers in the Registry, but I'm hoping only 1 or 2 of them, or flags in the printer settings, actually need to be removed. I can probably come up with some PowerShell magic to get rid of all of them--if that will address it. But I'm hoping there's a simpler way.

Anyone know a surgical way to get rid of them?

Answer 1

You can surgically remove them by editing the registry.

As you stated, the user was not able to remove printer. That is a feature with Deployed Printer.

The printers are added with a flag so they can't be deleted so clearing them from the registry is the way to go.

Start with HKEY_USERS\USERSID\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PushedConnections

There is also HKEY_USERS\USERSID\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PushedPrinterConnectionStore

When a connection does exist this will be a per user registry key based on their SID.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider

The connections also live under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider\Servers\SERVERNAME\Printers

Restart the Print Spooler service after the key clean up.

Answer 2

Ok, I have the exact same problem. Old Deployed Printers are unable to be removed.

I found that you can remove them from the hidden devices Printer Queues node of Device Manager (turn on Show Hidden Devices and expland the Print Queues Node) and they actually go away. I haven't tried scripting this with PowerShell yet but I see that it might be possible.

First, remove all references to the disconnected print server from the registry. I removed all references that included the old print server name. The printers now showed in the Printers and Devices list as Disconnected. I then opened Device Manager and removed the hidden print queues.

At this point, the printers disappeared from the list of Printers and Devices and did not return on reboots and logins.

Answer 3

Hi JRV,Add the Print Server Role to a machine with Group Policy Management Console. The policy module from Print Management will now be loaded by GPMC and you can remove the old objects. There is no need to run any scripts. I discuss this method in one of the Vista technology guides from Microsoft but even I no longer have a copy. Thanks

Answer 4

Hello

Thank you for your question and reaching out.

Please create script or startup GPO using below command to delete unwanted or orphaned printers.

wmic printer where (name like '%%(copy %%') delete

--If the reply is helpful, please Upvote and Accept as answer--

Answer 5

I'm not sure what CSE is for you.

The Microsoft default for adding connection to shared printers when the printers use Type 3 drivers is that the users on the client system are required to have local administrative rights on the client systems.

If the user is admin, the connections should be added.

If the driver on the server is a Type 4, the connection should be added regardless of the client level of access to the system but the driver on the server is NEVER copied to the client system so the connection is created with a framework driver normally resulting in a degraded print experience.

You can change this default requirement by allowing non admins the ability to install the software from the print server, the software being the print driver.

The domain policy located in Computer \ Admin Templates \ Printers \ Limits print driver installation to Administrators

When you disable this policy a standard used can make the connection to a shared printer which uses a Type 3 driver.