none
Computer applying printer GPO even though GPO is not assigned, any way to enable more logging?

    Question

  • I have a computer that appears to be processing a GPO that's adding printers. A gpresults doesn't show a any computer or user policies with printers in it. It's almost like a cached old policy is processing? Is that even possible? Is there anyway to enable additional logging so I can maybe catch a name of the policy or something? I don't really see anything to helpful in the event log GroupPolicy or Print Service section, expect that group policy had an issue installing one of the printer... I even tried removing the computer from the domain and adding it back. When I do group policy modeling, I see no printers should be installed in the report.

    Any ideas?

    Thanks in advanced!

    Tuesday, January 31, 2017 4:52 PM

All replies

  • Hi,

    Please try deleting GPO history related files here:

    C:\Users\<your current users>Administrator\AppData\Local\Microsoft\Group Policy\History

    Then: GPUPDATE/FORCR

    Besides, I suppose the following link is helpful for troubleshooting GPO related issues:

    Troubleshooting Group Policy Using Event Logs

    https://technet.microsoft.com/en-us/library/cc749336%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

    In addition, did you have any 3rd software effect this?

    Best regards,

    Andy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, February 01, 2017 5:37 AM
    Moderator
  • So far, these step below appear to have resolved the issue.

    1. Delete these entries for the printers that were "stuck" on the machine and shouldn't be there then restarted the print spooler.

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections\{105BA375-6F85-4690-A262-AC7FF1432B4F}]
    "Server"="\\\\Server01"
    "Printer"="\\\\Server01\\PRTMAINIL1 (Fax)"
    "Provider"="win32spl.dll"
    "LocalConnection"=dword:00000001
    "Attribute"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections\{349E1F36-604D-467D-AE61-CBD73EF52480}]
    "Server"="\\\\Server01"
    "Printer"="\\\\Server01\\PRTMAINIL1"
    "Provider"="win32spl.dll"
    "LocalConnection"=dword:00000001
    "Attribute"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections\{9CEB0035-D65D-465F-B03E-825D28C780D4}]
    "Server"="\\\\Server01"
    "Printer"="\\\\Server01\\Loan500C"
    "Provider"="win32spl.dll"
    "LocalConnection"=dword:00000001
    "Attribute"=dword:00000001

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections\{C40B7ADC-2E0F-4A50-B874-75E74384E62B}]
    "Server"="\\\\Server01"
    "Printer"="\\\\Server01\\PRTMAINIT"
    "Provider"="win32spl.dll"
    "LocalConnection"=dword:00000001
    "Attribute"=dword:00000001

    2. The fax one still came back after restarting the print spooler so I had to delete this additional entry.

    [HKEY_CURRENT_USER\Printers\Connections\,,Server01,PRTMAINIL1 (Fax)]
    "GuidPrinter"="{0A4F6104-4EA8-4943-B6CC-88A73ED4A7B2}"
    "Server"="\\\\Server01"
    "Provider"="win32spl.dll"
    "LocalConnection"=dword:00000001

    The "stuck" printers are now no longer showing under printers on the client computer and only the proper printers in the GPO are deployed and appear under printers on the client workstation.

    Now my question is why did these printers get "stuck". They appear like they were deployed via a GPO previously, because I couldn't right click on the printers and delete them. They gave me and error that I didn't have access to do so.  Also, I saw entries in the client computer print event log about not being able to some of the "stuck" printers, i.e. "Group policy was unable to add per computer connection \\server\printer name. Error 0x6. Event ID 513 from PrintService source.

    My testing shows that printers deployed via group policy show up under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections\ When I remove the group policy to deploy the printers to the machine and perform a gpupdate /force, the entries under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections\ disappear...

    Any thoughts? I'm trying to find a way to prevent this from happening again, though every seems fine now at the moment.



    • Edited by Truwarrior Friday, February 03, 2017 4:48 AM
    Friday, February 03, 2017 4:46 AM