@jt1001001 said in Network Printer keeps re-adding itself:

@mr-jones Xerox printer by chance?

Yes, we have 11 of them.

@notverypunny said in Network Printer keeps re-adding itself:

@mr-jones

OK, so it sounds like it's back to basics time:

• Multiple networks / segments or all on a common network
• use something like advanced IP scanner to see if there's anything unknown on the network it's self
• Keep in mind that printer sharing / publishing also has smb / samba in the loop, not just the print-spooler

Where I'm going with this is that there could be something publishing on the network with upnp or, zero-conf, bonjour or some other automagic protocol that your endpoints are only picking up based on one of the options (or defaults) in the GPO. The other thing to check (if not already done) is the protocols and services that are enabled on the printers themselves. Best thing is to disable all of the ones that you aren't using like bonjour, air-print, etc etc

Thanks. I'm going to take a break from this until tomorrow. But you've given me a few options. I appreciate it.

@notverypunny said in Network Printer keeps re-adding itself:

Could it be that one (or more) of the machines that are picking up this policy are also configured to publish / share their printers and the other machines are configured to automatically map locally shared devices? Just spit-balling, but this sounds like one of those situations where there are actually a couple of issues combining instead of just 1 simple problem.

I've simultaneously deleted every printer from every machine in the OU. I've even tried stopping the print spooler on all machines in the OU, but updating policy with any printer deployment GPO still brings them back. With that being said, unless there is a better way to check, I don't think it's another machine publishing it. I do however think that you are correct about it being a combined issue, but I'm running out of ideas to troubleshoot this.

I did notice that under the registry path HKLM\System\CurrentControlSet\Control\Print\Printers there are like 8 extra OneNote printers listed. After cross-referencing them with PS>Get-Printer | fl Name, PortName and deleting the extras, they also all come back with a policy update, but are never listed in Printers & Scanners or Devices and Printers. Maybe it's related?

@dbeato said in Network Printer keeps re-adding itself:

@mr-jones No actual GPO on the domain.

@dbeato Ah. Thanks. Yeah I isolated it to any printer mapping GPO.

@dbeato said in [Network Printer keeps re-adding itself]

There must be a computer GPO with deploying a printer. Have you check that?

Are you referring to Local Group Policy Editor? If so, yes I checked that.

@mr-jones Okay so I've narrowed it down a bit. I've found that another printer entirely may be the culprit, but I've yet to figure out why.

I have a GPO for another printer let's call it Classroom Xerox printer. I deleted it (for good measure) and recreated it by deploying the printer using New> TCP\IP Printer under USER CONFIG\PREFERENCES\CONTROL PANEL SETTINGS\PRINTERS.

If I disable that rule and gpupdate /force on client machine the bogus printer duplicates stay gone. As soon as I enable the GPO and run gpupdate /force again, it brings back both the Classroom Xerox printer & the bogus duplicates of the other printer.

Curious.

EDIT: After playing around with it, I've come to the conclusion that it's not the Classroom Xerox printer that's the culprit specifically, but ANY PRINTER GPO. That is to say that only when I add any GPO to that OU that has a printer mapping, it adds those two bogus printer instances again. Any GPO that does not have printer mappings does not result in this behavior.

This is certainly a head scratcher for me.

I have one particular network printer that keeps re-adding itself (upon gpupdate) to domain client machines when you delete it. Not only that, but it adds three instances of itself, two of which are bogus as they show up as "Printername on PRINTSERVERNAME". Of the three instances, the third is correct and shows up correctly as just the "Printername" portion.

Without the rule being applied to any client machine (i.e. no machine is pulling that rule from Group Policy) the two bogus instances still show up, which tells me that they are unrelated to the rule.

Firstly, I've used gpresult -r to get a list of active GPO's on a client machine, and I've ran through each GPO scouting for any signs of that printer rule in the following locations:

COMPUTER POLICY>POLICIES>WINDOWS SETTINGS>DEPLOYED PRINTERS
COMPUTER POLICY>POLICIES>ADMIN TEMPLATES>PRINTERS
COMPUTER POLICY>PREFERENCES>CONTROL PANEL SETTINGS>PRINTERS

USER CONFIG>POLICIES>WINDOWS SETTINGS>DEPLOYED PRINTERS
USER CONFIG>PREFERENCES>CONTROL PANEL SETTINGS>PRINTERS

Secondly, I checked the client machine's registry under
HKLM\System\CurrentControlSet\Control\Print\Printers and these printers don't seem to exist there.

I verified that Print Management on the Print Server only listed the one instance of that Printer. Furthermore, the same registry path as above but on the Print Server lists only one of this printer, so everything looks good there.

I checked that I didn't have a double listing of the GPO throughout the hierarchy within Group Policy.

I've checked the printer queue on both instances of that printer and they are empty.

I'm wondering if this isn't another replication issue as we have two pooled DC's, separate from the Print Server. On that idea, and after seeing that each DC had a different list of printers within Print Management, I've deleted DC (local) servers from the Print Servers list via Print Management on both DC's and replaced them with the Print Server, but it will not populate the list of printers, ports, etc or fix this issue. I've also verified via repadmin that replication is occurring between the DC's.

EDIT: I don't think that avenue has any weight to it.

What am I missing?

EDIT 2: I never found the culprit, but I added a GPO at domain level that stopped it.

USER CONFIG\POLICIES\ADMIN TEMPLATES\CONTROL PANEL\PRINTERS:

Browse the network to find printers: Disabled
Turn off Windows default printer management: Enabled
Prevent additions of printers: Enabled

@syko24 said in Who's sharing that printer?:
you can use Advanced IP Scanner and run a network scan. If a system has any shares it will list them below system name/ip address.

https://www.advanced-ip-scanner.com/

Oh, this is nice. Thank you.

I'm wondering if anyone knows a solid way to track down who is sharing a network printer in a Windows environment?

I have all network printers deployed via GP, and per OU as appropriate, but I'm seeing someone else has shared one, and renamed it something outside of my naming convention. I'm trying to track down which client has done so. I'm currently digging around, but I'm not finding anything.

Any ideas?

@laksh1999 your best bet would be to print out the Sec+ exam objectives and study each item on it.

I used that and some practice tests for good measure.

@scottalanmiller Yea, I see it now. My wife told me I should send the guy an email update on my success, but I'm not that petty. There was a lesson to be had, and I think I nailed it.

@scottalanmiller No. They have an Associates program, but this was just the cert stuff, no general studies.

So about a year and a half ago, right before the pandemic hit hard, I was really looking for a job with health benefits. I interviewed with a company for entry-level helpdesk, only to be told that even though I've been a System Admin for 5 years, I wasn't quite qualified to be hired as an entry-level helpdesk because I didn't have a "traditional education". I was told "traditional education teaches discipline", while they overlooked my military background. I could say lots of things about this situation but I'll tell you what I did about it instead. I used my remaining 10 months of G I Bill to take some instructor-led certificate prep.

Over the last 10 months, I've gotten 8 certificates to include:
A+
Networking+
Server+
Security+
And some basic MTA, and Linux certs
Saturday afternoon wrapped up my last exam (Net+) and I'm due to graduate with a 100% Cumulative GPA, what's considered to be the Dean's List (x2), and every certification knocked out on the 24th.

Probably looking at finding a DoD job if possible now that I've got the Sec+, with an active Security clearance.

Anyway, I just wanted to tell someone, thanks for reading.

@ndc Thanks. I figured with only 256 possible addresses, the addresses spill over into the 3rd octet. If that's what's going on here, what's a good way to calculate this in the future?

1024 ÷ 256 = 4? Being that 8,9,10,11 are the 4 taken up?

I got this question on a practice test, and I was hoping someone might be able to help me in figuring out why the right answer is the right answer:

A Company is configuring an internal network with routed subnets based on the following class B address range:

172.30.8.0/21

The company wants to set up the following subnets:

Network A - 600 hosts
Network B - 100 hosts
Network C - 56 hosts
Network D - 40 hosts

The company wants to keep the unused addresses in each subnet to a minimum.

Which network address ranges should the company use?

A:
Network A: 172.30.8.0/22
Network B: 172.30.12.0/25
Network 172.30.12.128/26
Network 172.30.12.192/26

B:
Network A: 172.30.8.0/22
Network B: 172.30.10.0/25
Network 172.30.10.128/26
Network 172.30.10.192/26

Network A: 172.30.8.0/23
Network B: 172.30.10.0/25
Network 172.30.10.128/26
Network 172.30.10.192/26

Network A: 172.30.8.0/22
Network B: 172.30.12.0/25
Network 172.30.12.128/26
Network 172.30.12.192/27

I've ruled out C on account of /23 only supplying 512 (510 host) addresses (Required 600).

I've ruled out D on account of /27 only supplying 32 (30 host) addresses (Required 40).

Because I'm obviously missing something, I feel like either A or B could be the correct answer, but the practice test claims that B is wrong because "Network B, C, and D all overlap with Network A." and I don't understand that.

I would love some insight.

@irj Nice. Since I left that comment I bought a pre-built as a graduation gift to myself as it seems the only way to get anything at the moment. I went with the 3900X / Radeon RX 6700XT combo. I got about a 6 week wait though.

One thing I would consider, if you haven't thought about it already, in relation to your original question is your power consumption. I noticed the 3900X is 105W whereas the 5600X is only 65W.

@irj - If you don't mind me asking, as I was trying to spec out a build earlier this morning only to hit the road block of no GPU's, where did you find a prebuilt? Or was this a while back?

@dbeato - thank you!

So class, today we learned that a Move Request and a Migration are two separate functions. ::facepalm::

@dbeato using Get-MoveRequest -movestatus completed | remove-moverequest

Results:
Move request "mailbox" is corrupted or not recognized: source database for the request doesn't match. Active Directory value: '(null)'. Request value: "EXCH2016".. Are you sure you want to remove it? It's asking for every one of them.

I think this is where I got into trying to use eseutil last time which made things worse.