Client Side Rendering and Network Printers

Background

A client alerted me of an issue they had while deploying Windows 10 to their branch offices. They make use of a Windows Print Server in order to manage and audit the print jobs being sent to the devices.

The first problem was that the Windows 10 devices wouldn’t allow users to install the printer drivers on the OS. The Event Log on the Windows clients (/Application and Services Logs/Microsoft/Windows/PrintService/Admin) had the following event.

Source:      Microsoft-Windows-PrintService
Event ID:    215
Description: Installing printer driver <DriverName> failed, error code 0x23f, 
             HRESULT 0x8007023f. See the event user data for context information.

Additional events became available after enabling logging on the adjacent Operational log.

Enable Branch Office Direct Printing

Cause

The problem was caused by two issues:

1. The Windows 10 machines prevented users from installing printer drivers.

2. The network policies were restricting direct communications between the Windows 10 machines and the network print devices.

Point and Print Restrictions

The first problem was addressed by either disabling the Point and Print restrictions, or in this case, modify it with two Group Policy adjustments:

Computer Configuration > Administrative Templates > Printers > Package Point and print - Approved Servers

Computer Configuration > Administrative Templates > Printers > Point and Print Restrictions

The settings above affected the ability for the users to install approved printer drivers from the Windows Print Server specified.

Note: In some circumstances, such as those VDI environments that used advanced printer driver management systems like those from Printer Logic and Tricerat, the policy adjustments aren't necessary; these solutions typically include an agent that would perform the driver installations automatically.

Note: The corresponding user settings located in the User Configuration > Administrative Templates > Control Panel > Printers node has been deprecated but is still available for backwards compatibility with legacy Windows versions. If the GPO is linked to an OU with users who use legacy Windows versions (or computer objects associated with legacy Windows versions and loopback

Getting Around the Network Communication Restrictions

This environment had network policies that would restrict direct communication between the Windows 10 systems and the network interfaces of the print devices. Starting with Windows 8, in conjunction with Windows Server 2012 (and up) print servers, there are two technologies to take into consideration:
1. Client Side Rendering
2. Branch Office Direct Printing

Option 1: Force all print jobs to be rendered by the print server and sent to the print device

The following setting on the printer will disable Client Side Rendering, forcing the print client to submit the print-job to the print server for rendering and spooling. Otherwise, the rendering would occur at the print-client.

Option 2: Disable Branch Office Direct Printing

Instead of disabling Client Side Rendering, you may disable Branch Office Direct Printing (which requires Windows 8 and up, and Client Side Rendering enabled on the client). This will force the print client to render the print job and submit it to the print server's spooler.