Hi,
I'm facing an issue with a print driver on client PC being broken.
Problem Description:
During normal operation of some client PCs, the HP Universal Printer driver becomes non functional due to the registry for that driver being modified. All users on an affected client are unable to print to a queue that uses that driver. The problem is per-machine
rather than per-user. Printers either produce no output, or garbaled characters on many sheets of paper.
Where the workaround listed below is enacted, there are no known re-occurences of this issue have been observed in our environment (at the time of writing).
Environment:
Server - Windows 2008 R2 Enterprise, SP1 + Updates, Dedicated Print Server
Affected PRinter Driver - HP Universal Printer Driver PCL6 (v5.4)
Client PCs - Windows 7 x64 Enterprise Edition SP1 + Updates
Troubleshooting undertaken:
Viewing the properties of the printer driver shows that dependant files, printer monitor and help file information is missing. Auditing has been enabled on a specific registry key to locate the process that has modified the associated registry values. No
readily identifiable commonalities between machines have been identified as yet.
Workarounds known:
Removal of the printer driver and package from an affected client, followed by a reinstall from the server resolves the problem. In some cases, the driver continues to be listed as in use. In these instances delting the registry key "SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
x64\Drivers\Version-3\HP Universal Printing PCL 6 (v5.4)" and restarting the spooler allows for the driver to be downloaded from the print server again.
Does anyone have any thoughts on the source of this issue? It does seem similar to
http://social.technet.microsoft.com/Forums/en-US/winserverprint/thread/e2acb625-027d-47a9-b4a7-1616e270bcbc - though that has been marked as answered ande there is no solution to the issues we see in that thread.
Supporting Information:
Auditing of the HP printer driver registry key has revealed:
Windows Registry Audit Logs
========================= RECORD STARTS =========================
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 28/05/2012 15:28:39
Event ID: 4657
Task Category: Registry
Level: Information
Keywords: Audit Success
Description:
A registry value was modified.
Subject:
Security ID: SYSTEM
Logon ID:
0x3e7
Object:
Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows
x64\Drivers\Version-3\HP Universal Printing PCL 6 (v5.4)
Object Value Name: Monitor
Handle ID:
0x634
Operation Type:
Existing registry value modified
Process Information:
Process ID: 0x56c
Process Name: C:\Windows\System32\spoolsv.exe
Change Information:
Old Value Type:
REG_SZ
Old Value:
HPPMOPJL
New Value Type:
REG_SZ
New Value:
========================== RECORD ENDS ==========================
========================= RECORD STARTS =========================
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 28/05/2012 15:28:39
Event ID: 4657
Task Category: Registry
Level: Information
Keywords: Audit Success
Description:
A registry value was modified.
Subject:
Security ID: SYSTEM
Logon ID:
0x3e7
Object:
Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows
x64\Drivers\Version-3\HP Universal Printing PCL 6 (v5.4)
Object Value Name: Help File
Handle ID:
0x634
Operation Type:
Existing registry value modified
Process Information:
Process ID: 0x56c
Process Name: C:\Windows\System32\spoolsv.exe
Change Information:
Old Value Type:
REG_SZ
Old Value:
unidrv.hlp
New Value Type:
REG_SZ
New Value:
========================== RECORD ENDS ==========================
========================= RECORD STARTS =========================
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 28/05/2012 15:28:39
Event ID: 4657
Task Category: Registry
Level: Information
Keywords: Audit Success
Description:
A registry value was modified.
Subject:
Security ID: SYSTEM
Logon ID:
0x3e7
Object:
Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows
x64\Drivers\Version-3\HP Universal Printing PCL 6 (v5.4)
Object Value Name: Dependent Files
Handle ID:
0x634
Operation Type:
Existing registry value modified
Process Information:
Process ID: 0x56c
Process Name: C:\Windows\System32\spoolsv.exe
Change Information:
Old Value Type:
REG_MULTI_SZ (New lines are replaced with *. A * is replaced with **)
Old Value:
hpcui118.dll*hpcpe118.dll*hpcdmc64.dll*hpbcfgre.dll*hpcpu118.cfg*hpc6r118.dll*hpcsm118.gpd*hpc6m118.gpd*hpcst118.dll*hpcur118.dll*hpcpn118.dll*hpcu1186.hpx*hpcsc118.dtd*hpcev118.dll*hpchl118.cab*hpcu118.dem*hpmux118.dll*hpmur118.dll*hpmpm081.dll*hpmpw081.dll*hpmsn118.dll*hpmsl118.dll*hpcsat20.dll*hpcu118u.ini*hpcu1186.xml*hpcls118.dll*hpcss118.dll*pjl.gpd*pclxl.gpd*stdnames.gpd*FxCompChannel_x64.dll*cioum.dll*cioum64.msi*hpcpn118.dll*hpcpp118.dll*pclxl.DLL*unires.dll*unidrvui.dll*stddtype.gdl*stdschem.gdl*stdschmx.gdl*hpcc6118.dll*HPDRVJCT.dll*hppdcompio.dll*hpbuio64.dll*hpfxcomw.dll*hpfie118.dll*hpsysobj.dll*HPSecurePrint64.dll*hpspw118.dll
New Value Type:
REG_MULTI_SZ (New lines are replaced with *. A * is replaced with **)
New Value:
========================== RECORD ENDS ==========================
========================= RECORD STARTS =========================
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 28/05/2012 15:28:39
Event ID: 4663
Task Category: Registry
Level: Information
Keywords: Audit Success
Description:
An attempt was made to access an object.
Subject:
Security ID: SYSTEM
Logon ID:
0x3e7
Object:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Drivers\Version-3\HP Universal Printing PCL 6 (v5.4)
Handle ID: 0x634
Process Information:
Process ID: 0x56c
Process Name: C:\Windows\System32\spoolsv.exe
Access Request Information:
Accesses: Set key value
Access Mask: 0x2
========================== RECORD ENDS ==========================
Print Spooler Admin Logs
======================= RECORD STARTS =========================
Log Name: Microsoft-Windows-PrintService/Admin
Source: Microsoft-Windows-PrintService
Date: 28/05/2012 15:28:50
Event ID: 372
Task Category: Printing a document
Level: Error
Keywords: Classic Spooler Event,Document Print Job
Description:
The document <FILENAME>, owned by <USERNAME>, failed to print on printer {01B96CA1-1C5A-497B-A667-28239E442049}. Try to print the document again, or restart the print spooler.
Data type: NT EMF 1.008. Size of the spool file in bytes: 434804. Number of bytes printed: 0. Total number of pages in the document: 2. Number of pages printed: 0. Client computer:\\<MACHINENAME>. Win32 error code returned by the print processor: 5. Access is denied.
========================== RECORD ENDS ==========================