After recent Windows security updates, an on-campus Windows print server can start refusing connections or driver installations that originate from Apporto cloud desktops. The desktops are not joined to your campus Active Directory domain, so a hardened print server treats them as untrusted and blocks them. Two separate Microsoft changes produce this behavior, and each has its own fix. Everything below is a change your team makes inside your own Windows environment, so review it against your security requirements before applying.

Which failure you are seeing

Identify the symptom first, because the two fixes live on different machines and solving the wrong one will not help. Confirm the exact error text the user reports, then match it against the table.

Fix 1, relaxing RPC authentication on the print server

This change comes from CVE-2021-1678 (KB4599464). Since the September 14, 2021 update, the print server requires clients to connect to its remote-printing RPC interface at a higher authentication level (packet privacy, meaning encrypted and authenticated RPC). Clients that cannot negotiate that level are refused, which commonly affects machines that are not joined to the same domain or forest as the server, including Apporto cloud desktops.

Apply this on the print server.

1. Open regedit on the print server.
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print.
3. Create or edit the REG_DWORD value named RpcAuthnLevelPrivacyEnabled.
4. Set the value to 0 to disable the enforced authentication level. A value of 1 or a missing value keeps enforcement on, which is the default.
5. Restart the Print Spooler service, or reboot the server, for the change to take effect.

Microsoft's position on this setting. Microsoft labels a value of 0 as "not recommended" and states that it leaves the server exposed to CVE-2021-1678. The alternative Microsoft prescribes is to keep enforcement on and make sure every connecting client has the January 12, 2021 update or later so it can negotiate the required authentication level. Whether that is practical for out-of-domain Apporto desktops is a decision for your team.

Fix 2, allowing non-administrators to install the driver

This change comes from CVE-2021-34481 (KB5005652). Since the August 10, 2021 update, Windows installs printer drivers through Point and Print only for administrators. A standard user connecting to a shared printer and pulling its driver from the server is now blocked. This restriction is evaluated on the machine that installs the driver, which is the Apporto cloud desktop, not the print server.

Apply this within the Apporto desktop environment. Because the value governs a single desktop, set it on the desktop image or template so every session inherits it. If you are not sure how to apply it to your Apporto image, contact Apporto support.

Registry method

1. Open regedit on the Apporto desktop.
2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint. Create the keys if they are not present.
3. Create or edit the REG_DWORD value named RestrictDriverInstallationToAdministrators.
4. Set the value to 0 to let non-administrators install signed and unsigned drivers. A value of 1 or a missing value keeps the administrator requirement, which is the default.
5. Restart the Print Spooler service, or sign out and back in, so the change applies to new installs.

Group Policy method

If you manage the desktops with Group Policy instead of editing the registry directly, set Computer Configuration > Administrative Templates > Printers > Limits print driver installation to Administrators to Disabled. This writes the same value.

Microsoft's position on this setting. Microsoft states that a value of 0 makes the device more vulnerable and that "there is no combination of mitigations that is equivalent to setting RestrictDriverInstallationToAdministrators to 1." Microsoft recommends using 0 only temporarily while you move toward the restricted default. Whether to keep it in place is a decision for your team.

One more thing to check. Setting this value only removes the administrator requirement. If you also have Point and Print Restrictions policies configured (for example the "do you trust this printer" prompts or driver-signing rules), those still apply on top and can continue to prompt or block.

Reference articles

• KB4599464, managing deployment of printer RPC binding changes for CVE-2021-1678
• KB5005652, managing the new Point and Print default driver installation behavior for CVE-2021-34481