This message was deleted.

We are looking into option 2 today! Will report back

I seen this as well https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-pri[…]e-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7

Update: With Disable inbound remote printing through Group Policy active, I was no longer able to view print queues or print, as such, I don't think this will work, at least not in my client environment. We will need to patch

Thanks for that update Owen

Update! Tried again, and it worked! Odd, I'll keep testing. For now, i'll leave the policy active for my client's test environment.

Owen check this out man

Oh snap, looks like the policy is the best means forward. I've got it active/tested as of yesterday for one of my clients test environments, can look at prod at a later date

With the Disable inbound remote printing policy enabled, can we access printers from applications published through citrix ?

I've only enabled it for Win 10 VDI, but, as per the docs from Microsoft, it should only impact the ability to connect to a mapped / installed printer on the client . Outbound Mapping from a XA / XD session to an actual printer server should continue to work, worked for me on XD Win 10, will test XA Server 201x next week

We also have user local personal printer redirected to Citrix applications. This wont be affected by this policy. Isnt it?

I'm not sure, I would suggest testing in your own test environment first, it's an ez policy change

Thank you

You bet! Post back your results, i'll do the same next week when i'm back with my client

Recent one: https://msrc-blog.microsoft.com/2021/07/08/clarified-guidance-for-cve-2021-34527-windows-print-spooler-vulnerability/ Install the patch first. If you have the two registry keys, set them to 0. If not, you are good is what Microsoft says.

So is anyone not using that workaround (Disabling the 'Allow print spooler...' GPO), and instead installing the patch and then adding the GPO settings for elevation of drivers per the updated guidance that Chaitanya posted?

I’m following the articleChaitanya posted on my end

Good deal. That's the route I was taking, as well. We're a 100% Citrix Universal driver shop, so probably in the best position to address this. No driver installation allowed.

We have so many dang printers and 3rd party software garbage. However I don’t let them install driver’s anyway I disabled it with a Citrix policy and force upd as much as possible

Anyone notice slow printer additions into sessions after patching? We use Ivanti Workspace Control to map printers at login, it seems after patching for this random printers will take 5+ minutes to get added into session.. very odd