Return code 1223 when mapping a printer (4298911)

Cause #1

Windows Update MS16-087, a Security update for Windows print spooler components from July 12, 2016, was installed on the affected computers.

This security update resolves vulnerabilities in Microsoft Windows. The more severe vulnerabilities could allow remote code execution if an attacker is able to execute a man-in-the-middle (MiTM) attack on a workstation or print server or set up a rogue print server on a target network.

To learn more about the vulnerability, see Microsoft Security Bulletin MS16-087.

The script is performing a printer mapping using the Microsoft AddPrinterConnection function and is receiving a Microsoft return code 1223.  This is not a Desktop Authority issue.  The script is merely automating the same error that manually adding the printer would produce.

Cause #2

Windows updates released August 10, 2021, and later will, by default, require administrative privilege to install drivers. This update includes the PrintNightmare vulnerability fix. 

After applying the update, by default, non-administrator users will no longer be able to do the following using Point and Print without an elevation of privilege to administrator:

• Install new printers using drivers on a remote computer or server.
• Update existing printer drivers using drivers from remote computers or servers.

Resolution for Cause #1

To verify that the same issue is encountered when adding the printer outside of the Desktop Authority script, simply launch the Windows Printers applet on the client machine, click on the Add Printer button and complete the steps to map the problematic printer.  It is expected that an error message will be produced when performing this same action manually.

Note:  It is not a sufficient test to connect to the printer using a UNC.  Connecting to the printer and adding it are two separate functions.  The script is adding it and not simply connecting to the printer queue.

To solve this issue these options are available:

• To update the affected printer driver. Package-aware V3 printer drivers were introduced in Windows Vista. Installing a package-aware printer driver will resolve the issue.
• If a specific legacy printer does not have the appropriate printer driver available, then pre-installing the problematic printer driver on the client system will resolve the issue.

For more information about these scenarios, see the following Microsoft resources:

• Print and Document Services architecture
• Package-aware print drivers

After security update MS16-087 (KB 3170455) is applied and a connection trusted package-aware printer is tried, the printer cannot be connected.

To resolve this issue, the Windows update roll-up on this Microsoft KB Article ID: 3170005 – “MS16-087: Security update for Windows print spooler components: July 12, 2016” must be applied.

Resolutions for Cause #2

1- Please review the Microsoft article called KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481) to see possibles ways to deal with this issue. 

2- Install V4 Printer Driver if available. For more details about the V4 Printer Driver visit this Microsoft site.

The printer is mapped under the context of the user that is logging into the machine. By now, there is no option to map the Printer Element as administrator.