Here is a guide on how to deploy printer drivers to local machines via pnputil.exe. This can help with the latest PrintNightmare issue where users no longer have the ability to install printer drivers automatically from print servers. I also include how to deal with some printer drivers that have certificate issues.

I am assuming the print servers in use are 64-bit Windows machines. As a starting point, printer drivers should be manually installed on a test Windows computer or print server. Here are the locations for print driver info in the Windows registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-4

These registry locations list what printer models are assigned to which printer driver. Pay attention to the InfPath key inside each printer listed. This shows the location of the 64-bit printer driver inside C:\Windows\System32\DriverStore\FileRepository. This is helpful if you don’t know what driver is necessary for each printer, like when you inherited an environment. The idea here is to get the driver from the source so you know you have an exact match.

If you know the GUID of the printer driver (seen inside the InfPath key) you can also find the printer drivers nicely packaged up inside .cab files in \\server\printer$ or C:\Windows\System32\spool\drivers. There is a sub-folder for each architecture, with a PCC sub-folder in each one. The PCC sub-folder has a .cab file with each printer driver packaged inside.

Edit: use the Print Management tool in Windows Administrative Tools instead. You can add columns of info to the display so you don’t have to fool with the registry like I did! Oh well I was just trying to learn the real nuts and bolts. You can also try to remove drivers here too.

Copy the printer drivers you want to a central location for deployment and testing. Put each one in a separate sub-folder.

For testing purposes, use a Windows 10 client machine that has never had network printer drivers installed.

If you don’t have that on hand, you can uninstall drivers manually.

1. Go to Control Panel, Devices and Printers, select each network printer one at a time and remove them.

2. Select a built-in printer that is left and select “Printer server properties” in the menu. In the Print Server Properties window, click the Drivers tab. Select “Change Driver Settings” with the shield and remove any network printer drivers. Use the “Remove driver and driver package” option.

Install printer drivers on your client test machine (using an elevated command prompt) with a command like:

pnputil.exe /add-driver "\\server\share\drivers\driver1\*.inf" /install

Record the output of the command, as you will want to uninstall the driver and do it again for further testing and validation. The output will have the name of the Inf you need to perform the uninstall. The uninstall command is:

pnputil.exe /delete-driver installeddrivername.inf

Edit: You can also delete a driver by just calling the inf from your install location. Just tried this and it worked.

If you can’t uninstall with pnputil for some reason, go back to the Printers and Devices and remove network printers. Also go to “Printer server properties” and remove there. Then try the uninstall again.

Older printer drivers can have certificate issues, like expired code signing certificates. They will give a pop-up window saying “Would you like to install the device software?” when installing via pnputil.

To mitigate this, install the printer driver on a test machine and export the certificate. Use the exported certificate in your driver install script by following these steps:

1. On a test box use pnputil.exe to install the printer. When asked “Would you like to install the device software” check "Always trust software from", and click install.

2. Once the install is finished run certmgr.msc. Under certmgr.msc navigate to Trusted Publishers>Certificates>"name of new cert". Right click the cert and export it. Leave all questions at default and choose an appropriate export folder. Make sure your exported file ends in .cer.

3. Use the certutil.exe tool to add the certificate to the machine before installing drivers with pnputil.exe.

Certutil.exe -addstore "TrustedPublisher" \\server\share\certs\cert_name.cer

You should now have what’s necessary to deploy printer drivers onto machines. Just use whatever deployment method you want with a batch file or powershell script. GPO script, MEMCM, GPO Task Scheduler, PDQ Deploy, Intune, whatever should work.

Not all printer drivers will work using this method, but most will. For example, old Sharp MFC drivers will not deploy properly using this method.

For example, a memcm task sequence could run a batch file with content like this:

cmd.exe /c “certutil.exe -addstore "TrustedPublisher" \\server\share\certs\cert1.cer”
cmd.exe /c “certutil.exe -addstore "TrustedPublisher" \\server\share\certs\cert2.cer”
cmd.exe /c “pnputil.exe /add-driver \\server\share\drivers\driver1\*.inf /install”
cmd.exe /c “pnputil.exe /add-driver \\server\share\drivers\driver2\*.inf /install”

If you know of any other tricks for using pnputil to install drivers please reply in the comments.

EDIT: The reason a lot of drivers did not work was because of a bug in driver detection. The October patch appears to be a help! https://www.reddit.com/r/sysadmin/comments/q7pqjo/printnightmare_driver_update_needed_bug_fixed_by/?utm_source=share&utm_medium=ios_app&utm_name=iossmf