Event details
35 Comments
- Heather_Poulsen
Community Manager
Thanks for joining Office Hours today. We'll be back next month. Follow this link to save the date: Windows Office Hours: September 17, 2026
Hi, we've recently implemented Universal Print across our infrastructure and are having a couple of issues. The first being that after a user releases a print job from the Universal Print portal it can take up to an hour for it to release from the printer, this is proving to be an issue when printing confidential material. We also have an issue where if a user prints a batch of 10 print jobs, only 6 will print off, but the portal will say that all jobs were sent to the printer successfully. The Universal Print connector is installed on the printers themselves as opposed to on each user machine. We've checked network connectivity and the print logs but can't see what's causing these issues. I was wondering what the best method would be to try and isolate the cause of these two issues. Thanks
- Joe_Lurie
Microsoft
markleivesley​ I’d isolate this by tracking several affected job IDs end-to-end. In the Universal Print portal, compare each job’s acknowledge, download, and final timestamps. Missing timestamps point to the connector; completed jobs that never physically print generally point downstream to the Windows spooler, printer driver/firmware, or a third-party secure-release component.
On the Windows connector host, search each job ID under Event Viewer > Applications and Services Logs > Microsoft > Windows > PrintConnector > Operational, and simultaneously watch the local printer queue. Events 22, 25, and 10 show the job notification, processing start, and handoff to the spooler. Also print a test page directly from that host; if the same delay or dropped jobs occur, Universal Print has been bypassed and the printer/driver path is the likely cause. A stuck secure-release job can also block subsequent jobs for that printer.
Please also confirm the architecture: Microsoft’s Universal Print connector runs on an always-on Windows device, not on the printer itself. If these are Universal Print-ready printers or use an embedded/vendor connector or release application, involve the printer vendor and update its firmware/software.
Microsoft’s detailed workflow is available here: Debugging Universal Print errors. If the logs do not identify the problem, open a Microsoft support case with the affected job IDs, UTC timestamps, connector version, exported PrintConnector log, driver/firmware versions, and whether the jobs appeared in the local spooler. Until the release delay is resolved, I wouldn’t use that queue for confidential material.
Is there any officially supported way for our IT team to force Windows 11 to retry a failed Windows update immediately on a remote workstation? We had a registry issue on 100+ workstations that caused the July CU to fail, and after each machine had failed the update several times WU was waiting 7+ days before automatically retrying the update. So after fixing the registry issue on each workstation, we ended up needing to connect to each one to manually click the “retry/download all/etc” button.
I’ve seen some discussion online about “usoclient”, but in my testing I couldn’t get that command to retry a failed update. I also couldn’t find official documentation so I assume it’s not officially supported. I know we could also use an Intune WU policy to set a specific time for a machine to update, but this was not feasible in this instance since each machine was manually fixed at different times.
- DaveD-MS-CETS
You can control this part of the update experience via Update Deadlines - once the deadline is reached, Windows continues pursuing installation/restart until compliance is achieved. From 22H2, you can configure a deadline for Quality or Feature updates.
Windows automatically retries failed downloads or installations during subsequent scan cycles.
Yes, these machines already had deadlines set but as the updates continued to fail for a few weeks, they were waiting longer and longer in between retries. I will assume this means there is no other officially supported method.
- Heather_Poulsen
Welcome to Windows Office Hours! Post your questions big and small about Windows configuration, deployment, and management right here in the Comments! We have folks from the Windows, Intune, and Windows 365 engineering teams here and ready to help.
Post Windows 24H2 something changed within SMB/Mapped Drives that results in recurring IO timeout errors.
Is anyone on the SMB/Shell team aware of this issue?
It appears when a process (most notably browsers) open a explorer process/thread when a mapped network drive is present, explorer attempts to enumerate mapped drives. As a result the process will hang, explorer will stop showing updates without a manual refresh.
Once SMB triggers an IO timeout the hang clears and explorer becomes responsive again.
I suspect this is related to hardening policies made available 24H2 or changes made to the SMB/shell integration as part of the implementation of those hardening policies.
Upon reviewing procmon and WPR captures the only visible issue is the SMB hang. We've seen this issue present in our environment across multiple shares, multiple users, and the shares are running on different servers with different OS' behind them, all the same behavior.
The only correlation is the upgrade to 24H2 which we've confirmed is reproducable in 25H2 as well.
We've applied the CIS benchmark SMB hardening policies but cannot reasonable find why those hardening policies would result in this behavior.
More information post on this Reddit thread: https://www.reddit.com/r/sysadmin/s/U9wfVVreIx
We've opened a ticket (#4367406/KLNKNY-99RWM) but I believe this needs an engineer familiar with the SMB/shell integration within Windows, specifically the changes made between 23H2 to 24H2 which are still present in 25H2.
- Joe_Lurie
wcw102653​ Thanks for the detailed reproduction information and for including the support case number. We can’t confirm a known product issue from the symptoms alone, but the support case is the right path to correlate your WPR/ProcMon evidence and engage the SMB/Shell engineers; please make sure it includes simultaneous client/server network traces, the affected share types, and the exact CIS settings applied.
Windows 11 24H2 introduced additional SMB security defaults, documented here, though we don’t recommend disabling them as a general workaround: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security-hardening.
The SMB trace-collection guidance is also useful for the case: https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/troubleshooting-smb
Are there any plans to add Autopatch logs from the device pane within Intune?
Currently to access Windows update information we need to go through reports or through the Autopatch pages.
It would be great to have a link to a device's timeline (the update timeline visible from Autopatch) from the device page and/or add a table similar to Device Timeline that includes WU data.
Right now, we've had to use the WUfB data we push to log analytics + custom PowerShell to allow our staff to easily see what KBs and drivers were recently deployed to a machine without adding steps to jump around different reports.
- AriaUpdated
This is great feedback! We are definitely looking at how we can better streamline our update reporting. I will ensure this feedback is included as part of that effort.
Also, if you'd like to provide more feedback as we work through this streamlining effort, please consider joining our customer connection program (https://techcommunity.microsoft.com/blog/windows-itpro-blog/join-the-windows-customer-connection-program/3473775)
What's the exact timeline of ending SMS/Voice as MFA? We have until Feb 2027 to migrate existing users using this method as primary to something else like passkey/Authenticator notif?
- EricMoe
collinblatt-mtm​ The retirement timeline is here: Passkeys by default and retirement of Microsoft-provided SMS and voice authentication - Microsoft Entra ID | Microsoft Learn After February 1, 2027, you will not be able to use SMS or voice as MFA. The rest of the article talks about how beginning in just 12 days users will be nudged for Passkey registration upon MFA sign-in.
If we turn off the option to enroll SMS MFA, will that impact users that are already enrolled?
Hey guys đź‘‹
We use Autopilot v1 with Device and User ESP. We have almost finished migrating our apps from CM to Intune. The one showstopper is that sometimes our app deployment team need to set an app to required deployment but without it impacting Autopilot.
Appreciate Autopilot has a "blocking apps" feature, but that just seems to stop Autopilot tracking the app install - it doesn't stop the app from installing while Autopilot is still running? (if I've understood it right).
What's the best way of making a required app wait until Autopilot has finished please? From asking this question before, someone suggested the OOFHOURS script below:https://oofhours.com/2023/09/15/detecting-when-you-are-in-oobe/ - checks for DefaultUser0, so this would only stop required apps deployed to device (in Device ESP) not user (in User ESP)?
Our apps team since found this one:https://github.com/okieselbach/Intune/blob/master/Detect-ActiveESP.ps1 - checks for ESP, would that pick up both Device and User ESP?
Just wondering if scripts are still the way to go, or if there are any Intune native options yet please?- Jason_Sandys
Hi HeyHey16K​.
For Win32 apps, only those set as "blocking" (and that are required) will install during ESP in Windows Autopilot. Required apps not configured as "blocking" will be postponed until after Autopilot completes and the user reaches the desktop.
For LOB apps, the behavior is slightly different as any required LOB app may install during the ESP regardless of whether it is set as "blocking" or not. "Blocking" for LOB simply guarantees that a minimum set of apps install but doesn't exclude others.
Mapping Universal Print printers for AVD 25H2 Multisession AAD Joined (not hybrid) - We have Universal Print set up in our environment and would like to move toward this. Right now I can create a policy in Intune and it will install on a Laptop or Windows 365 box without a problem. However the same policy does not seem to work in AVD. The policy says its successful inside or intune, but the printer never appears. A printer can be manually added, but Im looking to get the main printer for our locations mapped to their respective people.
Is there any way of scripting this or is there documentation to make this work in AVD ?
- Christian_Montoya
Murphjoh​ - Great question. Yes, we'd expect this to work pretty easily on a physical Windows 11 Laptop or Windows 365 Cloud PCs because Intune is pretty flexible with Windows 11 Enterprise (single-session). The Windows 11 Enterprise multi-session (for use with AVD) is a bit more specific on policy targeting and applicability. In general, it should work, but there's a few considerations with deploying policies to Enterprise multi-session through Intune (both Using Azure Virtual Desktop multi-session with Microsoft Intune - Microsoft Intune | Microsoft Learn)
- "User (Windows config) but be assigned to a User Group" in Intune. In this case, this is how you'll need to target Universal Print, since the printer needs to get registered per user.
- "Intune doesn't support FSLogix token roaming between devices". So if you have FSLogix configured you'll need to disable the RoamIdentity functionality. The reference and description is here, direct link to RoamIdentity -> Configuration Settings - FSLogix | Microsoft Learn .
Let us know if this helps!
Thanks. I verified the FSLogix configuration on the Windows 11 Enterprise multi-session AVD host.
HKLM\SOFTWARE\FSLogix\Profiles\RoamIdentity is not configured, so FSLogix is using the documented default of 0 and identity roaming is disabled.
The Universal Print Settings Catalog policy is also a user-scoped Printer Provisioning policy assigned to a user group.
