Microsoft
MicrosoftJust to add my 2c worth to Mike Pisano's reports, we run a windows 10 (mix of LTSB, LTSC, and CB - mostly the latter) fleet of approximately 4,000 desktops/laptops with Kerberos authentication/login, and the October update KB5006670 broke 100% of printing for our approximately 10,000 users.
Initial symptoms were that any attempts to print or bring up print properties (or start any app that queries printer lists on startup) would cause the print dialogue or app to just lock up. You could restart the local print spooler service (which would cause any attempted print operations to fail) but would at least un-stick the app. Restarting the server side print spooler would allow a single job through sometimes, but then further attempts would fail with the same "not responding" behaviour.
After a bunch of investigation, we determined that setting this GPO on the print server resolved that part of the issue:
[Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options]
"Network security: Restrict NTLM: Incoming NTLM traffic" = "Deny all accounts"
Unfortunately, whilst this allowed people with existing printers to recommence printing, we quickly discovered that users attempting to add a new printer (specifically, a printer that uses a different driver to the ones they already had installed, or some models of printers like Brother or Canon UFR II drivers) were met with a prompt to elevate to install the driver from the print server, and once you did this you immediately got an error.
The operation failed with error 0x0000007c
We noticed that for most recent Windows 10 Current Branch installs, we could get everything except for the HP printers working by pre-installing the drivers from the print server manually, using twelve variants of the following (one for each printer driver):
pnputil -i -a "\\print.xxxxxxxxxxxxxx\drivers\Konica Minolta\bizhub C558\PS\11.2.0.0\x64\IT5PSWinx64_11200EN\KOAXPA__.INF"
Add-PrinterDriver -Name "KONICA MINOLTA C658SeriesPS"
This did not appear to work for LTSC or LTSB users though. And obviously, doesn't work for HP printers - though the error we got there I think was a slightly different one: in powershell, attempts to add the HP printers threw error 3019 (0xBCB) - ERROR_PRINTER_DRIVER_DOWNLOAD_NEEDED, though I can't remember what the error code was when trying to map it normally. It was different to that.
In any event, we tried GPOs that effectively set the following registry entries:
