Sharing Printer from Windows 11 (25H2) to previous Windows OS

[WhiteMoon]

As far as I know, Windows now needs password protected user account if you are using local user account. maybe thats the problem? (it was for me on local home network, I wasn't able to share folders)

You can share folders without a password, but W11 network security now requires you to change so many different settings to permit it. Sometimes it's just easier to create a password to avoid the headaches.

Im able to share folders with every computer on the local network. I dont know what did the trick the first time i setup this network but im pretty sure that was the enabling of insecure guest logons.

But now i dont know what else to do, every computer was able to print just fine

 

[crypticus]

You can share folders without a password, but W11 network security now requires you to change so many different settings to permit it. Sometimes it's just easier to create a password to avoid the headaches.

Maybe thats it I just couldn't find the correct settings... Would you mind sharing a guide for it? because these seems doesn't make it work.


Giving access to everyone to read and write
Disabling password share
Making home network private or public
Making sure necessary services have firewall premission
Enabling file and printer share and network finding
Enabled insecure guests from regedit and some more settings maybe i forgot
I even created a radminvpn server and joined it

and some more...

 

[linkprogrami]

So, I am back because of this issue...
Since I build new Universal Deploys every 2 year or so, my previous build is 23H2.
Both builds integrate the same reg changes (that include Windows update manualizing, specifically for these reasons).

and these are my observations (the host\shared folder\shared printer is on 25H2 deploy):

• 23H2 can access shared folders on 25H2 without any issues,
• if I try to access 25H2 from 25H2, it asks for credentials. "Host" has no password on local account, and "guest" trying to access it will claim any input is "wrong credentials",
• Adding password changes nothing, 25H2 will still claims wrong credentials
• If I try to add the shared printer on 23H2 where 25H2 host has account username\password, it will ask for credentials; after I add them it will say those credentials are insufficient and will require additional ones:
  ""The credentials supplied are not sufficient to access this printer. Do you want to specify new credentials?"

At this point I did so many RPC and lanman experiments in order to circumvent it and it didn't budge; on occasion will get the 0x00000709 error but that's about it.

 

[linkprogrami]

You can share folders without a password, but W11 network security now requires you to change so many different settings to permit it. Sometimes it's just easier to create a password to avoid the headaches.

Annoyingly folder sharing is not what causes me issue on my deploy, but printer sharing again.
It seems that Microsoft has this tendency to mess things up when they working just because of some security pretense. But its probably tied to them pushing Microsoft accounts for users.

... that being said, any suggestions on what changes could undo this thing (as I already baked the universal deploy)? Tried bothering clankers but they use this forum thread as a reference.

 

[linkprogrami]

Im able to share folders with every computer on the local network. I dont know what did the trick the first time i setup this network but im pretty sure that was the enabling of insecure guest logons.

But now i dont know what else to do, every computer was able to print just fine

Would you be so kind to share a registry keys for:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer]

optionally (if it doesn't dox you in any way):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

My theory is they added some bypass key to circumvent this new sets of policies or whatever, and you added it or had it, so you are not hit by this plague. Or a specific set of keys just makes it work in good ol reliable way.

 

[linkprogrami]

No progress thus far, but I have been experimenting with reg. entries and this is the latest I applied:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC]
"RpcUseNamedPipeProtocol"=dword:00000000
"RpcProtocols"=dword:00000007
"ForceKerberosForRpc"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"LmCompatibilityLevel"=dword:00000003
"RunAsPPL"=dword:00000000
"RunAsPPLBoot"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
"BlockNtlmv1SSO"=dword:00000000
"NtlmMinClientSec"=dword:20000000
"NtlmMinServerSec"=dword:20000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print]
"RpcAuthnLevelPrivacyEnabled"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"AllowInsecureGuestAuth"=dword:00000001
"RequireSecuritySignature"=dword:00000000
"EnableSecuritySignature"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
"RequireSecuritySignature"=dword:00000000
"EnableSecuritySignature"=dword:00000000
"RestrictNullSessAccess"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001
"EnableLinkedConnections"=dword:00000001

Have 25H2 "host", 25H2 "guest" and 23H2 "guest".

When I try to access shared files to 25H2 "host" from 25H2 "guest", it requires username\password (even though host does not have any). Any reasonable input produces "incorrect credentials". Adding username\password on the hosts account and typing those in 25H2 still results in "incorrect credentials".

Strangely, 23H2 guest access files with 0 issues. I can browse, copy, do pretty much anything. Until I try to add the printer, then I get the "The credentials supplied are not sufficient to access this printer". Any credentials I tried to input, it will state they are insufficient and ask if I want to add different ones.

Lastly, 23H2 version (being host in this case, that is "endowed" with the registry changes from the 1st post of this thread) can share printer, files and everything with 0 issues, regardless if the guest is "23H2" or "25H2", including printer.


Just for the sake of sanity, I did export the registry keys from 23H2 to 25H2 and all issues are same. Conclusion is that there might be some additional keys SOMEWHERE that need to be added to use network sharing in compatible mode. It all smells of some credential thingy added, that I couldn't clank-out.

And, there is a QNAP on the network that just connects with everything with no issues whatsoever.

 

[crypticus]

hey guys I recently discovered creating/assigning password to your local account does the trick for file/folder/printer share. you can after disable password protected login to your account via this reg entry

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device]
"DevicePasswordLessBuildVersion"=dword:00000000

 

[linkprogrami]

hey guys I recently discovered creating/assigning password to your local account does the trick for file/folder/printer share. you can after disable password protected login to your account via this reg entry

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device]
"DevicePasswordLessBuildVersion"=dword:00000000

File share was not really an issue for me (working on XP even - with those few original regkeys), but printer share is becoming a nightmare.

On few occasions I found "the magic config" of reg changes and powershell scripts that did the job, but due to how many changes I do I am unsure which one should be retained. Filtering it as I am typing this, HOPEFULLY will have it in a day or two;


I set up 5 VMs with Bridged network to find the "perfect" solution, but its messy - sometimes printer share will work on all except XP (which I can ignore) and file share will not work only on Win7 for some reason, other times sharing just doesn't work; next config will make file sharing work for ALL but printer sharing gives errors...

 

[crypticus]

the reg file given in this thread and + my last fix actually does the job. I never used any powershell script for these

 

[linkprogrami]

the reg file given in this thread and + my last fix actually does the job. I never used any powershell script for these

Can you share your last fix? I am trying to make a... comprehensive or AIO fix for this, but still there are some issues.

Edit: Oh you mean adding a password? This is not convenient for some cases, where typing in the pass. on archaic printing machine that has some proto-EFI system in it is... tedious.

 

[linkprogrami]

I wish there was a 3rd party software to share printer or send files to printer. microsoft's sharing is sucks

Most printers nowadays have LAN or Wifi adapter cos of this; or those cloud printing services. The Microsoft just doesn't care that much about legacy cases (sorry necro reply).

 

[linkprogrami]

Ok, last week or so, I troubleshooted like a few dozen of Windows systems, on top of my VM-Bridge-Promiscuous network I made for testing.

These are conclusions thus far:

1. Do not force Kerberos on both Host and Guest machines. This is like 90% of issues on newer Windows (tested on Win10 and 11) - and it should be applied to both host and guest machine to make sure all works; so go to:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC]
"RpcUseNamedPipeProtocol"=dword:00000001
"RpcProtocols"=dword:00000007
"ForceKerberosForRpc"=dword:00000000

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print]
"RpcAuthnLevelPrivacyEnabled"=dword:00000000

2. Something can be weird with the various network settings. I clanked the issues, and made a huge list of registry changes that should be "last resort troubleshooter" for most of severe cases, though I am warning you about it causing certain SMB variabilities - reason the sharing problems came with some updates: The full reg key is:

Windows Registry Editor Version 5.00

; 10 Suggested by "crypticus" from NTLite forums
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PasswordLess\Device]
"DevicePasswordLessBuildVersion"=dword:00000000

; 20 UAC Remote Restrictions
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"LocalAccountTokenFilterPolicy"=dword:00000001

; 30 Disable Point and Print Restrictions for driver installation
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint]
"RestrictDriverInstallationToAdministrators"=dword:00000000
"UpdatePromptSettings"=dword:00000000
"InprocInstallPromptSettings"=dword:00000000
"NoWarningNoElevationOnInstall"=dword:00000001

; 40 Revert Print Spooler RPC Bindings to legacy Named Pipes, fixes KerberosForRpc
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC]
"ForceKerberosForRpc"=dword:00000000
"RpcProtocols"=dword:00000007
"RpcUseNamedPipeProtocol"=dword:00000001
"RpcTcpPort"=dword:00000259

; 45 In case of very old XP versions (SP1 and prior) two first dwords should be set to 00000000, minor futureproofing for Oct2026
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
"NtlmMinServerSec"=dword:20000000
"NtlmMinClientSec"=dword:20000000
"BlockNtlmv1SSO"=dword:00000000

; 50 Relax LSA & NTLM parameters to allow Windows XP connections & blank passwords (via LocalPort)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"auditbasedirectories"=dword:00000000
"auditbaseobjects"=dword:00000000
"disabledomaincreds"=dword:00000000
"EveryoneIncludesAnonymous"=dword:00000000
"ForceGuest"=dword:00000000
"LimitBlankPasswordUse"=dword:00000000
"NoLmHash"=dword:00000001
"LmCompatibilityLevel"=dword:00000003
"LsaCfgFlags"=dword:00000000
"RestrictAnonymous"=dword:00000000
"RestrictAnonymousSAM"=dword:00000000
"RunAsPPL"=dword:00000000
"RunAsPPLBoot"=dword:00000000

; 60 Disable RPC Binding Privacy (Fixes 0x0000011b)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print]
"RpcAuthnLevelPrivacyEnabled"=dword:00000000
"ThrowDriverException"=dword:00000001

; 70 Solves Universal Image Restore SID issue - important if all machines come from same image, or are ones where manufacturer pre-deploys an OS
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides]
"1517186191"=dword:00000000

; 80 Enable Insecure Guest Auth & Disable SMB Signing Requirement
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
"EnableSecuritySignature"=dword:00000001
"RequireSecuritySignature"=dword:00000000
"restrictnullsessaccess"=dword:00000000
"SMB2"=dword:00000001
"SMB1"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"AllowInsecureGuestAuth"=dword:00000001
"EnablePlainTextPassword"=dword:00000000
"RequireSecuritySignature"=dword:00000000
"EnableSecuritySignature"=dword:00000001

3. For Windows 7, XP and other incompatible systems? Just - use LDP\LPR (Optional Features->Print and Document services). It circumvents all the Windows network security issues introduced. Just install it via "Optional Features" - pretty sure instructions can be found easily. Because while I once managed to hit a magic setting that enabled printer to be shared on Windows 7 from network, I never found this for XP.


Few notes:

The "Local Port" trick on guest machine where you set the \\HOSTNAME\Printer or \\HOST_IP\Printer had questionable outcomes, as it would sometimes work, and sometimes it would not. Not sure what exact update, setting or something else could be causing this inconsistency, so I dropped it.

Strangely few times I hit a perfect setting that worked on everything except WinXP, and I cannot recreate it. If I ever manage to do so, I will re-edit this post. Could be that the PowerShell commands are the part of solution, and I will do more testings later.