Windows Cannot Connect to the Printer: 0x0000011b and 0x00000709
Fix a Windows 11 shared printer refusing older Windows clients - the packet privacy, RPC transport and Point and Print values behind 0x0000011b and 0x00000709, by hand or as one pick in NTLite.
A printer shared from Windows 11 stops accepting older Windows clients, and the connection ends in 0x0000011b, 0x00000709, or a driver prompt that never finishes. Two unrelated Microsoft changes cause it: the 2021 print security updates, and the Windows 11 22H2 switch of print RPC from named pipes to TCP. NTLite carries both sides of the fix as one dropdown pick, on the Windows you are running or baked into an install image, so every machine you deploy comes out already able to print.
What the Errors Mean
The three symptoms come from three different hardening steps, which is why fixing one of them alone often changes nothing:
- 0x0000011b - the client asks the sharing PC for the printer and the answer is refused. The print server enforces packet privacy on that call, and a client that cannot negotiate it is dropped.
- 0x00000709 - the connection never reaches the spooler. Windows 11 22H2 changed the default print RPC transport to TCP, so one side dials a transport the other is not listening on.
- A driver prompt asking for an administrator - Point and Print restrictions. A standard user can no longer pull a driver from the print server, so the connection stops at the prompt.
Everything on this page relaxes a mitigation Microsoft shipped after PrintNightmare. Use it on a LAN you trust, between machines you administer. It is not appropriate on a public network or a domain you do not control.
Set It With NTLite
- On the Image page, load an install image, or load the live install (
C:\Windows) to configure the PC in front of you - Open the Settings page. Both sharing groups sit on the Favorites tab, and under Network in the full tree
- Set the Printer sharing group dropdown to Legacy compatibility
- Set the File sharing group the same way when the client is Windows 7 or 8.1, which also needs the older SMB rules to see the share at all
- Go to Apply → Process
- On a live install only, restart the Print Spooler service afterwards, or reboot. The spooler reads these settings when it starts, and it is already running. An image needs nothing: it is applied before Windows ever boots, so the spooler comes up configured on first start
Both machines: the transport is a matched pair, so run the same pick on the PC sharing the printer and on each PC connecting to it. Deploy from an image and every machine that comes off it is already done.
What the Group Dropdown Does
Each sharing group carries a dropdown on its header row. It is a preset over the rows inside the group, not a setting of its own:
- DefaultEvery row in the group back to the value the image or the running Windows already had. The same as the group reset.
- Legacy compatibilityThe tested combination for older clients. It sets only the rows that matter for reaching an older Windows and leaves the rest of the group alone.
- CustomNot a pick you make, a state the dropdown reports. Change any row inside the group by hand and the header switches to Custom, so a mixed LAN gets tuned from the tested starting point instead of from scratch.
Expand the group to see every row it covers, each one settable on its own. The dropdown reads back what the rows currently say, so it also tells you at a glance whether a loaded image is already configured.
Save the result as a preset and next month's rebuild carries the same sharing configuration, alongside the updates, drivers and component removals you apply in the same pass.
The Printer Sharing Options
What each row in the group does, and what Legacy compatibility sets it to. The RPC rows appear on Windows 11 22H2 and later, which is where the transport changed; older editions already behave the way the fix asks for.
Reaching the Spooler
- Connect over RPC named pipesHow this PC dials out to a shared printer. Windows 11 22H2 and later use TCP only, and an older print server is not listening there, which is the
0x00000709half. Legacy compatibility turns it on. - Accept incoming RPC overThe transports this PC's spooler listens on for other machines: named pipes, TCP, or both. Legacy compatibility picks named pipes and TCP, so old and new clients both get through and nothing modern regresses.
- Require Kerberos for incoming RPCOn, only Kerberos-authenticated connections are accepted, which needs every machine domain joined. Off, Windows negotiates, using Kerberos where it can and NTLM otherwise, so workgroup and older clients can still connect. Legacy compatibility turns it off.
- RPC over TCP portA fixed port for incoming and outgoing RPC over TCP instead of a dynamic one, for writing firewall rules against. 0 means dynamic, the Windows default, and Legacy compatibility leaves it there, since the fix is about the transport, not the port.
- RPC packet privacyEncrypts and authenticates every packet on the print spooler RPC interface. Clients that predate the change cannot negotiate it and fail with
0x0000011b. Legacy compatibility turns it off, which is what lets them connect and is the protection you are trading away. Set on the PC sharing the printer.
Getting the Driver Installed
- Point and Print - warn and elevate on driver installInstalling a driver from a shared printer shows a warning and asks for administrator credentials. Legacy compatibility turns the prompt off so a standard user can finish the connection. A malicious print server could then install code without asking, which is why this one belongs on a LAN you administer.
- Limit print driver installation to AdministratorsEnabled by default, and it blocks the install outright rather than prompting for it. Legacy compatibility turns it off, otherwise the prompt setting above never gets a chance to matter.
- Point and Print - driver update promptThe same warning and elevation choice for a driver update rather than a first install: warn and elevate, warn only, or neither. Legacy compatibility leaves it alone, since a working connection does not depend on it. Set it yourself if repeat prompts on update are the complaint.
The File Sharing Options
A Windows 7 or 8.1 client that cannot even browse the share will not reach the printer either. The File sharing group has its own Legacy compatibility dropdown, and it touches two things:
- Enable insecure guest logonsModern Windows refuses guest access to a share. Older clients and NAS boxes frequently offer nothing else, so the share appears unreachable. Turned on.
- Digitally sign communications (Always)SMB signing demanded on every connection, on the server row and the client row both. An older client that cannot sign is refused. Turned off on both.
The rest of the group is untouched by the preset: SMB compression, the I/O request packet stack size, the authentication rate limiter, bandwidth throttling and administrative share access are performance and hardening choices unrelated to reaching an older client.
If a Client Still Cannot Connect
Work through the pairing itself before changing more rows:
- On a machine configured live, confirm the Print Spooler service was restarted or the machine rebooted. A machine deployed from a configured image needs neither
- Confirm the account on the sharing PC has a password. A blank-password account cannot authenticate a network share
- Try connecting by
\\name\printerand by\\address\printer. A failure on the name alone is name resolution, not printing - On a Windows 7 client, check the share itself opens in Explorer first. If it does not, the File sharing group is the part still missing
- Install the driver locally on the client and point a local port at the share, as the fallback when the print server refuses to hand its driver over
Next Steps
Download NTLite to set this on the machine in front of you, then keep it in a preset for the images you build. The Settings reference covers the rest of the page, and the Windows Lite ISO guide walks a full image build end to end.