Printer Drivers Installation and Troubleshooting Guide

In this printer drivers installation and troubleshooting guide, I cover various unattended installation methods and common errors (including solutions). This article is not only relevant to Citrix XenApp/XenDesktop, but applies to regular client installations as well.

Printing is a very complicated and encompassing topic. One article cannot deal with all aspects of printing. This article only deals with the installation and troubleshooting of printer drivers and does not cover topics such as printing pathways, the Citrix Universal Print Driver and Server, printing isolation or printing formats such as EMF and XPS. For these topics, I recommend you to read Bas van Kaam's excellent publication: The ultimate Citrix printing internals cheat sheet (version 2.0).

 

 

Table of Contents

The installation of printer drivers, especially unattended, can be a daunting task. First of all, there are various installation methods to choose from. Secondly, all sorts of problems may arise, the solution of which is not always straightforward.
I hope that this article may be of some help to you. In the sections below, you find a list of the main unattended installation methods as well as a detailed description of some of the common problems and their solution.

The installation methods apply to both model specific and universal printer drivers. The universal printer driver is "one driver to rule them all" and supports most or at least many of the vendor's various printer models. The advantage of a universal printer driver is that you only need to install one driver to support all vendor specific printer models.
However, in some cases you may require a model specific drive if, for example, the universal printer driver does not support a specific feature.

Printer drivers source files

Printer driver source files consist of a variety of files, such as:

  • BMP (e.g. for images used in the Devices and Printers GUI)
  • DLL (containing the core code and functions)
  • CHM (help files)
  • INI (configuration settings)
  • DAT (data files)
  • CAT (security catalog)
  • INF (the setup information file)

Each time a driver is installed, Windows looks in the INF file for the line Catalogfile=filename.cat, than finds the specified CAT file and verifies the digital signature. It than verifies each file against the cryptographic checksum value that is recorded in the signed catalog file. If a signature is not trusted or a file’s cryptographic checksum is not the same as the original, the installation will end with a warning or error.

Reference: http://download.microsoft.com/download/a/f/c/afcf8195-0eda-4190-a46d-aa60b45e0740/driver2.ppt

The INF file

The INF file is the setup information file. This file is responsible for "guiding" and organizing the installation of the printer driver.

The most important sections of the INF file are these:

  • The location of the catalog file
  • The exact name of the printer driver(s)
  • The supported system architectures (one driver can include multiple types):
    • 32-bit (NTx86 in the INF file)
    • 64-bit (NTamd64 in the INF file)
    • Itanium (NTia64 in the INF file)
  • The list of source files to be copied to the local system during installation (see also the following paragraph The CAT file)

Printer Drivers Installation and Troubleshooting Guide - INF file contents Samsung driver

The printer driver source files may contain more than one INF file.

The CAT file

Disclaimer: in this section, I present some examples of potential printer driver installation errors. I used a Samsung driver to simulate these errors. Please understand that this is for demonstration purposes only! I purposely manipulated these drivers to be able to demonstrate installation errors and warning messages. Do not interpret my examples as bad advertising regarding Samsung printers and printer drivers. This is absolutely NOT my intention. Thank you for your understanding!

The CAT file is the security catalog file. As per Microsoft, "the catalog (.cat) file contains the digital signature for all the files which are part of the driver package".
The catalog file contains a collection of cryptographic hashes, or thumbprints, for each of the files that are included in the CopyFiles section of the INF file. For example:

Printer Drivers Installation and Troubleshooting Guide - Catalog file included source files from INF

In case the cryptographic checksum of one of the files do not match, the installation will end in an error. The error message will contain the word tampered or tampering.

Printer Drivers Installation and Troubleshooting Guide - Driver is corrupt or tampered

In this case, you either have to obtain a new version of the printer driver, or create a new catalog file. If you need to create a new catalog file yourself, please see the section INF hash is not present in the catalog. Driver package appears to be tampered in this article for a detailed explanation.

The catalog file itself has to be signed with a certificate and the publisher (the issuer) of the certificate has to be trusted. If the catalog file has not been signed or the publisher is not trusted, the installation will halt.
The Add Printer Driver Wizard shows whether a driver is digitally signed or not. In the screenshot below the driver is digitally signed.

Printer Drivers Installation and Troubleshooting Guide - Driver is digitally signed

The following screenshot shows the notification This driver is not digitally signed!. This means that either the driver is not signed or that the driver is signed, but the certificate is not trusted.

Printer Drivers Installation and Troubleshooting Guide - Driver is not digitally signed

When a file is digitally signed, the tab Digital Signatures is present in the properties of the catalog file. A file that is not digitally signed does not have this tab. If you have an unsigned printer driver, please see the section Unsigned printer drivers in this article.

Printer Drivers Installation and Troubleshooting Guide - Catalog file digital certificate

The publisher of the certificate has to be trusted. This is a requirement for a successful installation. When the certificate descends from a main Microsoft certificate, the driver went through the regular WHQL process and is therefore trusted. One example is the certificate Microsoft Windows Hardware Compatibility Publisher in the screenshot above.
If the certificate is from a third-party, it may not be trusted. You need to make sure that the publisher certificate is present in the Trusted Publishers certificate store (local computer) on your local server.

Printer Drivers Installation and Troubleshooting Guide - Publisher certificate in trusted publishers store

To avoid installation issues, make sure that the publisher is trusted before triggering the (unattended) installation. For more information see the section Untrusted printer drivers in this article.

I want to share an interesting fact with you. When the publisher certificate has been added to the Trusted Publishers store, the driver will be trusted for installation. However, when opening the certificate to view its contents, the certificate is still marked as untrusted . Let me explain.

When installing a printer driver, the publisher is checked against certificates present in the Trusted Publishers store. When opening a certificate file to see its contents, the certificate store Trusted Root Certification Authorities (and, if applicable, the store Intermediate Certification Authorities) is checked.

In the screenshot below you see that the certificate is not trusted when opened (Properties \ Digital Signatures \ Details), even though it was trusted during the installation.

If you want the publisher to be trusted under all circumstances, add the certificate to both the Trusted Publishers and Trusted Root Certification Authorities store.

Default printer drivers included in Windows

As you probably know, the Windows operating system ships with a whole bunch of printer drivers. What this means is that the source files of these drivers are included in Windows, but that does not mean that these drivers are actually installed.

To see which printer drivers are currently installed, open the Control Panel and go to Devices and Printers. Click on an existing printer to make the button Printer server properties appear in the top menu. Open the Printer server properties and go to the Drivers tab. Here you will find the currently installed printer drivers.

Printer Drivers Installation and Troubleshooting Guide - List of installed printer drivers

In the following chapter, Unattended printer driver installation, I describe various methods for the unattended installing of printer drivers. Although the installation methods may be different, each method requires source files (including the INF file) and the exact name of the printer as written in the INF file. See the section Printer driver source files in this article for more information.

When you want to install a printer driver from external source files, obtaining the name and path of the INF file as well as the printer name is easy. You simply open the INF file and look for the name (as shown in the paragraph The INF file).

But what if you want to perform an unattended installation of a printer driver which source files are already included in Windows? How will you retrieve the name and the location of the INF file as well as the exact printer name? Well, I may be able to help out here.

First of all, the printers known to Windows are listed in multiple INF files. These files are located in the directory %WinDir%\inf, which by default is C:\Windows\inf. Printer driver INF files always start with the same first three letters: prn. The extension is .inf.

Printer Drivers Installation and Troubleshooting Guide - List of INF files in Windows driver store

Open an INF file with your favorite text editor (e.g. Notepad) to see the list of printers for which it provides a driver.

Printer Drivers Installation and Troubleshooting Guide - INF file contents example

Windows Server 2016 build 1607 ships with a total of 39 printer driver INF files. These 39 INF files include a total of 1253 printers. How do I know this? Well, I manually counted all printers listed in all INF files. No, just kidding, I had my colleague count them for me. 🙂 OK, OK, I will get serious now. I wrote a small PowerShell script which reads the printer names from all available INF files.

The output of the script is a list of all available printer drivers (their exact names as written in the INF file) including the path to the INF file. And exactly these two variables are required for an unattended installation.Printer Drivers Installation and Troubleshooting Guide - Script output list all printer drivers in the Windows store

This script has been created for and tested on:

  • Windows Server 2008 R2 SP1
  • Windows Server 2012 R2
  • Windows Server 2016 build 1607
  • Windows 7 Enterprise SP1
  • Windows 10 build 1703

The script automatically detects the operating system's architecture. It supports 32-bit and 64-bit processors (not Itanium).

Execute the script as follows, for example:
powershell.exe -file "C:\List all printer drivers included in OS.ps1"

In case you get a security warning, set the execution policy to allow the script to run:
powershell.exe -executionpolicy unrestricted -file "C:\List all printer drivers included in OS.ps1"

Would you like to know how many printers are included by default in other Windows operating system? Simply run the aforementioned script. Since I was curious myself, I checked a number of Windows versions and this was the result:

  • Windows 7: 1785 printers in a total of 103 INF files
  • Windows Server 2008 R2 SP1: 1785 printers in a total of 103 INF files
  • Windows Server 2012 R2: 1242 printers in a total of 37 INF files
  • Windows Server 2016 build 1607: 1253 printers in a total of 39 INF files
  • Windows 10 build 1703: 1257 printers in a total of 41 INF files

When you are preparing the unattended installation of a printer driver, you will know the name of the vendor of the printer (e.g. HP, Canon, whatever). With a small modification of the above script we can search for all available printer drivers for that particular vendor. This significantly reduces the output. In the script below, I search for all available printer drivers for Canon printers. You can change the name of the vendor in the variable $VendorName in line 18.

Adding printer drivers to the Windows driver store

It is possible to add printer drivers to the Windows driver store (prestaging). Adding a driver to the Windows driver store does not install the printer driver. It merely adds the printer driver source files to the operating systems for future use. Future use in this case means one of the following:

  • The driver is installed at a later time using method 1 to 4 in the section Unattended printer driver installation.
  • The driver is installed automatically during a Plug and Play operation, for example when a printer that requires this particular driver is connected.

The tool to add drivers to the driver store is PnPUtil.exe. This executable file is included by default in every version of Windows, starting with Windows Vista. This is what the command looks like:

pnputil.exe /a C:\Temp\MyPrinterDriver\MyINFFile.INF

The following command adds the drivers to the driver store and installs the driver:

pnputil.exe /a /i C:\Temp\MyPrinterDriver\MyINFFile.INF

You can execute these commands directly from the command line. For unattended installations, you can add these commands to a script or directly to an SCCM or MDT task sequence.

 

 

In case you ever want to remove the driver from the store, please read the following statement by Microsoft; "When you add a driver package to the driver store by using the /a switch, Windows uses a different name (published name) for the driver package's INF file. You must use the published name of the INF file for the PublishedInfFileName parameter of the /d switch".

For more information, please see the Microsoft article https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil. The command syntax is described here: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax.

Source file location of installed printer drivers

To see detailed information concerning installed printer drivers, execute the following command:

cscript "C:\windows\system32\Printing_Admin_Scripts\en-US\prndrvr.vbs" -l

The image below shows you the details of a driver for an HP LaserJet P1102 printer, such as printer name, version, architecture and the location of the main source files after installation. During installation, the source files are copied to the directory C:\Windows\system32\spool\DRIVERS\x64.

Printer Drivers Installation and Troubleshooting Guide - Installed printer driver details prndrvr.vbs -l

Please note the different source file location for drivers that are included in the Windows driver store (C:\Windows\System32\DriverStore\FileRepository).

Printer Drivers Installation and Troubleshooting Guide - Installed printer driver details prndrvr.vbs -l from Windows drivers store

Unattended printer driver installation

In this section, I present five methods for the unattended installation of printer drivers. Even though the installation methods may be different, each method requires the path to the printer driver source files and especially the INF file, as well as the exact name of the printer as written in the INF file.

If you are installing an external printer drivers not included in the Windows driver store, read the paragraph The INF file to learn how to retrieve the exact name of the printer driver.
If you want to install a printer driver already included in the Windows store, please see the chapter Default printer drivers included in Windows. In this chapter, I explain how to retrieve the path and name of the INF file as well as the exact name of the printer driver.

Method 1: using PRNDRVR.vbs

Operating systems: all

One of the oldest methods to install a printer driver unattended is to use the default Microsoft VBScript prnddrvr.vbs. This file has been around forever. Its location changed over time though. Initially, the file was located in the directory C:\Windows\System32. In newer operating systems, the file is located in the directory C:\windows\System32\Printing_Admin_Scripts\en-US.

For the sake of completeness, this directory also contains other scripts for managing printer objects, ports and jobs:

  • prncnfg.vbs -> get and set printer configuration
  • prnjobs.vbs -> manage print jobs (pause, resume, cancel and list jobs)
  • prnmngr.vbs -> manage printer objects (add, delete and list printers)
  • prnport.vbs -> manage printer ports (add, delete and list ports)
  • prnqctl.vbs -> control printers (pause, resume and purge printers)
  • pubprn.vbs -> publish printers (old, applies to Windows 2000)

Here is an example how to install a printer driver from the Windows driver store using the VBScript prnddrvr.vbs:

cscript "C:\Windows\System32\Printing_Admin_Scripts\en-US\prndrvr.vbs" -a -m "Canon Inkjet Type4 Class Driver" -v 3 -e "Windows x64" -i "C:\Windows\inf\prncacla.inf"

And here is an example how to install a printer driver not present in the Windows store using the VBScript prnddrvr.vbs:

cscript "C:\Windows\System32\Printing_Admin_Scripts\en-US\prndrvr.vbs" -a -m "HP LaserJet Professional P1102" -v 3 -e "Windows x64" -i "C:\Temp\HP_1100\HP1100.INF"

These commands also work on the latest editions of Windows Server 2016 and Windows 10 (I have tested them).

Let's take a closer look at the structure of the command line:

cscript(.exe)*
This executable file is the command-line version of the Windows Script Host required to execute VBscripts.

prndrvr(.vbs)*
The VBScript file used to install the printer driver.

-a
This parameter tells the VBScript to install the driver (as opposed to the parameter -d which deletes the driver).

-m "HP Universal Printing PCL 6 (v5.5.0)"
The name of the driver you want to install. Use the exact name as specified in the driver's INF file (if not you will get the error Win32 error code 87). The INF file is included in the driver's source files. Please be aware that there may be more than one INF file.

-v 3
The version of the driver. Nowadays, printer drivers are either version 3 or 4. You may be able to check the version in the INF file (but not always).
If you cannot find the version number, use 3. During my tests I was able to install a version 4 driver without problems even if I used version 3 in the command line.
If you want to be absolutely sure, install the printer driver manually on a test server and check the version in the GUI. Open the Control Panel and go to Devices and Printers. Click on an existing printer to make the button Printer server properties appear in the top menu. Open the Printer server properties and go to the Drivers tab. Here you will find the currently installed printer drivers including their versions (type).

Printer Drivers Installation and Troubleshooting Guide - Print server properties driver version

-e "Windows x64"
The environment (= the architecture of the operating system) in which the driver is to be installed. Possible values are Windows NT x86Windows x64 and Windows IA64.

-i "C:\Temp\PrinterDrivers\HP\UP_PCL6\hpcu130u.inf"
The complete path and file name of the INF file of the driver. The INF file contains all relevant driver specific data.

*The file cscript.exe does not require the full path, because the parent directory C:\Windows\System32 is listed by default in the environment variable path.

You can use this command directly in software deployment tools such as Microsoft MDT and Microsoft SCCM. I personally do not use command lines such as these, because I prefer my own centralized logging and customized error handling. Instead, I have created a PowerShell script to install printer drivers in my master images (see below).

For more detailed information concerning the prndrvr.vbs, please see the following Microsoft article: https://technet.microsoft.com/en-us/library/cc754632(v=ws.11).aspx

Method 2: using RUNDLL32.exe

Operating systems: all

Another old way how to install printer drivers is to use the rundll32.exe and calling the printui.dll. The rundll32.exe, as explained by Microsoft, "loads and runs 32-bit dynamic-link libraries (DLLs)". One of the many DLLs that can be loaded is the printui.dll.

Here is an example how to install a printer driver from the Windows driver store using the RUNDLL32.exe:

RUNDLL32 PRINTUI.DLL,PrintUIEntry /ia /f "C:\Windows\inf\prncacla.inf" /m "Canon Inkjet Type4 Class Driver"

And here is an example how to install a printer driver not present in the Windows store using the RUNDLL32.exe:

RUNDLL32 PRINTUI.DLL,PrintUIEntry /ia /f "C:\Temp\PrinterDrivers\HP\UP_PCL6\hpcu130u.inf" /m "HP Universal Printing PCL 6 (v5.5.0)"

These commands also work on the latest editions of Windows Server 2016 and Windows 10 (I have tested them).

Let us analyze this command line:

RUNDLL32(.exe)*
This executable file loads and runs the printer DLL.

PRINTUI.DLL
This DLL file contains all the functions required to install the printer driver.

PrintUIEntry
The PrintUIEntry keyword, required by the printui.dll, is case sensitive and you must enter the syntax for this command with the exact capitalization shown.

/ia
This parameter lets the printui.dll know that a printer driver, using a INF file (*.inf), needs to be installed.

/f "C:\Temp\PrinterDrivers\HP\UP_PCL6\hpcu130u.inf"
The complete path and file name of the INF file of the driver. The INF file contains all relevant driver specific data.

/m "HP Universal Printing PCL 6 (v5.5.0)"
The name of the driver you want to install. Use the exact name as specified in the driver's INF file. The INF file is included in the driver's source files. Please be aware that there may be more than one INF file.

*The file rundll32.exe does not require the full path, because its parent directory C:\Windows\System32 is listed by default in the environment variable path.

You can execute this command directly on the command-line or within a script (e.g. VBScript or PowerShell).

The command RUNDLL32 PRINTUI.DLL,PrintUIEntry can be used for more than installing a printer driver. For a complete list of all possible functions and the corresponding parameters, please see the Microsoft article Rundll32 printui.dll,PrintUIEntry. I personally do not use command lines such as these (except for the unattended uninstallation), because I prefer my own centralized logging and customized error handling. Instead, I have created a PowerShell script to install printer drivers in my master images (see below).

For more information concerning the above command, please see the Microsoft article Deploying Printers and Print Drivers Remotely.

 

 

Method 3: using PowerShell and WMI

Operating systems: all

Nowadays, a lot of automation in a Windows infrastructure is done with PowerShell. Installing printer drivers is no exception. In this paragraph, I provide you with a working example complete with error handling and detailed logging.

For operating systems from Windows 8 / Windows Server 2012 and higher, you may also want to check the next paragraph Method 4: using PowerShell and cmdlet.

The script works for all operating system from Windows Server 2008 R2 / Windows 7 and higher. Please always make sure to install the latest PowerShell version.

Based on my installation template, this is what the complete script, including logging and error handling, looks like.

The above script can be used for the installation and uninstallation of one or more printer drivers. In the script, I call the function DS_InstallPrinterDriver for installing printer drivers and the function DS_UnInstallPrinterDriver for uninstalling printer drivers. You can call these functions as many times as you like. This means that the script offers you a lot of flexibility. You can choose to have one consolidated script to manage all of your printer driver (un)installations or to use a separate copy of the script for each driver. Whatever suits your needs.

Make sure to call the function correctly. For example:

DS_InstallPrinterDriver -Name "Canon Inkjet Type4 Class Driver" -Path "C:\Windows\inf" -INF_Name "prncacla.inf"

  • Name: has to be the EXACT name as specified in the INF file, otherwise the error 87 is thrown.
  • Path: specify the path WITHOUT adding the name of the INF file. Path only!
  • INF_Name: specify the name of the INF file only. No path!

To install the printer driver, I used Windows Management Instrumentation (WMI); the Win32_PrinterDriver class to be exact. Now, it is important to realize that WMI is not restricted to PowerShell. I could have easily used a different scripting language, such as VBScript, to communicate with WMI.

Before you can use the above script, you first need to prepare the printer driver source files. I recommend to follow these steps:

  • Create an installation directory on the local computer or on a file share (UNC path). For example: C:\Temp\PrinterDrivers.
  • Create a subdirectory for each vendor, for example: C:\Temp\PrinterDrivers\HP and C:\Temp\PrinterDrivers\Canon.
  • Create a subdirectory for each printer driver per vendor, for example C:\Temp\PrinterDrivers\HP\HP Universal Printing PCL 6 (v5.5.0).
  • In the printer driver directory, create a subdirectory called Files, for example C:\Temp\PrinterDrivers\HP\HP Universal Printing PCL 6 (v5.5.0)\Files.
  • Copy the printer driver files (for the specific printer) to the directory Files.
  • Copy the above script to a new PS1 file, for example PrinterDrivers.ps1 and add this file to the root of your installation directory. You can choose on which level you want to add this script, for example:
    • C:\Temp\PrinterDrivers\PrinterDrivers.ps1 -> use one script to install all printer drivers.
    • C:\Temp\PrinterDrivers\HP\PrinterDrivers.ps1 -> use one script to install all vendor specific printer drivers.
    • C:\Temp\PrinterDrivers\HP\HP Universal Printing PCL 6 (v5.5.0)\PrinterDrivers.ps1 -> use one script for each individual printer driver.
  • Execute the PowerShell script, for example:
    powershell.exe -file C:\Temp\PrinterDrivers\PrinterDrivers.ps1
  • In case you get a security warning, set the execution policy to allow the script to run: powershell.exe -executionpolicy unrestricted -file C:\Temp\PrinterDrivers\PrinterDrivers.ps1

Log files are created in the directory C:\Logs\PrinterDriver, but you can change this to any directory you want (see lines 188 and 189).

Method 4: using PowerShell and cmdlet

Operating systems: Windows 8.1 / Windows Server 2012 R2 and higher

From Windows 8.1 / Windows Server 2012 R2 and higher, the cmdlets Add-PrinterDriver and Remove-PrinterDriver can be used.

Note: the following commands only work with drivers already present in the Windows drivers store! You cannot install a printer using external source files.

The only parameter both commands require is the exact name of the printer driver (as specified in the INF file). See the section Default printer drivers included in Windows on how to retrieve the exact name of the printer driver.

It is very unfortunate that these commands do not allow an administrator to install drivers not present in the driver store.

Method 5: using the vendor's installer

Operating systems: all

In some cases it is better to use the vendor's installer instead of any of the previous methods, for example when installing a more complicated driver.

Take the HP Universal Printer Driver for example. The source files contain multiple INF files, the driver can be installed in traditional mode or dynamic mode and the driver comes in two flavors; a version specific or a non-version specific installation.

Note: dynamic mode is not supported on multi-user environments such as Microsoft RDS and Citrix XenApp. Only traditional mode is supported.

In this more complicated case, the installer may be the better choice. Also, and this is not unimportant, the only other supported method for unattended installation according to the HP documentation is Method 2: using RUNDLL32.exe.

And one other important and positive information; the installer install.exe can be called with the parameters /q /h to enable an unattended installation. I cannot guarantee that all vendor installers can handle unattended installation, but I think that most can.

The conclusion at the end of this long section is that you will have to make a decision which installation method to use for each printer driver you want to install.

Unattended printer driver uninstallation

The unattended installation of a printer driver should be something simple, but it turned out that was not the case. The main reason for this is that the WMI class Win32_PrinterDriver does not seem to have a delete method.

The way I got it to work was with the executable file RUNDLL32.exe:

RUNDLL32 PRINTUI.DLL,PrintUIEntry /dd /m "HP Universal Printing PCL 6 (v5.5.0)"

I have successfully tested this uninstall command on Windows Server 2008 R2 and Windows Server 2016.

The PowerShell script in the section Method 3: using PowerShell and WMI contains both an installation and uninstallation function. The installation function is based on WMI; the uninstallation function executes the executable file RUNDLL32.exe.

Common installation problems and solutions

Note: before reading this chapter, I recommend reading the entire article from the top for a better understanding of the behavior and handling of printer drivers.

In general, installation problems of printer drivers fall into one of the following categories:

Regarding of the type of error, one of the most important sources of information is the log file C:\Windows\INF\setupapi.dev.log. Open this log file and scroll to the end to see the reason for the installation failure.

Unsigned printer drivers

As explained in the section The CAT file, printer drivers need to be digitally signed. To be more specific, the catalog file (.cat) needs to be digitally signed.

As a best-practice, I strongly recommend that you try to get the original printer driver from the vendor. Nowadays, these should be WHQL signed. If this is not possible, the following workarounds are available to you:

  • Disable integrity checks (bcdedit.exe)
  • Sign the catalog file (selfcert.exe, signtool.exe)

Disable integrity checks (bcdedit.exe)

One workaround for installing unsigned drivers is to play around with the boot configuration data settings (BCD), but this method goes against various security guidelines from Microsoft and becomes more and more difficult with newer operating systems. The goal of this method is to disable integrity checks and enable the test-signing mode using the bcdedit.exe.

  • Disable integrity checks by executing the following command:
    bcdedit.exe /set loadoptions DISABLE_INTEGRITY_CHECKS
  • Enable test-signing by executing the following command:
    bcdedit.exe /set testsigning ON

Please be aware that when Secure Boot is enabled, the above two commands have no affect. Also, I have not tested these commands on the latest operating system (Windows Server 2016 and Windows 10). I cannot guarantee the commands still work on these newer operating systems.

To undo the above settings, execute the following commands:

  • bcdedit.exe /deletevalue loadoptions
  • bcdedit.exe /set testsigning OFF

Sign the catalog file (SelfCert.exe, SignTool.exe)

My preferred method to solve this unsigned driver issue is to simply sign the catalog file myself.

In order to digitally sign a file you will need a certificate. You can use your enterprise certificate authority (CA) for this. In case you do not have a certificate authority, you can use the selfcert.exe included in Microsoft Office.

Run the file SELFCERT.EXE located in the directory C:\Program Files (x86)\Microsoft Office\Office15.

Enter an appropriate name for the certificate and click OK. In this example I use the name MyPrinterDriver.
Printer Drivers Installation and Troubleshooting Guide - Selfcert.exe create certificate

The following message should appear:
Printer Drivers Installation and Troubleshooting Guide - Selfcert.exe create certificate success message
The certificate is now created and added to your Personal certificate store. To see the certificate, open a Microsoft Management Console (mmc.exe) and add the snap-in Certificates (Current User).

Printer Drivers Installation and Troubleshooting Guide - Personal store self-signed certificate

At this point, it may be wise to export the certificate. You will need this in one of the following steps. While in the Personal certificate store, select the corresponding certificate with a right-mouse click and go to All Tasks \ Export. Simply follow the wizard. At the end of the wizard you will have a .CER file (without the private key which is not exportable).

To sign the catalog file with the newly created certificate, the Microsoft signtool.exe can be used. This tool ships in the Microsoft Windows Driver Kit (WDK) and can be downloaded here. To sign the catalog file, execute the following command:

"C:\Program Files (x86)\Windows Kits\10\Tools\bin\i386\signtool.exe" sign /i MyPrinterDriver "C:\Temp\MyPrinterDriver\MyCatalogFile.cat"

In the above example, I assume that the signtool.exe is located in the default installation directory of the Windows Driver Kit. Adjust the path to your requirements.
It is enough to specify only the name of the certificate, because it is automatically retrieved in the Personal certificate store.

The above steps take care of the signing of the catalog file, but, the certificate is not yet trusted. Please use one of the methods described in the section Untrusted printer drivers to make the certificate trusted (you will need the exported certificate for this).

References:

Untrusted printer drivers

To prevent error messages relating to untrusted drivers, the publisher certificate has to be added to the Trusted Publishers certificate store.

The first step is to identify which certificate is the publisher certificate. Open the file properties of the catalog file, go to the tab Digital Signatures and click the button Details (you may have to wait a bit before something happens). A new windows opens displaying the certificate details. Go to the tab Advanced. Here you find the name of the publisher (= issuer).

Printer Drivers Installation and Troubleshooting Guide - Find issuer name in certificate properties

You may have to retrieve the publisher certificate from the Internet. If you cannot find it I suggest you contact the vendor and have the certificate sent to you.
In some cases the publisher certificate is the same as the one on the catalog file. This is the case when using a self-signed certificate as explained in the section Unsigned printer drivers. In this case you can simply save (export) the certificate to a .CER file.

 

 

Now that you have the publisher certificate you need to add it to the Trusted Publishers store (I also recommend to add it to the Trusted Root Certification Authorities store right away as explained in the section The CAT file). There are various ways how to achieve this goal:

Update certificate store using Group Policy

The easiest method is to use a Group Policy. Open the group policy editor (GPMC.msc) and create a new group policy object or modify an existing one. Go to Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Public Key Policies and add the exported certificate to the Trusted Publishers store (and the Trusted Root Certification Authorities store).

Printer Drivers Installation and Troubleshooting Guide - Group Policy add certificate to trusted publisher store

Update certificate store using PowerShell and .Net

Operating systems: all

In case you would like to install the certificate on the local server (or in your master image) without using Group Policies, I recommend to use PowerShell.

The following PowerShell script adds the example certificate PrinterDriver.cer to both the Trusted Publishers store and the Trusted Root Certification Authorities store.

In the script, I use the .Net framework class instead of the cmdlet Import-Certificate. The simple reason for this is that the .Net class works on all operating systems (at least from Windows 2008 R2 and later), whereas the Import-Certificate cmdlet only works from Windows Server 2012 R2 / Windows 8.1 and above (see the following paragraph).

Execute the script as follows, for example:
powershell.exe -file "C:\Import certificate.ps1"

In case you get a security warning, set the execution policy to allow the script to run:
powershell.exe -executionpolicy unrestricted -file "C:\Import certificate.ps1"

Update certificate store using PowerShell and cmdlet

Operating systems: Windows 8.1 / Windows Server 2012 R2 and higher

From Windows 8.1 / Windows Server 2012 R2 and higher, the cmdlet Import-Certificate can be used. Two parameters are required:

  • Filepath: the path to the certificate file which has to be imported.
  • CertStoreLocation: this parameter requires two inputs.
    • The store path, which can have one of two values:
      • LocalMachine
      • CurrentUser
    • The store name. The mainly used stores are:
      • CA  (= Intermediate Certificates Authorities)
      • My (= Personal)
      • Root (= Trusted Root Certificates Authorities)
      • TrustedPublisher (= Trusted Publishers)

To see all available stores, open a PowerShell command window and type the following command:

Here is an example how to import a certificate using the cmdlet:

Update certificate store using CertMgr.exe

Operating systems: all

Another possible method for adding certificates to the local certificate store is the certmgr.exe tool from Microsoft. For more information, please see the following article: https://docs.microsoft.com/en-us/dotnet/framework/tools/certmgr-exe-certificate-manager-tool.

INF hash is not present in the catalog. Driver package appears to be tampered

As explained in the section The CAT file, the catalog file contains a collection of cryptographic hashes, or thumbprints, for each of the files that are included in the CopyFiles section of the INF file.

If one or more source files have changed, the hash values stored in the catalog file no longer match the actual hash values. In this case the installation ends in an error such as Driver package INF file hash is not present in catalog file and Driver package appears to be tampered. These errors are also clearly identifiable in the log file C:\Windows\INF\setupapi.dev.log.

Printer Drivers Installation and Troubleshooting Guide - Setupapi.dev.log hash not present in catalog file

To solve this problem, I strongly recommend to try to get the original printer driver from the vendor. If this is not possible for some reason, you will have to recreate the catalog file yourself. These are the steps involved.

First, you need the tool Inf2Cat.exe, which is included in the Windows Driver Kit (WDK). If you do not have the WDK installed on your machine, you can download it here. Install it on your machine.

Open the INF file of the driver you are trying to repair. Make sure that the line CatalogFile=MyCatalogFile.cat is specified in the beginning of the file. If not, add it to the [Version] section.

Printer Drivers Installation and Troubleshooting Guide - INF file catalog entry

To create a driver compatible with the operating systems Windows Server 2012 R2 and Windows Server 2016, open a command window and execute the following command line:

C:\Program Files (x86)\Windows Kits\10\bin\x86\Inf2Cat.exe /driver:"C:\Temp\MyPrinterDriver" /os:Server6_3_X64,Server10_X64

For more information about the various command line options, either check the help function of Inf2Cat (Inf2Cat.exe /?) or check the Microsoft article Inf2Cat. Here you also find the list of operating systems and their abbreviations, although the abbreviation for Windows 10 and Windows Server 2016 I only found in the help function of the Inf2Cat file.

The catalog file has now been restored, but you are not done yet; the catalog file still has to be digitally signed and the publisher certificate needs to be trusted by the local system. Please follow the steps in the section Unsigned printer drivers to sign the catalog file. Afterwards, make sure that the publisher certificate is trusted by using one of the methods described in the section Untrusted printer drivers.

References:

Share this post:
Dennis Span on EmailDennis Span on LinkedinDennis Span on Twitter
Dennis Span
Dennis Span
Dennis Span works as a Senior Citrix Architect for a large insurance company in Vienna, Austria. He holds multiple certifications such as CCE-V, CCIA and CCEA. In 2017, Dennis became a Citrix Technology Advocate (CTA). Besides his interest in virtualization technologies and blogging, he loves spending time with his family as well as snowboarding, playing basketball and rowing. He is fluent in Dutch, English, German and Slovak and speaks some Spanish.

9 thoughts on “Printer Drivers Installation and Troubleshooting Guide

  1. Pingback: EUC Weekly Digest – September 2, 2017 – Carl Stalhood

  2. Dennis, I was wondering if you would be able to tell me if this is even possible. We just moved from WinXP to Win10. We have shop flyers for about 10,000 parts are constantly adding new ones. We build wood store fixtures. We were using a driver called HPLJ.GPD in WinXP. It's actually a Microsoft driver. We use it in our CAD system to print to file (we print to AutoCAD's .plt file that is used in our ERP system). This driver (and it's associated .dll, .inf, .cat files etc) are not part of Win10. I've tried installing them, but Win10 keeps me from modifying things. How would I go about getting these drivers to work in Win10? Remember, we're not printing to a physical printer. We're only using this driver to create a plot file in AutoCAD.

    • Hi Mick, did you actually manage to install the HPLJ.gpd driver in Windows 10? What do you mean when you say that "W10 keeps me from modifying things"? Are you installing and modifying in admin mode without User Account Control (UAC)? I found the following article where a number of workarounds are described such as using a generic HPGL/2 driver. Could this work for you? This is the article I am referring to: https://knowledge.autodesk.com/support/autocad/troubleshooting/caas/sfdcarticles/sfdcarticles/HP-printers-do-not-work-with-AutoCAD-2015-on-Windows-8.html

      • Thanks. I did not try lowering (or turning off) UAC. I can try that. We actually need to be able to use the old driver. The HPLJ.GPD creates a plot file that is compatible with our ERP software. Any of the newer PCL formats (PCL3, 4, 5 or 6) messes up the print jobs. It seems all the newer printer options print PCL formats. I'd like to be able to re-create an .inf file on Win10 using this older driver, since we aren't printing to a hardware device. Do you know of an article like "creating .inf files in Win10 for dummies" ? BTW, great article. Back in the early 90's I wrote an article for Laserjet Journal on how we used HP Macro language to create our Work Order system. Back then it was pretty trick printing the database information, barcodes and a CAD drawing all on the same sheet. Got a free HP mug out of the deal.

  3. Hi Dennis
    This article and script is REALLY thorough and just works out of the box.
    One thing though. It fails with error 87 on 32-bit drivers when added to a 64-bit server?

    • Hi Thomas,

      I am happy you like the article and that the script worked for you (in most cases at least). I think that error 87 is sort of a general error. I mention error 87 in the article. This error is generated when the name of the printer is not exactly the same as the one specified in the INF file, but it may be that other errors also throw the same error number. In case you believe the error is caused by the script, than please use one of the other methods to verify that the installation of the 32-bit driver on a 64-bit system actually works, for example using this command: RUNDLL32 PRINTUI.DLL,PrintUIEntry /ia /f "C:\Temp\PrinterDrivers\HP\UP_PCL6\hpcu130u.inf" /m "HP Universal Printing PCL 6 (v5.5.0)"

      Bye,

      Dennis

Leave a Reply

Your email address will not be published.

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.