Installing Print Drivers That Are Not Microsoft Signed in Papercut Hive

Introduction

PaperCut Hive automatically installs print queues and drivers. Some print vendors provide drivers that are digitally signed by the vendor but do not include a Microsoft Authenticode signature. In these situations, Windows can block automatic driver installation.

This article explains how to identify this issue and how to trust the print vendor’s certificate so the driver can be installed successfully.

Before You Begin

Before uploading or deploying a print queue through PaperCut Hive, install the print driver manually as a local administrator.

This allows you to:

• Verify that the driver installs correctly.
• Configure any driver settings required by your organization.
• Identify whether the driver uses a non-Microsoft signature.

During manual installation, Windows may display a Windows Security prompt asking whether you trust software from the print vendor. If you see this prompt, the driver will likely require the certificate steps described in this article.

Identifying Blocked Driver Installations

Users may report one or more of the following symptoms:

• The Hive print queue is removed and does not reappear.
• The printer never appears on the workstation.
• Driver deployment repeatedly fails.

To confirm the issue, review the pc-edgenode-service.logs file.

Example log entry:pc-queue-handler.exe: STDERR|SUPPORT: Queue operation failed for: New-Driver, action: install: install and configure queue: install queue: install driver: driver 'Kyocera ECOSYS MA4000x KX' not found in installed drivers {"src":"queueop.go:105"}

Here is a snippet from the logs so you know exactly what to look for:

If this error is present, continue with the steps below.

Part 1: Save the Print Vendor’s Security Certificate

First, you must locate and save the printer’s security file

1. On the taskbar, click the folder icon to open File Explorer.
2. In the address bar, navigate to C:\Windows\System32\CatRoot.
3. Open the most recent folder.
4. Locate the most recent file with the .cat extension.
5. Double-click the .cat file.
6. In the Security Catalog window, select the General tab.
7. Click View Signature.

8. In the Digital Signature Details window, click View Certificate.

9. In the Certificate window, select the Details tab.
10. Click Copy to File…

11. In the Certificate Export Wizard, click Next.
12. Leave the default export format selected and click Next.
13. Click Browse….
14. Select a location, for example, your Desktop.
15. In the File name field, type PrinterCert and click Save.
16. Click Next, Finish, and OK.

Part 2: Tell Your Computer to Trust the Certificate

Install the certificate on your machine.

1. Double-click the saved PrinterCert file.
2. In the Certificate window, click Install Certificate….

3. In the Certificate Import Wizard, select Local Machine and click Next.
4. If prompted to allow changes, click Yes.

5. Select Place all certificates in the following store.
6. Click Browse….

7. In the Select Certificate Store window, select the Show physical stores checkbox.
8. Select the Trusted Root Certification Authorities folder.
9. Click OK.

10. Click Next, then click Finish.
11. When the success message is displayed, click OK.

Optional: Deploy the Certificate via Group Policy

Most environments only require Parts 1 and 2.

If the driver still fails to install, or if you want to deploy trust to multiple devices centrally:

1. On a Windows server, open the Group Policy Management Console.
2. Right-click your domain group policy and select Edit.
3. Navigate to Computer Configuration > Policies.
4. Navigate to Windows Settings > Security Settings.
5. Select Public Key Policies.
6. Right-click Trusted Publishers and select Import.
7. In the Certificate Import Wizard, follow the prompts.
8. Select the location and name of your saved certificate file.
9. Leave all other settings at their defaults and click Finish.

Resolving the Windows Security prompt

PaperCut Hive requires the print driver to have an official Microsoft Authenticode signature to automatically add a printer. If the signature is missing, use one of the following methods:

• Switch to a Microsoft-signed print driver.
• Install the unsigned print driver manually.
• Install the security certificate using the procedure above.

If you install the driver manually, the Windows Security dialog box is displayed. To complete the installation:

1. In the Windows Security dialog box, select the Always trust software from… checkbox.
2. Click Install.