03d0754fdc
Assigning a printer to a bay is useless if the bay cannot install it, and the fleet data says why that mattered: 42 of 44 printers could not resolve a driver. This is the delivery half - the drivers themselves, staged once per bay, so that creating a queue never waits on a download. Install-ShopdbPrinterDriver.ps1 does one driver: trust the package's signer, then pnputil /add-driver, then Add-PrinterDriver. Install-ShopdbPrinterDrivers.ps1 does a site's whole set from drivers.json, and answers a compliance question with -TestOnly, which is what makes it a clean DSC Script resource rather than a fire-and-forget install. Deliberately SEPARATE from assignment. Drivers are large, near-identical across a fleet and change rarely; assignments are small, per-bay and change often. Staging the set in the GE-Enforce common scope means the assignment client only ever creates a queue - it never fetches a 48 MB package while somebody is waiting to print, or discovers the share is unmounted at the worst moment. THE SIGNER TRUST STEP IS THE WHOLE TRICK, and it took a real driver to find it. certutil -addstore on the .cat file satisfied the Xerox package and failed every HP INF with "The publisher of an Authenticode(tm) signed catalog has not yet been established as trusted" - a coin toss, not a mechanism. The certificate is now extracted with Get-AuthenticodeSignature and added to Trusted Publishers, for every catalog under the package rather than the first INF's neighbours. On a locked bay there is no prompt to answer, so the old failure was silent. Verified on Windows against real packages, not by reading: all six drivers this site needs install through the script, a second run is a no-op, a wrong driver name fails with the names the package actually offers, and the DSC cycle behaves - TestOnly exits 1 on a clean box, install exits 0, TestOnly then exits 0. The packages themselves stay out of git: they are licensed vendor binaries, and they belong on the share beside the other imaging payloads. DEPLOYING-DRIVERS.md carries the GE-Enforce entry, the DSC configuration and the Intune shape, plus the constraint that has cost a session before: the SFLD share is mounted only during the enforcement cycle, so this runs as a manifest entry and never as its own scheduled task.
36 lines
1.1 KiB
JSON
36 lines
1.1 KiB
JSON
{
|
|
"_comment": "Driver set for a site. Each entry names a driver EXACTLY as its INF declares it (what Add-PrinterDriver matches on) and where its package lives, relative to the package root or as an absolute UNC path. Copy to drivers.json and edit for the site.",
|
|
"drivers": [
|
|
{
|
|
"drivername": "HP Universal Printing PS",
|
|
"path": "drivers/hp_upd_ps",
|
|
"covers": "HP office printers (universal)"
|
|
},
|
|
{
|
|
"drivername": "Xerox Global Print Driver PCL6",
|
|
"path": "drivers/xerox_gpd",
|
|
"covers": "Xerox office printers (universal)"
|
|
},
|
|
{
|
|
"drivername": "HP DesignJet T1700dr V4",
|
|
"path": "drivers/hp_designjet",
|
|
"covers": "DesignJet T1700 / T1700dr plotters"
|
|
},
|
|
{
|
|
"drivername": "ZDesigner ZT411-300dpi ZPL",
|
|
"path": "drivers/zebra_zt411",
|
|
"covers": "Zebra ZT411 label printers"
|
|
},
|
|
{
|
|
"drivername": "EPSON TM-C3500",
|
|
"path": "drivers/epson_tmc3500",
|
|
"covers": "Epson ColorWorks C3500 label printers"
|
|
},
|
|
{
|
|
"drivername": "DTC4500e Card Printer",
|
|
"path": "drivers/hid_dtc4500e",
|
|
"covers": "HID FARGO DTC4500e card printer"
|
|
}
|
|
]
|
|
}
|