![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Installing Windows Updates released on or after September 14, 2021 on Windows print servers programmatically sets RpcAuthnLevelPrivacyEnabled=1
Windows and non-Windows print clients must support RPC_C_AUTHN_LEVEL_PKT_PRIVACY to connect to Windows print servers that have installed September 14 and newer Windows Updates with RpcAuthnLevelPrivacyPrivacyAnd=1.
Here are some things to check before or after installing the September 14, 2021 Windows Update on Windows print servers with RpcAuthnLevelPrivacyPrivacyAnd=1 when experiencing the "Windows cannot connect to a printer" with "Operation failed with error 0x0000011B" error:
- Windows Print clients on currently supported OS versions must install any single Windows Update released between January 12, 2021 and September 14, 2021
- Windows Print Clients whose clients OS lifecycle has expired must upgrade to a supported OS then install any single Windows Update released between January 12, 2021 and September 14, 2021.
The OS lifecycle for the 1903 release of Windows 10 for example expired in December 2020 and cannot install January 2021 or newer Windows updates. 3. Window print clients running legacy OS versions like W2K8 -> WS 12 R2 must have an active ESU then install any single LCU between January 12, 2021 and September 14, 2021.
Legacy OS versions not eligible for an ESU should be upgraded to a supported OS. 4. IOS, Linux and Unix print client clients must support RPC_C_AUTHN_LEVEL_PKT_PRIVACY.
In a network trace, focus on the value in the "auth level" field of the network packet sent by the print client to the Winspool interface of the print server over the port returned by the EPM. The “auth level” field flag will read “0x6” on print clients that support RPC_C_AUTHN_LEVEL_PKT_PRIVACY. 5. VPN and network security solutions must allow all print clients to have network connectivity to the remote Winspool service over the port in the "high" dynamic port range (49152 -> 65535) returned by the endpoint mapper of a Windows print server configured with RpcAuthnLevelPrivacyEnabled=1.
RpcAuthnLevelPrivacyEnabled can be temporarily set to =0 followed by a restart of the print spooler service on the print server until the requirements in 1-5 can be satisfied on print clients but doing so downgrades security protections in the September 14, 2021 updates.