Printer Has Windows OS

rockn · 2018-11-26T20:15:11.000Z

I doubt 3389 (RDP) would ever be open on a printer, I think she is referring to the server/workstation it is set up on. How are these printers deployed on your network? Shared from a print server or from a workstation?

adamsmith34 · 2018-11-26T20:19:04.000Z

Rockn, they are standalone network printers.

jackie · 2018-11-26T20:21:22.000Z

You wouldn’t think 3389 would be open on a printer, but if it’s not from AD or DNS, then there has to be (I think we use other ports besides 3389 as Windows - that’s just the primary example). You can use our IP Scanner to see all the ports open on a particular subnet.

adamsmith34 · 2018-11-26T20:21:31.000Z

Jackie, what I’m understanding is consideration 1 is out of the question. These printers were all set up long before the AD and DNS existed.

I am reading the links you provided for the second consideration.

big-green-man · 2018-11-26T20:25:59.000Z

Are you able to give specific models? It’s very common for printers to run Windows Embedded/IoT these days.

adamsmith34 · 2018-11-26T20:52:46.000Z

Big Green Man, some examples include Brother MFC-L2700DW, HP OfficeJet 4650, and Canon D1150. I’m not sure any of these is new enough/sophisticated enough to be running Windows Embedded or IoT, but please correct me if I’m wrong.

big-green-man · 2018-11-26T21:23:40.000Z

adamsmith34:

Big Green Man, some examples include Brother MFC-L2700DW, HP OfficeJet 4650, and Canon D1150. I’m not sure any of these is new enough/sophisticated enough to be running Windows Embedded or IoT, but please correct me if I’m wrong.

You’d be surprised. I’m not sure about those particular models. I discovered this because Spiceworks was reporting that my Brother QL-720nw was running Windows. Here’s the topic on that:

Brother QL-720NW Reports as Windows 10 SP1 Spiceworks Support

Any ideas on this? No stale DNS entries, forward or reverse. Deleting and re-adding doesn't change it, and neither does forcing a rescan. As you can see, it updates okay when forcing a rescan. Get-WMIObject fails with RPC server unavailable, so I can't check and see via WMI if it's actually running on Windows 10. Is there a way to check with SNMP, which you'd think would be the protocol to use Does the printer actually run Windows 10 (SP1 even though there are no SPs)? Spiceworks is up to da…

I still haven’t gotten confirmation as to whether or not my QL-720nw is actually running Windows, but I suspect it is. Maybe @kareembadr4040 can give some more info.

@repairatrooper

Repairatrooper · 2018-11-26T21:52:37.000Z

I can’t speak for any other than HP, but the HP Enterprise Laser and PageWide Pro products run embedded Windows CE. Samsung unit were Android based. The standard OfficeJet models I am not sure of as we do zero support on those products.

hp_windows_ce.jpg783×486 76.6 KB

adamsmith34 · 2018-11-26T22:03:30.000Z

Big Green Man, I see. Then this is a problem that Spiceworks needs to address directly. The anti-virus report does no good if it indicates false negatives. It obfuscates actual problems when devices which actually need anti-virus doesn’t have it. Thank you for your help in this thread.

robertgolobek · 2018-11-27T11:43:36.000Z

Ok I agree printers have an os. The question is why do you care? Are people surfing the web from these printers? If you are looking to put AV on these printers good luck. AV only works if the device executes the program if the device is open to read/writes (the way a spooler would be) the AV has no way to know friend for foe so the spooler will get wiped. As far as other progs in the printer you should be fine. You are looking to protect against worms attacking your system due to the fact that these devices are not upto date? I agree this could be an issue however we all remember how childproof we made the house for the first baby. Just make sure your printers are inside the DMZ and the only ports and shares open are for printing.

big-green-man · 2018-11-27T11:45:52.000Z

Robert4788:

Ok I agree printers have an os. The question is why do you care? Are people surfing the web from these printers? If you are looking to put AV on these printers good luck. AV only works if the device executes the program if the device is open to read/writes (the way a spooler would be) the AV has no way to know friend for foe so the spooler will get wiped. As far as other progs in the printer you should be fine. You are looking to protect against worms attacking your system due to the fact that these devices are not upto date? I agree this could be an issue however we all remember how childproof we made the house for the first baby. Just make sure your printers are inside the DMZ and the only ports and shares open are for printing.

It’s causing Spiceworks to report that they need an AV because one isn’t installed.

adamsmith34 · 2018-11-27T13:51:44.000Z

Robert, I agree: Anti-virus on a printer is a silly idea. That is why Spiceworks needs to fix the dashboard Security Center reporting. I don’t care if printers are running Windows Embedded or C64 Basic. It matters because the Security Center says I have a significant percentage of devices without anti-virus and the vast majority of those devices are printers. The only way to get an accurate count and address devices which actually need anti-virus is to periodically and systematically check the actual list of devices to verify there are no non-printers. This is a security issue in and of itself because I have better things to do that to validate false negatives in a report. If I don’t double check Spiceworks all the time, I risk missing a device which requires anti-virus. This really defeats the purpose of having such a report on the Spiceworks dashboard.

rockn · 2018-11-27T13:59:26.000Z

Why would you not know which devices are on your network in the first place? Are the printers not being reported as printers within their own group?

adamsmith34 · 2018-11-27T14:06:53.000Z

Rockn, it isn’t a matter of knowing what devices are on my network. It is about alerting me to anomalies. If I knew everything about my network at all times, I wouldn’t need Spiceworks. Yes, most of the printers are being reported as printers. Again, this just highlights that this is a problem with Spiceworks: Spiceworks can identify devices as printers; printers don’t run anti-virus; ergo they should be excluded from reporting, regardless of their OS.

deanmoncaster · 2018-11-27T15:19:00.000Z

im not actually sure what you are asking for.

adamsmith34 · 2018-11-27T16:10:28.000Z

deanmoncaster, this post has evolved. Perhaps a new post is in order. My goal is to not have printers marked by Spiceworks reporting as not having anti-virus which they don’t require, thereby eliminating the noise so devices which do need anti-virus can more readily be addressed. It seems some printers actually run some form of Windows. This throws off Spiceworks reporting on the status of anti-virus. I’m asking that Spiceworks resolve this contradictory reporting.

Along the lines of the original post, I have scanned two printers-- both Brothers-- using nmap and neither one has port 3389 open. These are the ports which are open:

25/tcp open smtp
80/tcp open http
443/tcp open https
515/tcp open printer
631/tcp open ipp
9100/tcp open jetdirect

and

23/tcp open telnet
80/tcp open http
443/tcp open https
515/tcp open printer
631/tcp open ipp
5080/tcp open onscreen
9100/tcp open jetdirect

As far as I can tell, the overlapping ports are 80, 443, 515, 631, and 9100. Are any of these ports a problem or should I continue to test?

jackie · 2018-11-27T17:41:41.000Z

Here is documentation on the ports we use: https://community.spiceworks.com/help/How_Does_The_Scan_Work#Port Thus, I am not sure why we are identifying those as Windows devices.

Unfortunately, Spiceworks isn’t going to be resolving this in the desktop version. The online version is more reliable at picking out ports, although AV reporting doesn’t exist yet.

State of Desktop app v8.0 Spiceworks

Hi everyone, we've been working hard on our Inventory products, but have not provided a recent update on the status of the Inventory 8.0 beta or the general future of the Desktop app (Help Desk and Inventory). Below are details around where both are headed, and how it ties into what we're working on for Help Desk and Inventory products. Inventory 8.0 beta The 2017 beta releases of Inventory 8.0 made it apparent that application performance would be a challenge for both Inventory and Help De…

I apologize I don’t have a better answer.

adamsmith34 · 2018-11-27T20:59:03.000Z

Using the information from How Does The Scan Work, I closed all services not SNMP, HTTP, or JetDirect on one of the Brother printers I scanned with nmap before. Confirming with nmap that only ports 443 and 9100 were open, I attempted to rescan it, but it didn’t work update the printer OS. I deleted the asset from Spiceworks and scanned it again (by IP address), but it didn’t create a new asset. I couldn’t reach it with BRAdmin either, but I had also disabled the Remote Setup protocol. I enabled Remote Setup protocol through the printer web console and was then able to reach it with BRAdmin. Finally, I scanned it with Spiceworks and it was added as an asset and the OS field is now blank.

The reason I chose this printer to work with was because not only did it indicate Windows OS, but it also came up as an “Http device”. For what it’s worth, I also noted that it was automatically categorized in a group from Active Directory OU information… It isn’t in Active Directory. I looked over the remaining printers which indicated Windows OS and no anti-virus. Each one was in a category associated with and Active Directory container/OU. I checked a dozen or so printers which didn’t indicate anti-virus and they did not have an Active Directory association.

My Spiceworks is connected to Active Directory, but as stated before, all of my printers are standalone and I don’t have a print server, Windows or otherwise. Furthermore, the OU/container this particular printer was associated with is a different department, so that doesn’t make sense. I suspect this is how Spiceworks was making the inference that the printer was a Windows device: In the Active Directory? Must be a user or a computer and it isn’t a user so it must be a computer.

I am going to continue to work on the other printers to disable unused services, delete them from Spiceworks, and rescan them. In the meantime, does anyone know how the erroneous Active Directory connection might have been made?

jackie · 2018-11-27T21:31:57.000Z

DNS or old entries in AD using the same name or IP address could cause erroneous lookups. I’m not familiar enough with how to troubleshoot them since I’m not an IT Pro, but I know people have experienced this before and there are threads in the Community that pertain to this type of issue.

jackie · 2018-11-27T21:39:03.000Z

I did a search for you. Here’s a few threads that may give you things to look at. Some of them are old, but the info is still relevant, I think.

Wrong OS Reporting back from Scan Spiceworks Support

We re-used an IP address from an old Windows 2000 server for a new device on our network. The nightly network scan detected the new device but has assigned it the name of the old server and the old OS 2000. Which is not reporting well with auditors. I deleted the device from the database and re-scanned - same result recognizes the new hardware and manufacture but is still giving it the name of the old Windows server and OS version. Can I manually correct the OS version some how or how do I f…

Potential DNS Errors in Inventory scan Networking

We recently upgraded our Domain from Server 2003R2 to Server 2012R2. Ever since then I get a very long list of IP Addresses from all our ranges saying "Potential DNS Errors" with "IP Address does not resolve to a hostname." This did not happen before the upgrade. We've verified our new DNS server is set up correctly, double-checked Reverse DNS, verified in NSLookup. Everything is fine on the network side but for some reason Spiceworks still reports DNS Errors. Any ideas? Do I need to wipe th…

Also, ensure you’re not using NMap in the advanced settings. This should be off by default and we may have even removed the setting in a later version (I can’t remember).