Windows 10 Weird Wi-Fi Printer Installation Issue

YouAreHere

New Member
Joined
Oct 3, 2019
Messages
5
We have a printer which we connect to over wi-fi on our home network. I tried to install the printer via the Windows 10 Add a Printer or Scanner function. Windows 10 went through what looked like the normal printer installation process, however, Device Manager was showing an error against the printer saying the device could not be used because the drivers were unsigned. This is strange because Windows 10 installed the drivers on its own.

I looked at the Event Viewer logs at the time of the printer installation and the Security log showed something on the network tried to logon to the Windows 10 Guest account on two occasions.
---------------------------
An attempt was made to query the existence of a blank password for an account.
Target account name: Guest
---------------------------
An account failed to logon
Logon Type: 3
Security ID: NULL SID
Account Name: Guest
Failure reason: Account currently disabled
Caller process name: C:\Windows\System32\rundll32.exe
----------------------------

Based on the timing, I'm guessing it was the printer that was trying to access the computer Guest account. Is this expected behavior for a wi-fi printer to try and logon to a Guest account?
 


Last edited:
Solution
A type 3 logon is a "over the network" type of access and is not SOP for a printer. Are you on an open network, or one with weak security? Seems more likely someone is on your network that probably shouldn't be.
A type 3 logon is a "over the network" type of access and is not SOP for a printer. Are you on an open network, or one with weak security? Seems more likely someone is on your network that probably shouldn't be.
 


Solution
It's months since I wrote the original post but I'd like to follow it up.
Are you on an open network
No, but sometimes it feels like it. I'm on a home network behind a firewall (it blocks inbound traffic by default). I wiped the computers and re-installed Windows and not long afterwards we got bad actors on our network again.
I've changed the router admin password as well as the WPA2 password.

Our ISP allocates us a dynamic IP address, so perhaps something on the network is phoning home to the hackers or we wouldn't have this recurring problem.

Thoughts?
 


Last edited:
Back
Top