September 2026 Patch Breaks Shared Printing on Server 2022: How RMM Turns a Fleet-Wide Print Outage Into a 30-Minute Fix

It's the morning after Patch Tuesday. You log in, and the helpdesk queue is already on fire: "can't print," "printer offline," "nothing comes out at the front desk." Then someone from finance — working on the terminal server — adds the worst one: nobody in any session can print.

This is exactly what Windows administrators are reporting after the September 2026 updates: KB5122882 breaks shared printing across Windows Server 2022, Windows 10, and Windows 11. Shared print queues running Type 3 printer drivers fail, and Remote Desktop Session Hosts take the hardest hit — every user in every session loses printing at once. Microsoft has shipped an out-of-band update (KB5129237), but as of this writing, the printing regression isn't listed as a known issue for either KB.

Here's the uncomfortable part: if your monitoring stack only watches "server up, spooler service running," it will stay green through this entire outage — and you'll learn about it from an angry user, not your tools. Fixing it the traditional way means RDP-ing into server after server, checking queues one at a time. There's a better way, and it's the reason RMM exists.

The Problem in Depth: Your Tools Say Green, Your Users See Red

Monitoring watches the wrong signals

Traditional infrastructure monitoring misses print failures almost by design:

• The spooler service is running — check.
• The server responds to ping, disk is fine, CPU is idle — check, check, check.

But a broken Type 3 driver interaction doesn't necessarily crash the spooler. Jobs silently stick in the queue. Client-side rendering fails on shared connections. On RDS Session Hosts, printer redirection fails at logon. Every dashboard metric is green; every user in the building is walking to the one printer that still works.

Fragmented tooling turns one incident into a fire drill

Now watch what happens in the average IT shop, where monitoring, patching, helpdesk, and RMM live in four disconnected products:

• The monitoring console says all systems operational — it only sees service state and hardware metrics.
• The patch tool proudly reports "KB5122882 deployed successfully to 214 endpoints" — installation completed without errors, so it flags nothing.
• The helpdesk collects 47 "can't print" tickets, but nothing correlates them with last night's patch wave.
• The RMM tool — if it's a separate product — has exactly the remote scripting you need, but nobody has connected "we patched 214 machines last night" to "the estate stopped printing this morning."

So the diagnosis happens manually: a tech RDPs into the print server, restarts the spooler, prints a test page. Then the next server. Then discovers the RDS hosts are involved. Then tries to reconstruct from memory — or from a different console — which machines even got the bad patch. Twenty minutes per server, times every print server and session host you run.

What it costs in numbers

Take an MSP with 30 client sites — a print server or shared queues at each, plus two clients on RDS farms. Manual triage burns 15–25 minutes per affected server before remediation even begins; that's a full technician-day across the estate. Meanwhile:

• Every minute without printing at a logistics client stops shipping labels. At a clinic, it stops prescriptions and intake forms.
• Ticket volume spikes 5–10x over baseline, drowning unrelated issues and stretching every SLA.
• Because Microsoft hasn't acknowledged the regression, your techs debug blind — vendor KBs are silent, and the real intel is scattered across forums and the 4sysops report.
• The post-incident review turns into "why didn't monitoring catch this?" — an unfair question with an honest answer: the tools were never connected.

The root gap is architectural. No single system can answer the only question that matters: "Which machines got the bad patch, which of them serve shared print queues, and how do I fix all of them right now?"

How AlertMonitor Solves It: One Timeline From Alert to Fix

AlertMonitor collapses monitoring, RMM, helpdesk, and patch management into one platform with a single device inventory — and that changes every step of this incident.

1. Detect printing as a monitored service, not a helpdesk rumor. Because AlertMonitor's script engine lives inside the monitoring platform, you can promote a PowerShell check into a scheduled monitor: enumerate shared queues and their driver types, flag stuck jobs, verify the spooler actually renders. When it fails, AlertMonitor alerts — often hours before the ticket flood.

2. Scope the blast radius in minutes. Run one script across the device group "All Windows Servers" (or every Windows endpoint if needed). It returns which machines have KB5122882 installed and which expose shared Type 3 queues. Results feed straight into each device's timeline — the same place the alerts and tickets already live. No tab-switching, no spreadsheets.

3. Remediate remotely, in bulk, with an audit trail. From the same console: push a spooler-restart and queue-clear script, uninstall the offending KB on print servers, or deploy the out-of-band KB5129237 the moment you approve it. Every action — automated or manual — lands on the device timeline, so your post-incident report writes itself.

4. Close the loop in the helpdesk. Those 47 "can't print" tickets link to the same incident and the same devices. When the fix lands, one bulk reply updates every affected user from the same window the tech used to push the fix.

5. Stop the next one with patch rings. AlertMonitor patch management lets you ring deployments: print servers and RDS hosts go in a slow ring with a script-based health check as the gate. The next regressive update gets caught on 5 machines, not 214.

Old way: 6 hours, 4 tools, 3 technicians, and a war room. AlertMonitor way: one alert, one device-group script, one bulk remediation, one helpdesk blast. Detection-to-resolution drops from half a day to under 30 minutes.

Practical Steps: Triage the September 2026 Print Breakage Today

Step 1 — Find out which machines have the bad KB

Run this across your device groups from AlertMonitor's script engine; every result is recorded per endpoint:

# Check for the September 2026 updates
$kbList = 'KB5122882', 'KB5129237'
Get-HotFix |
    Where-Object { $kbList -contains $_.HotFixID } |
    Select-Object PSComputerName, HotFixID, Description, InstalledOn

Step 2 — Assess print health on print servers and RDS hosts

"Spooler: Running" means nothing here. Look at the queues and drivers:

# Flag shared queues and their likely driver type (Type 3 is the problem class)
Get-Printer |
    Where-Object { $_.Shared } |
    Select-Object Name, DriverName, PrinterStatus,
        @{n = 'DriverType'; e = {
            if ($_.DriverName -match 'V4|Class Driver') { 'Type 4' }
            else { 'Likely Type 3' }
        }} |
    Format-Table -AutoSize

# Count stuck jobs older than 15 minutes
Get-PrintJob |
    Where-Object { $_.JobStatus -match 'Error|Retained' -or
        ((Get-Date) - $_.SubmittedTime).TotalMinutes -gt 15 } |
    Group-Object PrinterName |
    Select-Object Name, Count

Step 3 — Try the non-destructive workaround first

On affected hosts, recycle the spooler and clear jammed queues without touching the driver stack:

Stop-Service -Name Spooler -Force
Start-Sleep -Seconds 3
Remove-Item -Path "$env:SystemRoot\System32\spool\PRINTERS\*" -Force -ErrorAction SilentlyContinue
Start-Service -Name Spooler

If queues jam again immediately, the patch/driver interaction is the cause — move to rollback.

Step 4 — Roll back the offending update on critical print infrastructure

On print servers and RDS Session Hosts where printing is business-critical, remove KB5122882 and reboot in a maintenance window:

# Requires elevation
wusa /uninstall /KB:5122882 /quiet /norestart

# If wusa refuses (SSU/LCU combos sometimes do), find and remove via DISM:
dism /online /get-packages | Select-String 'KB5122882'
# dism /online /remove-package /packagename:<Package_for_RollupFix_name> /quiet /norestart

# Confirm removal and reboot in the window you promised the business
Get-HotFix -Id KB5122882 -ErrorAction SilentlyContinue
Restart-Computer -Force

Once Microsoft's out-of-band KB5129237 is validated in your test ring, redeploy it through AlertMonitor patch management — print-server group first, then the rest of the estate.

Step 5 — Make printing a monitored service going forward

Promote a test-page render into a scheduled script check in AlertMonitor. The core check:

# Submit a test page to a shared queue and verify the spooler accepted it
$printer = '\\printserver01\Finance-HP4515'
Start-Process -FilePath 'rundll32.exe' -ArgumentList "printui.dll,PrintUIEntry /k /n `"$printer`"" -Wait
if ((Get-Service -Name Spooler).Status -ne 'Running') {
    Write-Output 'FAIL: Spooler not healthy after test page'
    exit 1
}
Write-Output 'OK: test page submitted, spooler healthy'
exit 0

Schedule it every 30 minutes against your print servers and RDS hosts in AlertMonitor. The next silent printing failure becomes a 30-minute-old alert with the device, the queue, and the ticket already linked — not a Monday-morning user revolt.

The Takeaway

You can't prevent a vendor from shipping a printing regression, or from forgetting to list it as a known issue. What you control is the distance between first failure and fleet-wide fix. If that distance is measured in RDP sessions and desk walks, patch day wins every time. If it's measured in one device-group script and one bulk remediation — with patch state, alerts, tickets, and the fix on a single timeline — you win quietly, before most users notice.

That's what RMM is for. That's the whole point.

Related Resources

AlertMonitor RMM & Remote Management AlertMonitor Platform Overview Book a Demo RMM & Remote Management Resources