Ricoh SMB scan works but print fails — AES signing mismatch

Hi! I can help you troubleshoot the exact scenario you described: Ricoh SMB scan works but print fails, especially when it lines up with SMB signing / AES signing changes on Windows (hardening policies, updates, or new server builds).

I’m going to keep the *final “make it work” change* gated for live chat (because the safe fix depends on your environment and the wrong change can weaken security or break other devices), but I will walk you through a solid diagnostic path here so you can identify what’s actually failing.

People search this issue in a lot of long-tail ways — I’ll naturally cover them in our messages so the page matches real searches:
• scan to SMB works but can’t print to Ricoh
• print jobs stuck in queue / “spooling” forever after security hardening
• SMB signing required breaks printer share / print server connectivity
• AES signing cipher mismatch (SMB 3.1.1 signing negotiation issues)
• Windows 11 / Server 2022 SMB signing changes impacting older firmware or print paths

First, tell me your layout (this is the “map” that decides which checks matter):
1) Are you printing direct TCP/IP (port 9100/IPP) or via a shared printer like \\SERVER\\Ricoh (print server / SMB share)?
2) What Windows versions are involved (Windows 11 clients? Windows Server 2019/2022 file/print server?)
3) What exactly “fails” on print: error popup, stuck jobs, “access denied,” or “cannot connect to printer”?

Your answers tell me whether this is a SMB signing policy conflict, a credential/auth (Kerberos/NTLM) problem, or a print spooler path problem.

That’s a very “real-world” clue: scan-to-folder works but printing fails after hardening often means the scan path and print path are using different protocols and trust assumptions.

Why? On many setups:
• Scanning to SMB share = the Ricoh is the SMB *client* connecting outbound to a file server on TCP 445 using stored credentials in the address book.
• Printing via \\SERVER\\PrinterShare = your PCs are SMB *clients* pulling drivers/printing through a print server / shared queue — and Windows policies like “Digitally sign communications (always)” can change what is allowed.

When someone says “AES signing,” they’re usually referring to SMB 3.x signing algorithms (for example AES-based signing like AES-CMAC and newer variants on SMB 3.1.1). If the client/server negotiate a mode the other side can’t handle (or if signing is required in one direction but not supported in another), the symptom can look like “printing is broken,” even though scanning is fine.

Quick pinpoint questions (these decide the branch):
1) Are you printing through a Windows print server (shared printer / Point and Print), or is each PC printing directly to the Ricoh’s IP address?
2) Did the hardening include changes to SMB signing policies, disabling older SMB, or enforcing stronger crypto?
3) What driver type are you using (Ricoh PCL6 / PostScript, Type 3 vs Type 4)?

Perfect — this is the classic environment where a mismatch shows up: Windows 11 clients + Server 2022 print server + policy that forces SMB signing.

Here’s why it can be confusing (and why people Google “Ricoh SMB scan works but print fails — AES signing”): scanning success makes it feel like “SMB is fine,” but printing via \\PRINTSERVER\\queue is a different SMB relationship with different policy scopes (client vs server).

Common “looks-like-AES-signing” symptoms in this layout:
• Clients can browse the share but printer connection fails or reverts after reconnect
• Print jobs show spooling then vanish, or stay “Error” with a generic message
• Event logs mention signing, authentication, or session setup failures (often not user-friendly)
• It works for some PCs but not others (because of mixed policies, cached creds, or Kerberos vs NTLM differences)

Two important related keywords to keep in mind (and to check in diagnostics):
Kerberos vs NTLM (UNC path access and signing behavior can differ), and SMB 3.1.1 signing negotiation (cipher selection can change depending on OS and settings).

Before we touch anything: do you see errors like “Windows cannot connect to the printer,” “Access denied,” or just silent failure/stuck queue? And is the failure happening for all shared queues or only the Ricoh?

If other shared printers work but the Ricoh share fails, that points away from “SMB is totally broken” and more toward a Ricoh-specific combination like:
• driver package / Point and Print behavior
• how that queue is published / permissions / UNC hardening
• how the Ricoh port is configured on the print server (RAW 9100 vs IPP vs WSD)
• or a policy interaction that impacts this queue more than others.

Where “AES signing” still fits: organizations often enable policies that require signing on the client side and/or server side. If you have a mix of settings (client requires signing, server only “if client agrees,” or vice versa) you can see inconsistent results. Microsoft’s SMB signing policies are split into “Microsoft network client” and “Microsoft network server” settings — and it matters which role your print server is playing for the printer share connection.

I don’t want you to flip security switches blindly, so here are safe, non-destructive checks you can do now:
1) Confirm the failing path is truly \\PRINTSERVER\\Ricoh and not direct IP printing.
2) Check if the Ricoh share requires re-auth (credential prompts, cached creds, or NTLM fallback).
3) Note whether it fails only after reboot/policy refresh (often signals a GPO/security option).

Also: are you using the Ricoh’s Web Image Monitor for configuration, and do you know the Ricoh model/firmware family (IM Cxxx, MP Cxxx, etc.)?

Thanks — IM C-series + Server 2022 print server usually means the printer itself is fine, but the server-client negotiation (policies + driver + spooler + ports) is where it breaks.

Here are the most common “clusters” for your symptom (I’m wording these with related SEO phrases because this page is meant to catch the exact searches):

Cluster A — SMB signing policy mismatch
“SMB signing required” + “printer share connection fails” + “Windows 11 can’t connect to shared printer” can happen when client/server signing policies are out of alignment. This can also show up after CIS hardening or enabling Digitally sign communications (always) on either the client or server side.

Cluster B — UNC / Point and Print hardening side-effects
If driver distribution or trust settings changed, the client may “connect” but fail to fully install/use the queue consistently (especially with Type 3 packages). People often see “it works once, then breaks,” or “connects but won’t print.”

Cluster C — Print spooler / port / protocol mismatch
The print server might be fine but the Ricoh port or protocol can be sensitive when tightened firewall rules or service policies changed (RAW 9100, IPP, WSD). This is why it’s possible for scan-to-folder SMB to work while print path fails — they’re not the same port or service.

If you open the live chat, I’ll ask for 3 screenshots/log snippets (non-sensitive) that let me identify which cluster you’re in within minutes.

100% agreed — the goal is keep signing and fix the print path correctly. Here’s a “safe-only” checklist that doesn’t require turning security off.

Safe checklist (no policy changes)

1) Confirm the print connection type
On a failing Windows 11 PC, check whether the printer is connected as a shared queue (\\PRINTSERVER\\Ricoh) or “direct TCP/IP.” Shared queues are the ones affected by SMB-related hardening and driver distribution behaviors.

2) Identify where the job stalls
Does it fail at “Connecting to printer,” at driver install, or after the job is sent (stuck in queue)? Those are three different problems with different fixes.

3) Compare a working vs failing machine
If one PC prints and another doesn’t, compare: driver type (Type 3 vs Type 4), whether it used Kerberos vs NTLM to reach the server, and whether it’s on the same OU/GPO set. This is often where the “SMB signing / AES signing” clue becomes obvious.

4) Check print server logs (non-invasive)
On Server 2022, look for print spooler / SMB session related errors during the exact time you attempt a print. (In live chat, I’ll tell you exactly what event IDs/locations matter for your case without you hunting.)

5) Confirm the Ricoh’s backend port/protocol
On the print server, the Ricoh queue may use RAW 9100, IPP, or WSD. If hardening impacted firewall rules or services, one protocol can fail while others still work.

This checklist usually narrows it to one of the clusters I mentioned — and then we can apply a targeted fix that keeps SMB signing intact.

Great question — and it’s exactly why this issue gets mislabeled as “printer firmware can’t do AES signing.”

In your specific layout (Windows 11 clients → Server 2022 print server → Ricoh over a printer port), the Ricoh usually isn’t negotiating SMB signing directly for printing. The SMB signing/AES signing part is more about the Windows client-to-server connection for the shared printer (and sometimes for driver/package retrieval), not the server-to-printer print data path.

However, Windows 11 / Server 2022 do have modern SMB 3.1.1 capabilities and negotiate stronger signing/encryption options depending on policy. If your hardening requires signing and also changes how sessions are established (Kerberos vs NTLM, UNC hardening rules, blocking legacy behaviors), it can indirectly cause printer-share failures that *look* like an “AES signing mismatch.”

Related phrases users search that map to this exact confusion:
• Windows 11 SMB signing breaks printer sharing
• Server 2022 print server shared printer not working
• SMB 3.1.1 signing AES-128-GMAC / AES-CMAC
• Kerberos required for UNC path / “don’t connect via IP address”

The reason I’m not dropping a one-size-fits-all “turn X off” answer: some orgs need signing for compliance, and there are safe ways to resolve printer-share failures without weakening security — but they depend on your exact policies and how the queue is configured.

Bring these 6 items (they’re fast to collect, and none require changing security settings):

What to bring to live chat (fast diagnosis)
1) The exact printer connection path used on clients (example: \\PRINTSERVER\\Ricoh-3F).
2) Whether the client fails at connect/install or fails at printing after it’s connected.
3) A screenshot of the printer queue status (job stuck at “Spooling/Printing/Error”).
4) The Ricoh model family (IM Cxxx) + whether you’re using PCL6 or PostScript driver package.
5) The print server OS (Server 2022 confirmed) and whether the queue is Type 3 or Type 4.
6) Any recent hardening notes: “SMB signing required,” UNC hardening, changes to NTLM/Kerberos, firewall rules.

With those, I can tell whether this is truly a SMB signing policy mismatch, a driver/trust distribution problem, or a spooler/port issue — and then give a minimal, safe fix plan (keeping your signing requirements intact).

Open the chat whenever you’re ready and paste those details.

That’s the right goal — and it’s achievable. In paid chat we’ll focus on the smallest change that restores shared printing without relaxing security: we validate which signing requirements apply (client vs server), confirm whether the printer share is triggering NTLM fallback, and verify the Ricoh queue’s driver/port settings on Server 2022 so print jobs stop failing.

To move forward: Open the chat and share the 6 items above. I’ll guide you step-by-step and keep everything aligned with SMB signing/AES signing best practices.