How can I get rid of the "Do you trust this printer" message box and add my printer via GPO?

The "fix" is to download trusted, package-aware print drivers from the printer manufacturer; however, since not all manufacturers will produce these drivers, there is a work around that I found here: Cannon Forum - Package-Aware Print Drivers (Note: This does not work for unsigned drivers, but there are plenty of tutorials out there for self-signing a print driver.)

Here are the steps to get around the issue:

1. Install the required drivers on the print server
2. Note any drivers that have "false" listed under the "Packaged" column. All of these will have to be modified to deploy via Group Policy.
3. Edit the registry on your print server and go to the following locations:
   • For 64-bit drivers: HKLM\System\CurrentControlSet\Control\Print\Enviroments\Windowsx64\Drivers\Version-X\{Driver Name}
   • For 32-bit drivers: HKLM\System\CurrentControlSet\Control\Print\Enviroments\Windows NT x86\Drivers\Version-X\{Driver Name}
   • Where "X" is the print driver "Type", usually either "3" or "4"
4. Edit the key named "PrinterDriverAttributes" by adding 1 to whatever value is currently set. (Example: if the current value is "6", change it to "7".) This will make the print server believe that these drivers are packaged.
5. Do this for every driver that is not listed as a "Packaged" driver.
6. Restart the print server.
7. Everything should now deploy through Group Policy (provided you have all the usual GPO settings configured correctly).

I am in the process of deploying this fix myself; however, since it requires a restart of the print server I cannot test it until this evening since our print server also runs a few networked applications.

An alternate solution to the registry edit is to edit the printer driver INF file and add the following:

For 32-bit drivers:

[PrinterPackageInstallation.x86]
PackageAware=TRUE

For 64-bit driver

[PrinterPackageInstallation.amd64]
PackageAware=TRUE

If you decide to edit the INF file, it'll be easier to remove the driver from the print server, edit the INF file from a clean download, and then install the edited driver.

Aside from this, double check the Group Policy settings for Point and Print Restrictions and Package Point and print - Approved Servers.

Background Info

Microsoft Security Bulletin MS16-087 detailed a security issue where a rogue print server could inject malicious code through a "man in the middle" style attack. Security update KB3170455 was issued on July 12, 2016 to fix it, which then messed with the distribution of print drivers from the print server.