Server:
Windows 2008 R2 SP1 + current windows updates.
Xerox GPD PS 5.303.16.0

Clients:
Windows 7 x64 SP1 + current windows updates
Windows XP SP3
GPO with Point and Print restrictions enabled.
Users utilize Point and Print.

Problem:

Was examining a client's PrintService/Admin event logs and noticed some reoccurring entries stating the Xerox global print driver failed to install due to invalid signature, Error code= 800f024b.   Upon checking the actual .dll versions present in \\PCNAME\c$\Windows\System32\spool\drivers\x64\3\, they DID match the version on the print server.  Odd why Windows would then be complaining about a failed driver install?

Other vendors UPDs (HP, Ricoh, etc) have not logged this error. The Xerox UPD is PackageAware.

Details:

Event logs:

Log Name:      Microsoft-Windows-PrintService/Admin
Source:        Microsoft-Windows-PrintService
Date:          7/10/2013 10:56:32 AM
Event ID:      600
Task Category: Client-side rendering
Level:         Error
Keywords:      Client Side Rendering (CSR),Classic Spooler Event
User:          SYSTEM
Computer:      PCNAME.MyDomain
Description:
The print spooler failed to import the printer driver that was downloaded from \\PRINTSERVER\print$\x64\PCC\ntprint.inf_amd64_neutral_e758378b95b6b97a.cab into the driver store for driver Xerox Global Print Driver PS. Error code= 800f024b. This can occur if there is a problem with the driver or the digital signature of the driver.
------------------
Log Name:      Microsoft-Windows-PrintService/Admin
Source:        Microsoft-Windows-PrintService
Date:          7/10/2013 10:56:32 AM
Event ID:      601
Task Category: Client-side rendering
Level:         Error
Keywords:      Client Side Rendering (CSR),Classic Spooler Event
User:          DOMAIN\USER
Computer:      PCNAME.MyDomain
Description:
The print spooler failed to download and import the printer driver from \\PRINTSERVER into the driver store for driver Xerox Global Print Driver PS. Error code= 800f024b.

Checking the contents of \\PRINTSERVER\print$\x64\PCC\ntprint.inf_amd64_neutral_e758378b95b6b97a.cab, it's just the PostScript and ntprint.inf files. There is nothing related to Xerox.  Odd.

Digging into \\PCNAME\c$\Windows\inf\setupapi.dev.log, one finds more details about the exact failure is due to 'UNIRES.DLL'.

>>>  [Import Driver Package - C:\Windows\system32\spool\{FA90EB76-242F-4150-A362-3A8FBB37DB2F}\ntprint.inf]
>>>  Section start 2013/07/10 10:56:27.591
      cmd: C:\Windows\System32\spoolsv.exe
     sto: Importing driver package into Driver Store:
     sto:      Driver Store   = C:\Windows\System32\DriverStore (Online | 6.1.7601)
     sto:      Driver Package = C:\Windows\system32\spool\{FA90EB76-242F-4150-A362-3A8FBB37DB2F}\ntprint.inf
     sto:      Architecture   = amd64
     sto:      Locale Name    = neutral
     sto:      Flags          = 0x0000000C
     sto: Copying driver package files to 'C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}'.

<snip>

     flq: {_commit_file_queue exit OK}
     pol: {Driver package policy check} 10:56:30.555
     pol: {Driver package policy check - exit(0x00000000)} 10:56:30.555
     sto: {Stage Driver Package: C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}\ntprint.inf} 10:56:30.555
     inf:      Opened INF: 'C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}\ntprint.inf' ([strings])
     inf:      Opened INF: 'C:\Windows\TEMP\{404a24de-0f2d-46a2-c9da-a30e91dcbd0d}\ntprint.inf' ([strings])
     sto:      Copying driver package files:

<snip>

     flq:      {_commit_file_queue exit OK}
     sto:      {DRIVERSTORE_IMPORT_NOTIFY_VALIDATE} 10:56:32.614
     inf:           Opened INF: 'C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.inf' ([strings])
     sig:           {_VERIFY_FILE_SIGNATURE} 10:56:32.614
     sig:                Key      = ntprint.inf
     sig:                FilePath = C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.inf
     sig:                Catalog  = C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.cat
     sig:                Success: File is signed in catalog.
     sig:           {_VERIFY_FILE_SIGNATURE exit(0x00000000)} 10:56:32.645
     sto:           Validating driver package files against catalog 'ntprint.cat'.
!!!  sto:                Failed to verify file 'UNIRES.DLL' against catalog. Catalog = ntprint.cat, Error = 0xE000024B
!!!  sto:                Catalog did not contain file hash. File is likely corrupt or a victim of tampering.
!!!  sto:           Driver package appears to be tampered. Filename = C:\Windows\System32\DriverStore\Temp\{5ded2c15-82b3-44c9-c959-633d5454fb33}\ntprint.inf, Error = 0x800F024B
!!!  sto:           Driver package appears to be tampered, and it will not be installed.
!!!  ndv:           Driver package failed signature validation. Error = 0xE000024B
     sto:      {DRIVERSTORE_IMPORT_NOTIFY_VALIDATE exit(0xe000024b)} 10:56:32.661
!!!  sto:      Driver package failed signature verification. Error = 0xE000024B
!!!  sto:      Failed to import driver package into Driver Store. Error = 0xE000024B
     sto: {Stage Driver Package: exit(0xe000024b)} 10:56:32.661
!!!  sto: Failed to stage driver package to Driver Store. Error = 0xE000024B, Time = 2200 ms
<<<  Section end 2013/07/10 10:56:32.677
<<<  [Exit status: FAILURE(0xe000024b)]

As the Event Log entry stated (and the translated error code in http://answers.microsoft.com/en-us/windows/forum/windows_other-windows_update/error-code-800f024b/19fcf1e0-56be-4eef-a2bf-54f22f1a764f) 0x800F024B = SPAPI_E_FILE_HASH_NOT_IN_CATALOG. 

I can only find really old versions of Winerror.exe and err.exe, neither which contain 0x800F024B SPAPI_E_FILE_HASH_NOT_IN_CATALOG; where does one find updated versions of these tools? Or is there a better location to translate error codes these days?

Why doesn't ntprint.cat contain the correct hash for UNIRES.DLL?

Little bit more info. 

We have two print servers, PROD and TEST.  TEST is always running the latest drivers from each vendor.  I compared the ntprint.inf_amd64_neutral_e758378b95b6b97a.cab between the two servers and they have different SH1 & MD5 hashes.  Extracted the contents of both and compared the files. The only thing which is different was ntprint.PNF.  What's this file do besides "precompiled setup info"?

Also compared \\PROD-PRINTSERVER\print$\x64\3\unires.dll to \\TEST-PRINTSERVER\print$\x64\3\unires.dll.  Both are file version 0.3.7601.17514. However PROD date modified is 11/20/2010 (as it should be per http://support.microsoft.com/kb/969744) but TEST date modified is 5/10/2013 AND is digitally signed by Hewlett-Packard Company.  What the heck?

Very odd.  I'll pass this along to one of the Program Managers that deals with vendors.  HP could be redistributing the package and touching the file.

you are looking for this? 

C:\>winerror 0x800f024b
-2146500021 SPAPI_E_FILE_HASH_NOT_IN_CATALOG <--> No NTSTATUS matched

Thanks Alan.   Most interested in the 0x800f024b error.  The HP signed file is just an unrelated bonus to this troubleshooting ;)

Ah yes, now I see my error with winerrror utilization. Never seems clear when one should use search using the full or partial error code to properly diagnose the underlying issue logged; I had searched for just 800F024B.

Q:\>winerror 0x800F024B
-2146500021 SPAPI_E_FILE_HASH_NOT_IN_CATALOG <--> No NTSTATUS matched

Q:\>winerror 800F024B
   800 ERROR_OPLOCK_SWITCHED_TO_NEW_HANDLE <--> 0x00000215 STATUS_OPLOCK_SWITCHED_TO_NEW_HANDLE

For others wondering, newer versions of winerror.exe are distributed in the WinDDK tools.

Is there a newer version of err.exe? The only one I can find on MS is dated from 2004. Or should it not be used any more?

HP does have redistribution rights to a recent NTPRINT package.  I do not think this includes code modification.  The gentlemen I spoke postulated stated the current package is a Windows 8 version which does not match the version you stated.

If one deletes the cab file

\\PRINTSERVER\print$\x64\PCC\ntprint.inf_amd64_neutral_e758378b95b6b97a.cab

The next time a client needs the file or the spooler is restarted, the cab file will be regenerated from the driverstore location not \x64\3.

PNF versions of the INF can be parsed quicker than the text version.

I think err.exe will also work with HResults but I typically do not use this tool.

Yes, I can confirm that deleting ntprint.inf_amd64_neutral_e758378b95b6b97a.cab, and cycling the spooler, results in a new one being generated.  I backed up the old one just in case. The hashes between the old and differ with once again, with ntprint.PNF being the only difference.

Using a separate Win7 workstation I tested successful driver download and Point and Print printing. It too logged the same Error code= 800f024b for the Xerox Global Print Driver PS.

Also noticed the following WER entry related to this failure was created (in case it helps the printing team pinpoint).

Log Name:      Application
Source:        Windows Error Reporting
Date:          7/26/2013 3:18:43 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      PC.MyDomain
Description:
Fault bucket 2223412205, type 5
Event Name: PnPDriverImportError
Response: Not available
Cab Id: 0

Problem signature:
P1: x64
P2: E000024B
P3: ntprint.inf
P4: f0801f86992721a95cc51806211aae8e15b4b85f
P5: 
P6: 
P7: 
P8: 
P9: 
P10: 

Attached files:
C:\Windows\Temp\DMI1879.tmp.log.xml
C:\Windows\System32\spool\{50EAA7E7-7D4C-453B-ABB9-0AC2A273178C}\ntprint.inf

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\NonCritical_x64_fef418eda491bed8e4ba36ff3f11e2260546cde_1823194d

Analysis symbol: 
Rechecking for solution: 0
Report Id: 544bede1-f641-11e2-98ab-9c8e99c9db6d
Report Status: 0

Does this block the client connection or just an oddity you are seeing in the event logs?

Appears to just be an oddity... well actually cannot 100% validate the document printed as the rooms with these printers are now locked :-/  but at least according to Windows they printed successfully.