Re: Printer rights

From: Bruce Sanderson (bsanders_at_junk.junk)
Date: 07/18/04


Date: Sun, 18 Jul 2004 16:44:36 -0700

I'm not sure I understand the situation exactly.

1. Pardon my ignorance, but I have yet to find a way to successfully create
a useable shortcut to the Printers and Faxes folder (on Windows XP), so I'd
be interested in exactly how you do that.

2. If the users are accessing the printer (shared from a server that is a
member of a domain) from their local workstation, try this approach instead:

   a. have the user issue the command:
         net use \\PrintServerName\IPC$ password /user:PrintServerUserName
/persistent:yes
   b. then the user should be able to add the printers to their workstation
as a Network Printer using the Add Printer Wizard, or "see" them in Windows
Explorer whether or not they actually have permission to use the printer by:
          i. click Start, Run, key \\PrintServerName and press Enter,
or
         ii. navigate to the Print Server computer via Network Neighborhood

3. Whether you specify the UserName or a group that the user is a member of
should not make any difference to what the user has access to. The only
caveat is that group membership is cached a logon time, so if you change
group membership after the user logs on, they have to logoff and logon again
to make use of the group membership change. Also, you don't mention it, but
if the user account is a local user account, then the group must also be
local (a local user account on computer can not be a member of domain
group).

4. With Windows, in the normal course of events, objects (e.g. printers,
shares) will be visible in Windows Explorer whether or not you actually have
permission to use that object.

-- 
Bruce Sanderson MVP Printing
It is perfectly useless to know the right answer to the wrong question.
":Patrick Bonneau" <anonymous@discussions.microsoft.com> wrote in message 
news:2d90f01c46a66$e0809c70$a501280a@phx.gbl...
> General configuration :
> windows 2000 servers Sp4 (5 with 2 actives directory)
>
> Problems: some user need to have access to specific
> printer...but they dont use our domain so we create some
> local user on terminal server...after that we put those
> users into a group called PrinterManager.  I add
> printerManager to the security of the printer on the
> terminal server.  After that I create a shortcut on user
> desktop pointing on terminal server\printers(witch is a
> target to servername::{2227A280-3AEA-1069-A2DE-
> 08002B30309D}
>
> the problem is that the user dont see the printers...even
> if they are into a group that should be able to see those
> printer....If I add the user without the group into the
> security of the printer the user see the printer....is it
> a bug or is there a way to fix this?
>
> thanks!
> 


Relevant Pages

  • Re: WindowsTokenRoleProvider & Domain Groups
    ... It looks to me that if Windows auth in ASP.NET works for you, ... just use Context.User.IsInRole to look at group membership. ... IIS vdir Directory Security is set to only Integrated Windows ... account to my domain account and leaving impersonate on. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: IsInRole & SID/Token Caching in .NET v1.1
    ... Remember also that if you update group membership on a domain, ... domain controllers, thus when you restart your service (login the ... > I'm building will be used by ASP.NET apps and also by Windows Services. ... > WindowsIdentity from the target UPNName, ...
    (microsoft.public.dotnet.security)
  • Re: Single OU limitations
    ... there could be issues with group membership. ... In Windows 2000 it ... limitation is removed in W2k3. ... I've w2k3 sp1 ent. ...
    (microsoft.public.windows.server.active_directory)
  • Re: General questions about LDAP, GC and access permissions
    ... using Windows Communicaiton Foundation, ... is that we get a combination of all permissions that may be directly assigned ... users and groups and assigning various permissions to those. ... calculate a user's group membership in the user's logon token. ...
    (microsoft.public.windows.server.active_directory)