Re: Prevented from adding users

Yes the same policy, but disabling will allow the clients to make a
connection without the (there is a policy in affect...) message. Does this
happen for all printers you attempt to make a connection or only some
printers?

If the issue now is the "you do not have sufficient access" message then the
clients are getting past the Trusted Server policy and are now hitting a
problem when installing the driver?

What model is the printer?

Setup a machine where users have write access to \windows\system32\spool
and subdirectories and see if the user can connect.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

"Alex" <Alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C59AF275-0F93-4E52-A7D6-649B10FC6BD8@xxxxxxxxxxxxxxxx
Disabling the policy has not resolved the problem. Is it the sam policy
setting I should configure my print server name?

The "you do not have sufficient access" error message only appears on Win
XP
since when I´m logged on to the server I´m logged on as administrator.

"Alan Morris [MSFT]" wrote:

Did disabling the policy in the domain GPO (or configuring it with your
print server name) correct the issue?

If the "sufficient access" message is on Server 2003 machine when the
user
is logged on that's a policy setting.


Without stepping through the debugger on this I am unsure why the client
domain access check is failing.

You can get around all this by using drivers that ship in XP or install
the
drivers on te clients before making the connection.
you can use the wmi print scripts to accomplish this remotely but the
driver
files need to be copied to the client unless you enabled delegation in
your
domain (I'm unsure how to do the delegation thing since I don't get admin
right to the MS domain).

md \\remotemachine\c$\drivers
copy \\path\to\driverfiles\* \\remotemachine\c$\drivers
prndrvr.vbs -a -m "model name of printer" -v 3 -e "Windows NT x86" -h
c:\drivers -i c:\drivers\driver.inf -s remotemachine

This why the client does not have to copy the driver from the "untrusted"
server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

"Alex" <Alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:5F505756-2DCC-462F-8D24-BDFD790FA605@xxxxxxxxxxxxxxxx
No clusters, missed that question!
I also receive the error message "You do not have sufficient access to
your
computer to connect to the selected printer" on some machines.

"Alan Morris [MSFT]" skrev:

Can the user make the connection by opening the remote machine (START,
Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you
get
the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting
for
the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

"Alex" <Alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:0CA625DF-2493-4AF2-9023-65CFC394E3C2@xxxxxxxxxxxxxxxx
Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

"Alex" <Alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8641BBD2-ADB6-4E0A-BB64-F711C5E0ED4C@xxxxxxxxxxxxxxxx
I have checked the default settings on my server 2003 and XP
client.
On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server
and
"point
and print restrictions" to disabled to allow connecting to any
server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing
printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can
connect
to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted
to
only
point and print to a server within its own forest, and/or to a
list
of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to
allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point
and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers
no
rights.

"Alex" <Alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:6D8B73C6-73DD-4303-815A-1E8E1033E1D5@xxxxxxxxxxxxxxxx
Hello and thanks for your reply.
I have checked all policy setting regarding printers in the
domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver
addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with
a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP
clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and
confers
no
rights.

"Alex" <Alex@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:B17F9CD1-A152-47F6-8A95-609C60A3DAEF@xxxxxxxxxxxxxxxx
I have a 2003 server as a printserver, with a printer
shared.
When users try to add the printer the receive a message
saying
either
"You
do not have sufficient security privileges to install
hardware
on
this
computer. Please contact your site Administrator, or logout
and
log
in
again
as an administrator and try again. " (WINXP clients) or "A
policy
is
in
effect on your computer which prevents you from connecting
to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing
drivers
or
adding
printers etc. What can I do?

















.

Relevant Pages

  • Re: Prevented from adding users
    ... Is the print server a cluster. ... But that should not matter if the policy is disabled. ... clients). ... The policy setting applies only to non Print ...
    (microsoft.public.windowsxp.print_fax)
  • Re: Prevented from adding users
    ... Did disabling the policy in the domain GPO (or configuring it with your ... If the "sufficient access" message is on Server 2003 machine when the user ... Without stepping through the debugger on this I am unsure why the client ... This policy setting restricts the servers that a client can connect ...
    (microsoft.public.windowsxp.print_fax)
  • Re: NETLOGON SERVICE STOPPED EVERYTIME I RESTART THE SERVER
    ... > clients can not logon, clients XP they logon to ... > server, Actullay they can not even browse" SERVER IS ... First check the domain or domain controller security policy to see what the ...
    (microsoft.public.windows.server.dns)
  • Re: Prevented from adding users
    ... Win2k is not affected by either policy. ... On Server 2003 launch secpol.msc ... The policy setting applies only to non Print Administrators ... You should not have any problem with Win2k clients. ...
    (microsoft.public.windowsxp.print_fax)
  • Re: Prevented from adding users
    ... "A policy is in effect on your computer which prevents you from connecting ... and print restrictions" to disabled to allow connecting to any server. ... The policy setting applies only to non Print ... and only to machines that are members of a domain. ...
    (microsoft.public.windowsxp.print_fax)