Re: Cannot install new printer drivers

Martin,

I had to use Google Groups to find old posts that I had deleted, but I got
the information I needed.

I do think it is Explorer that is getting the access denied error, as this
is the process hosting the Add Printer Wizard. It must go through the
AddPrinterDriver and AddPrinter Winspool APIs. So if the Print Spooler
service or any components it is using is compromised in any way, it could
cause failure here. So I would advise deleting all the stuff the Print
Spooler service might be using with this Cleanspl utility, then try again.
It will delete the Brother driver that may have started this all, for one
thing.

http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

In Process Monitor, you probably don't need to be concerned with NOT FOUND
messages, only ACCESS DENIED messages. You may post the log here if you want
us to examine it, noting the approximate time of failure.

Paul

"Martin Brilliant" <MartinBrilliant@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:2B590A80-90CD-42B6-8AC1-956CE26CB7E6@xxxxxxxxxxxxxxxx
Paul,

To avoid repeating myself: "what changed" is described in the first post
in
this thread. Permissions in the folder you asked about are covered in the
third post (my second post), but briefly, I can read/write/delete in that
folder.

I looked up auditing of events on the web and it seems to involve group
policies and local security policy, neither of which exist in Win XP Home.

I downloaded and ran Process Monitor (which supersedes File Monitor and
Registry Monitor in Win XP) from Sysinternals. A lot of other processes
are
active: svchost, mozybackup, nprotect, winlogon, . It seems that
explorer.exe
is doing all the work of installing the printer driver. There are a lot of
SUCCESSes and a few other things, but the non-SUCCESSes look as though
they
might be intended to find something if it's there, or to make sure it's
not
there, so I can't say I've found a smoking gun.

It would help if I could identify to the microsecond when the installer
declares failure, so I could know where to look in the Process Monitor
output. What's the process that sets up the Access denied message?

"Paul Baker [MVP, Windows - SDK]" wrote:

Martin,

Thanks for the information. You are right, the various administrative
tools
are not helping.

The built-in Administrator account may behave differently than one you
added
yourself, though I don't know much about that. If I were you, I would
continue your tests with an administrative account you added rather than
the
built-in one. I found these related articles:
http://support.microsoft.com/kb/314412/en-us
http://support.microsoft.com/kb/298252/en-us
http://support.microsoft.com/kb/926183/en-us

Yes, there is an built-in Administratrors group in Windows XP Home
Edition
that a new user is added to when you choose the "Administrative user"
radio
button in the Users and Accounts Control Panel.

What changed between the time it worked and the time it didn't work? Did
you
log off? Reboot? Install software? Or just use the bathroom and come back
to
find everything went to heck?!

Did you check the permissions in the C:\WINDOWS\system32\spool\drivers
folder, especially C:\WINDOWS\system32\spool\drivers\w32x86\3? You may
find
it easier to examine if you use Folder Options to turn off "Use Simple
File
Sharing".

You can turn on auditing of successes and failures (or can you in Windows
XP
Home Edition?) to see what the last thing it succeeded in doing was and
the
first thing that failed. You can also use a tool like File Monitor or
Registry Monitor from Sysinternals to produce a log of file or registry
access.

Unfortunately, in Windows XP Home Edition, some security features are
missing, some are hidden but can be shown and some are hidden eg. in the
registry. For security-specific questions, you could try
microsoft.public.platformsdk.security. But it would probably be
preferable
to continue this thread as long as it is productive instead of explaining
it
all over again.

Paul

"Martin Brilliant" <MartinBrilliant@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:2EC3D3C1-71AF-442F-9810-CBF22CE0E91C@xxxxxxxxxxxxxxxx


.