Re: delegation of printer administration...

Paul,

Again, thanks for responding. I didn't think this would work, as I was under
the impression that Print Operator only covered print servers and printers
published in AD, and not all printers on all servers in the domain. But I too
could be mistaken...if you can find some reference suggesting otherwise, this
would work perfectly, and the security issue is not a problem, as our
objective is to keep from adding these admins out of the local admin groups.

Thanks!

"Paul Williams [MVP]" wrote:

> My thinking behind that statement was to create a new domain local group and
> a local group on the member servers, and give that group full control
> permissions over all installed printers. Then add users to the domain local
> group and the domain local group to that local group on each member.
>
> Without checking up, I was under the impression that Print Operators covered
> all printers in the domain. However, I could be wrong here. As a print
> server is usually just a member server. I'll check this on Monday.
>
> And I guess the slight security issue from making someone a member of this
> group isn't too bad -especially if they don't have interactive access to the
> DCs.
>
> --
> Paul Williams
> Microsoft MVP - Windows Server - Directory Services
> http://www.msresource.net | http://forums.msresource.net
>
>
>
.

Relevant Pages
Quantcast