Re: Terminal Server with SBS 2K3

The default domain controllers policy was "not defined"

The main server is SBS 2K3 SP1, the Terminal Server is 2003 SP1

I was able to have the user add the printers after following your
instructions. I will try your other instructios to see if I can limit them
so they are not print operators since I do not like that they are in that
group now.

> 1. Do normal users try to install a network printer? Which OS is the
> printer server? Have you installed the Windows 2003 printer driver on it?

1.) Normal users on the LAN can add printers without problem, this is
strictly a problem when logging into the TS.

> 2. Please run the "gpresult /v >c:\gpresult.txt" command to generate the
> gpresult.

2.) I have sent the file as you requested.

I now have a problem with the SBS fax, when the same users attempt to print
to the SBS fax they this error message,

"Configuration settings cannot be saved due to an internal error"


""Charles Yang [MSFT]"" <v-chayan@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:p4fMJ4nCGHA.832@xxxxxxxxxxxxxxxxxxxxxxxx
> HI,
>
> Thanks for your updates.
>
> If I understand properly, when a normal user logs on the terminal server
> tries to install a printer he/she receives the error message saying that
> "You do not have sufficient access to your machine to connect to the
> selected printer". You have followed the steps in KB259937 to disable the
> "Prevent users from adding printers" group policy in the default domain
> policy and the local policy of the terminal server.
>
> Before we go any further, I would like to confirm whether you have checked
> the default domain controller policy to ensure that the "Prevent users
> from
> adding printers" group policy was enabled. If not, I suggest that you
> check
> it as the default domain policy and local policy are overridden by the
> default domain controller policy. If this policy is defined in the default
> domain controller policy, users will be prevented from adding printers.
>
> Based on my research, this problem may also occur when normal users do not
> have enough permission to install and uninstall printer drivers. When a
> user connects to a printer on a print server, the connecting client looks
> for the appropriate driver on the print server, and then automatically
> downloads it. If the printer driver for Windows 2003 server is not
> installed previously and users do not have Add/Remove printer driver
> permission, you will receive this error. To enable normal users to install
> printer, make sure that you install printer drivers for all the supported
> operating systems in your corporate network or grant users with the
> permission to install printer driver.
>
> To grant users with install printer driver permission on the domain
> controller, you can add normal users to the "Printer Operators" group and
> define the Load/Unload Device Drivers privilege to grant the user the
> right. To set this privilege, you can perform the following steps:
>
> 1. Click Start -> Run, type "gpedit.msc" in the text box, and click OK.
> 2. Locate the following group policy: [Computer Configuration\Windows
> Settings\Security Settings\Local Policies\ User Rights
> Assignment\Load/Unload Device Drivers].
> 3. Add the user who needs to install local printer to the group policy.
> 4. Click Start -> Run, type "cmd" in the text box, and click OK.
> 5. Run the following command to refresh the group policy:
>
> Gpupdate /force
>
> For management facility, you may consider create a user group that
> contains
> users who need to add local printer and then grant Load/Unload Device
> Drivers privilege to this user group.
>
> Does it work now? If this problem continues, please help me collect some
> information so that I can perform further research on this issue:
>
> 1. Do normal users try to install a network printer? Which OS is the
> printer server? Have you installed the Windows 2003 printer driver on it?
> 2. Please run the "gpresult /v >c:\gpresult.txt" command to generate the
> gpresult.
>
> Please send the gpresult.txt file to my email address at:
> laurazh@xxxxxxxxxxxxxx I will perform further research.
>
> More Information
> -----------------
> 279753 Error Message: You Do Not Have Sufficient Access to Your Machine to
> http://support.microsoft.com/?id=279753
>
> I appreciate your time on this issue, please carefully go through all the
> suggestion above to perform test. I am glad to be of assistance.
>
>
>
> Best regards,
>
> Charles Yang (MSFT)
>
> Microsoft CSS Online Newsgroup Support
>
> Get Secure! - www.microsoft.com/security
>
> ======================================================
> This newsgroup only focuses on SBS technical issues. If you have issues
> regarding other Microsoft products, you'd better post in the corresponding
> newsgroups so that they can be resolved in an efficient and timely manner.
> You can locate the newsgroup here:
> http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
>
> When opening a new thread via the web interface, we recommend you check
> the
> "Notify me of replies" box to receive e-mail notifications when there are
> any updates in your thread. When responding to posts via your newsreader,
> please "Reply to Group" so that others may learn and benefit from your
> issue.
>
> Microsoft engineers can only focus on one issue per thread. Although we
> provide other information for your reference, we recommend you post
> different incidents in different threads to keep the thread clean. In
> doing
> so, it will ensure your issues are resolved in a timely manner.
>
> For urgent issues, you may want to contact Microsoft CSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Any input or comments in this thread are highly appreciated.
> ======================================================
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
>
> =====================================================
> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> =====================================================
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> --------------------
> | From: <wedor>
> | References: <OjUc1ZXCGHA.4016@xxxxxxxxxxxxxxxxxxxx>
> <OAi#gkZCGHA.628@xxxxxxxxxxxxxxxxxxxx>
> <l5fRrfeCGHA.3992@xxxxxxxxxxxxxxxxxxxxx>
> | Subject: Re: Terminal Server with SBS 2K3
> | Date: Mon, 26 Dec 2005 13:03:11 -0600
> | Lines: 172
> | X-Priority: 3
> | X-MSMail-Priority: Normal
> | X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
> | X-RFC2646: Format=Flowed; Original
> | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
> | Message-ID: <uqEqF8kCGHA.3920@xxxxxxxxxxxxxxxxxxxx>
> | Newsgroups: microsoft.public.windows.server.sbs
> | NNTP-Posting-Host: ip66.244.133.12.cust.max.inter.net 66.244.133.12
> | Path: TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
> | Xref: TK2MSFTNGXA02.phx.gbl microsoft.public.windows.server.sbs:232470
> | X-Tomcat-NG: microsoft.public.windows.server.sbs
> |
> | This was an operating SBS network that I have just added a Terminal
> Server
> | to, the printers have been installed since day one, they are an HP-4300
> and
> | an HP-4000 and the SBS fax, the printers are controlled by HP internal
> Print
> | servers.
> |
> | 1.) If a user is logged in as admin all the printers are visible and
> | useable.
> |
> | 2.) Incorrect
> |
> | 1.) The exact error message is
> |
> | "you do not have sufficient access to your computer connect to the
> selected
> | printer"
> |
> | 2.) No
> |
> | 3.) Yes
> |
> | 4.) The local security policy, "Security Settings/Local
> Policies/Securtiy
> | Options/Devices: Prevent users from installing print drivers" I changed
> it
> | from enabled to disabled.
> |
> | ""Charles Yang [MSFT]"" <v-chayan@xxxxxxxxxxxxxxxxxxxx> wrote in message
> | news:l5fRrfeCGHA.3992@xxxxxxxxxxxxxxxxxxxxxxxx
> | > HI,
> | >
> | > Welcome to SBS newsgroup.
> | >
> | > Issue description:
> | > ============
> | >
> | > I understand that you encountered problem when you want to add the
> printer
> | > to the terminal server.
> | >
> | > Analyzing and suggestion:
> | > ============
> | >
> | > If my understanding is correctly, you want to add the printer to the
> | > Terminal server without giving the local admin right of Terminal
> server.
> | >
> | > Before we go any further, can I assume that you have already installed
> the
> | > printer on the SBS domain also, you just want to use normal user to
> add
> | > the
> | > printer via "add printer wizard", if so the reason might be caused by
> the
> | > Terminal server did not have the printer driver installed. You can
> follow
> | > the steps below:
> | >
> | > 1. Login as Administrator and install all drivers for the
> corresponding
> | > printers on the print server.
> | > 2. Users are now able to install network printers.
> | >
> | > If this is not your issue or your issue is not resolved after
> performing
> | > the steps above, please help gather more information:
> | >
> | > 1. Could you paste the detailed error message you want to add the
> printer
> | > via normal user?
> | > 2. Is there any error event on the event view related to printer?
> Please
> | > also paste them to newsgroup.
> | > 3. Does the issue occur on all shared network printer?
> | > 4. If possible, could you tell us which policy you change.
> | >
> | > I really appreciate your effort on this issue, please feel free to let
> me
> | > know the results, I am glad to be of assistance.
> | >
> | >
> | >
> | > Best regards,
> | >
> | > Charles Yang (MSFT)
> | >
> | > Microsoft CSS Online Newsgroup Support
> | >
> | > Get Secure! - www.microsoft.com/security
> | >
> | > ======================================================
> | > This newsgroup only focuses on SBS technical issues. If you have
> issues
> | > regarding other Microsoft products, you'd better post in the
> corresponding
> | > newsgroups so that they can be resolved in an efficient and timely
> manner.
> | > You can locate the newsgroup here:
> | > http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
> | >
> | > When opening a new thread via the web interface, we recommend you
> check
> | > the
> | > "Notify me of replies" box to receive e-mail notifications when there
> are
> | > any updates in your thread. When responding to posts via your
> newsreader,
> | > please "Reply to Group" so that others may learn and benefit from your
> | > issue.
> | >
> | > Microsoft engineers can only focus on one issue per thread. Although
> we
> | > provide other information for your reference, we recommend you post
> | > different incidents in different threads to keep the thread clean. In
> | > doing
> | > so, it will ensure your issues are resolved in a timely manner.
> | >
> | > For urgent issues, you may want to contact Microsoft CSS directly.
> Please
> | > check http://support.microsoft.com for regional support phone numbers.
> | >
> | > Any input or comments in this thread are highly appreciated.
> | > ======================================================
> | > This posting is provided "AS IS" with no warranties, and confers no
> | > rights.
> | >
> | >
> | > =====================================================
> | > When responding to posts, please "Reply to Group" via your newsreader
> so
> | > that others may learn and benefit from your issue.
> | > =====================================================
> | >
> | > This posting is provided "AS IS" with no warranties, and confers no
> | > rights.
> | >
> | > --------------------
> | > | Reply-To: "MikeR" <research@xxxxxxxxxxxxxxxxxx>
> | > | From: "MikeR" <research@xxxxxxxxxxxxxxxxxx>
> | > | References: <OjUc1ZXCGHA.4016@xxxxxxxxxxxxxxxxxxxx>
> | > | Subject: Re: Terminal Server with SBS 2K3
> | > | Date: Sun, 25 Dec 2005 13:21:09 -0800
> | > | Lines: 29
> | > | Organization: my own
> | > | X-Priority: 3
> | > | X-MSMail-Priority: Normal
> | > | X-Newsreader: Microsoft Outlook Express 6.00.2900.2180
> | > | X-RFC2646: Format=Flowed; Response
> | > | X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
> | > | Message-ID: <OAi#gkZCGHA.628@xxxxxxxxxxxxxxxxxxxx>
> | > | Newsgroups: microsoft.public.windows.server.sbs
> | > | NNTP-Posting-Host: rollesolutions.com 66.92.0.119
> | > | Path:
> TK2MSFTNGXA02.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
> | > | Xref: TK2MSFTNGXA02.phx.gbl
> microsoft.public.windows.server.sbs:232374
> | > | X-Tomcat-NG: microsoft.public.windows.server.sbs
> | > |
> | > | Maybe I am missunderstanding but in my scenario (SBS03 + Serv03
> terminal
> | > | server) I have added the printers myself and the users are free to
> use
> | > them.
> | > | I did not have to change any policy to do this. There are many
> changes I
> | > | have made policy wise (though nothing in regard to printers) but the
> | > changes
> | > | were all made after I had everything set up and tested.
> | > |
> | > | Are you wanting your users to be able to add printers at will? What
> did
> | > you
> | > | change or disable in policy?
> | > |
> | > |
> | > |
> | > | <wedor> wrote in message
> news:OjUc1ZXCGHA.4016@xxxxxxxxxxxxxxxxxxxxxxx
> | > | >I have a Terminal Server running on an SBS 2K3 network, I have
> followed
> | > the
> | > | >MS document on setting this up but have run into a problem I can't
> seem
> | > to
> | > | >overcome.
> | > | >
> | > | > The only way I can add printers is if the user is a local admin on
> the
> | > TS,
> | > | > anything short of that does not work.
> | > | >
> | > | > It does not seem to matter how I access the TS, either by RWW or
> on
> | > the
> | > | > LAN.
> | > | >
> | > | > I have found articles on line pointing to policy permissions
> regarding
> | > | > print drivers and have disabled that in the policy.
> | > | >
> | > | > What am I missing?
> | > | >
> | > |
> | > |
> | > |
> | >
> |
> |
> |
>


.

Relevant Pages

  • Re: Crashed DC, reinstalled and now server cant find domain - Please help!
    ... server a DC, I read I had some problems with replication. ... Now I only have one problem: When recreating the SYSVOL, ... access the Domain Controller Security Policy, I get the "The system cannot ... > If you don't have the tools installed load them from your install disk. ...
    (microsoft.public.win2000.active_directory)
  • Re: Crashed DC, reinstalled and now server cant find domain - Please help!
    ... > server a DC, I read I had some problems with replication. ... > Now I only have one problem: When recreating the SYSVOL, ... > to access the Domain Controller Security Policy, ... >> If you don't have the tools installed load them from your install disk. ...
    (microsoft.public.win2000.active_directory)
  • RE: NPS Install Event ID 1616 Error Code 0x80070643
    ... Source: Server Manager ... Network Policy and Access Services ... Attempt to install Network Policy Server failed with error code ...
    (microsoft.public.internet.radius)
  • Re: passing parameters to MSI for a Group Policy install
    ... How would you pass those parameters if you install the MSI file by hand? ... Have a look at the Windows Installer SDK-Tool "Orca" - it lets you open MSI files and create MST files where you can set the properties you wish. ... Microsoft MVP - Windows Server - Group Policy. ...
    (microsoft.public.windows.group_policy)
  • GPO Error
    ... Default Domain Controller Policy I get this error message: ... soon and I am getting so frustrated with this server (wish I was the one who ...
    (microsoft.public.windows.server.sbs)