Re: All users printers showing up on terminal server



Hi,

You need to remove your users from the Power Users group. Members of this group have the ability to become administrators if they choose to (or if a malware program they run chooses to). In the *best* case it is likely that the server will eventually have application errors and other strange issues and will need to be redone.

Use Process Monitor to determine which ntfs and registry permissions the database application needs to run. That way you can grant only those permissions that are necessary.
The most common case is read/write access to the app's registry key under HKLM, and modify access to the app's program folder(s) (for example, a folder under program files and program files\common files).

In the most *rare* cases you can use virtualization software to allow a stubborn application to run without high privileges.
This is not the case for you since your application will run okay with Power Users membership.

A member of the Power Users group may be able to gain administrator rights and permissions in Windows Server 2003, Windows 2000, or Windows XP

http://support.microsoft.com/kb/825069

-TP

James wrote:
Hi,

Windows 2003sp2 terminal server. XPsp2 and Vista clients.

When the users log onto TS all the redirected printers are show on the
printers dialogue. At present there are 50 printers on view (Approx 5
for each of the 10 users). I think this is caused by the fact that
all users are "power users" on the 2003 server. Unfortunately this
"power user" status is required to allow a bespoke database
application to work. I'm aware that this a far from ideal but is
there a way for each user to only see their own "redirected" printers
not everyone elses. I could not see this in Group Policy only the
ability to disable printer redirection On or OFF. Most users use printer redirection but some of them are confused with
long list. This problem seems to have appeared or increased after I
enabled the "fail back" printer drivers after driver problems on the
server. Any suggestions would be most welcome. thanks
.



Relevant Pages

  • RE: Printer Help Please !!!!!!!!!!
    ... are still members of the Administrators or Power Users group. ... MCSE,CCEA, Microsoft MVP - Terminal Server ... > All printers can be printed to, ... >> Server Session ...
    (microsoft.public.windows.terminal_services)
  • Re: Wrong NTFS-Permissions after dcpromo
    ... This sid is for the Power Users group - ... use the old deprecated groups anyway (Server Operators, Power Users, ... contain the group "server-operators" but instead they contain the SID ...
    (microsoft.public.windows.server.active_directory)
  • RE: Terminal server printing and taking control of remote sessions
    ... not change the fact that power users and admistrators would see other's ... printers, as this is a function of the core OS. ... Microsoft MVP - Terminal Server ... Giving them this right also gives them the ability to see other ...
    (microsoft.public.windows.terminal_services)
  • Re: Power Users on XP machines
    ... I am not too familiar with GPOs yet but I have looked at them a bit. ... do this solely on the 2003 server or on the XP machine? ... > into the local power users group on your XP workstations. ...
    (microsoft.public.win2000.general)
  • Re: 2003 Security, How do you add power users (No Built-in)
    ... Power Users doesn't exist on Server versions. ... >>>the power users group on all the local machines, ...
    (microsoft.public.win2000.security)