Printer Permissions
Dustin Spicuzza
I manage the software for my universities two biggest labs on campus, with
120 and 90 computers, respectively. The problem does not seem to be limited
to a subset of any of these.. but affects all.
About 5 times a day (estimated, sometimes more... sometimes less), people
cannot print to the printers. It gives an access denied error anytime the
user tries to access the printer properties, or print to the printer.... try
as I might, it just wont work. I've tried adjusting security properties a
million different ways while the user was logged in (using runas cmd
/user:Administrator)... and it never works, even if I log out and log in as a
different user. However, the printer works perfectly when logging in as
Admin...
There are four printers set up on each machine: Two CUPS printers, and the
"Microsoft Office Document Image Writer", and a "PDFCreator". The problem
ONLY affects the two CUPS printers, as far as I know.
For a login agent, we use pGina 1.8.2 with the LDAPAuth plugin. Essentially,
on login, pGina creates a new user profile for the user on the local machine,
and uses the "Default User" profile to do so... when the user logs out, the
user account is deleted from the system, and the profile is removed.
We're using a CUPS server to do printing, in conjunction with PyKota to do
print accounting (which, we are having limited success at the moment with
that). The printers use IPP to do printing to the CUPS server.
We use symantec ghost to image the computers, and we use some custom
programs to rename the computers and set up the printers, and then lock them
using driveshield after that process is done.
Now, we have 15 printers in one lab, and 8 in the other. Each lab also has a
"main" printer that everyone in the lab can print to. All of these are
directed through CUPS. On the initial image computer, the printers are set up
to point to some generic printer, and upon ghost we rename and change
registry settings to get the printer to point to the correct CUPS server.
Once again, this renaming stuff is done automatically using a custom program,
and not manually. We also load the "default users" ntdata.dat hive somewhere
on the registry tree, and change the default users "Default Printer" to point
to the proper printer, since Windows does not allow you to set up a global
default printer (weird, eh? You can set everything else globally it seems...
except printers). Maybe its this playing around with the registry keys that
is causing problems... except that when we reboot (with the computer locked),
everything goes back to how we expect it should be.
By default, users who log on are a part of the group "Users" and "Debugger
Users". I have experimentally tried changing to "Power users", but this
problem still happens.
The thing that really gets me, is when the computer reboots (whether it is
"locked" with DriveShield, or not locked..), that everything goes back to
normal. It just only happens *some* of the time. I mean, its really random.
Because most of the time (or maybe not, its frequency varies according to the
people I talk to), it works fine. Then every once in awhile, it just doesn't
work, and theres no explicit reason why. I've tried resetting privileges and
all that jazz... but no dice. I mean, it still shows up as "everyone" being
able to do whatever they want to it, but only the admin account can, plugin
authenticated accounts (normal users) cant do anything to it. It just seems
like that every once in awhile, Windows decides that the user isn't apart of
"Everyone". Or something like that... its weird. However, I haven't noticed
any other portions of the system where permissions aren't how they should be.
As a sidenote, apparently sometimes the printers just decide to disappear
also every once in awhile. However, these problems are only limited to the 2
CUPS printers we have set up. The other 2, a PDF monitor and the Microsoft
Office Imaging printer thing... don't seem to be affected (as far as I know
at least... ).
Now-- in another lab, with 60 or so computers in it, the two teachers
stations (which use a seperate ghost image, because the computers are
radically different), we are having the same problem, except that the
printers are setup to print to a local port using a Novell print queue (this
lab uses Novell, the labs mentioned above do NOT use Novell). These printers
are NOT modified in any way by my custom program that goes through and sets
stuff up for us after ghost... but here, the plugin users can never print,
only administrator. Once again, "Everyone" is given full access to the
printer.... the student computers printers work fine, and do not experience
this problem.
I've tried looking through websites on better ways to set the permissions
for the printers... but.. well, I'm lost. Thanks for any help you can send my
way!