[Samba] Access denied, and other problems, trying to administer printers

[Åke Holmlund via samba]

Hi all.

We are running Samba 4.4.10 as an NT-domain server on Solaris 10. The server is
also used to store printer preferences and drivers. We are using LDAP as the
passdb backend.

Now we need to change some printing preferences and change one printer driver,
however I can not do any of those things any more (last time I did it we was
running Samba 3.x...).

When I log in to a Win 7 computer as a domain administrator but when I try
to add a new driver, using the Print Management tool, I get Access Denied.
When I try to look att the printing defaults for a printer, I get a message
telling me that the printing defaults can not be shown. Same thing happens
when I try to look att det print settings for a printer.

I have tried "everything" but can not get it to work! Any ideas?

Regards,
Åke Holmlund

--
To unsubscribe from this list go to the following URL and read the
instructions: https://lists.samba.org/mailman/options/samba

[Marc Muehlfeld via samba]

Hi Åke,

Am 06.03.2017 um 15:02 schrieb Åke Holmlund via samba:
> Now we need to change some printing preferences and change one printer
> driver, however I can not do any of those things any more (last time
> I did it we was running Samba 3.x...).
>
> When I log in to a Win 7 computer as a domain administrator but when I try
> to add a new driver, using the Print Management tool, I get Access Denied.
> When I try to look att the printing defaults for a printer, I get a message
> telling me that the printing defaults can not be shown. Same thing happens
> when I try to look att det print settings for a printer.

It sounds like the problem that came up last summer, after MS updated
the Windows print spooler. For details and how to fix it in a Samba AD, see:

https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients#Creating_a_GPO_for_Trusting_the_Print_Server

You can easily figure out if this is your problem: Set up a new Win7
client without applying the updates. If you can preconfigure drivers and
connect to the printers on this machine, then MS16-087 is your problem.

You can have a look at the *.admx files in C:\Windows\PolicyDefinitions\
on your Windows client to figure out what registry keys the two group
policies update and manually set them using a *.reg file on each machine
or by using NT4 policies. I think this should work.

If it works, please provide me the *.reg file with the settings and I
will enhance the documentation to work around this problem in non-AD
environments.


Regards,
Marc

[Åke Holmlund via samba]

Hi Marc.

> It sounds like the problem that came up last summer, after MS updated the Windows print spooler.
> For details and how to fix it in a Samba AD, see:
>
> https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Client
> s#Creating_a_GPO_for_Trusting_the_Print_Server

I have seen that but I guess it does not apppy in my situation (NT-domain).

> You can easily figure out if this is your problem: Set up a new Win7 client without applying the
> updates. If you can preconfigure drivers and connect to the printers on this machine, then
> MS16-087 is your problem.

Tested that but it still fails in the same way. Maybe I should have mentioned
that connecting to the printers and using them to print does work. It's just
the management part that fails.

Regards,
Åke

[Marc Muehlfeld via samba]

Hi,

Am 07.03.2017 um 12:55 schrieb Åke Holmlund via samba:
>> It sounds like the problem that came up last summer, after MS updated
>> the Windows print spooler.
>> For details and how to fix it in a Samba AD, see:
>>
>> https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Client
>> s#Creating_a_GPO_for_Trusting_the_Print_Server
>
> I have seen that but I guess it does not apppy in my situation (NT-domain).

This should affect all print server installations, because it's
something MS changed on the client and is independently of the type of
print server (AD, NT4 domain, standalone)

>> You can easily figure out if this is your problem: Set up a new Win7
>> client without applying the
>> updates. If you can preconfigure drivers and connect to the printers
>> on this machine, then
>> MS16-087 is your problem.
>
> Tested that but it still fails in the same way. Maybe I should have
> mentioned that connecting to the printers and using them to print
> does work. It's just the management part that fails.

Even if you applied this patch, your users are able to connect the
printer and use it - as long as the driver is already available on the
client. This means, if one of your users connected the printer on a
workstation before MS16-087, the driver was installed locally. For all
users on this host that are connecting later to a printer that uses the
same driver, the driver is not downloaded from the print server again
(as long as it is not updated on the server).

Your situation sounds really like it is caused by this MS update.
However, if you tested this with a fresh install without installing any
updates, it's unlikely.


Can you please go through the following guides:
https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server
https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients
and make sure that everything matches your environment? Especially that
you use an account that has the SePrintOperatorPrivilege privilege
granted and is able to write to the print$ share. I rewrote both guides
recently and verified them using Samba 4.5.3 or 4.5.4 on RHEL 7.3.
However, I only checked Win8 and 10 (both 64-bit), not Win7.


If you verified that your settings matches what we have in our
documentation and be sure that it's not related to the MS update, can
you please put a level 10 debug log on pastebin (or any other paste
service) that contains only the log entries when you click the action
that fails? Additionally, your [global], [printers], [print$], and the
section of an printer would be interesting.


Regards,
Marc

[Åke Holmlund via samba]

Hi,

Today I finally got time to do some more testing. I set up a Windows 10
machine but got the same problem (just wanted to make sure...).

I will do more testing tomorrow but I have a question about an error
I'm seeing in the logs. Do You know what
"access DENIED for non-printserver bits" (log level 3) means?

Regards,
Åke

[Åke Holmlund via samba]

Hi,
Running Samba 4.4.10 as a NT-domain controller. Does anybody know
what the error message "access DENIED for non-printserver bits"
(log level 3) means when trying to add a new printer driver?

Regards,
Åke