win2003 printer permissions

  • Thread starter Thread starter ewald lieuwes
  • Start date Start date
E

ewald lieuwes

I am having a slight problem: i want to add specific rights for a not
default group to the printer on a win2003 print server: the group
helpdesk should have the same permissions on the printjobs as the
CREATOR OWNER. They can't have the same permissions as Administrators or
Print Operator, they only should be able to manage the queues and not
the printer itself.

Of course, i can manually edit the security of every printer, but there
are a few 100 and growing. So, is there a way i can add the group
HELPDESK as a standard to all existing and new printers? Globally, so to
speak.

I've looked at the print GPO, can't see a policy for that specific need.
I can make a new policy, but then, i need the correct information. I
searched the registry for the CREATOR OWNER, nothing there (of course
not, what was i thinking, it would be too easy, stupid :))

Anybody, suggestions?
 
The resource kit has a tool setprinter.exe where you can set all the
security descriptors the same for all printers. Basically you need to
configure one printer with the UI with the changes, then read the
descriptor, then set all the printers the same.

config "PrinterName" with UI
To see current settings:
SetPrinter -show PrinterName 3

To change security settings (see "Security Descriptor String Format" in MSDN
or SDKdocs for details)
:
*** WARNING: this could make the print queue inaccessible and require the
use of a registry editor to fix ***

SetPrinter PrinterName 3
"pSecurityDescriptor=O:BAG:DUD:(A;CIIO;RC;;;CO)(A;OIIO;GA;;;CO)(A;;SWRC;;;WD
)(A;CIIO;GX;;;WD)(A;;LCSWSDRCWDWO;;;BA)(A;OICIIO;GA;;;BA)(A;;LCSWSDRCWDWO;;;
PU)(A;OICIIO;GA;;;PU)"

To leave the settings unchanged (but what's the point then):
SetPrinter PrinterName 3 "pSecurityDescriptor=NULL"

here's the resource kit.
http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en


--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.
 
Back
Top