[Samba] Win7 to Samba Domain Printing Strangeness

[Ben Clayton]

Hi,

I have a server which until recently was serving a domain of about 20 XP
PCs in a school. Over the summer I updated Samba to 3.5.4-0.70, and
replaced the desktops with new machines which are running Win7 Pro 64 bit
SP1.

This being a school, I have a system of mandatory group profiles set up,
and all of the pupil groups curently have copies of the same mandatory
profile (generated via the official Microsoft windows AIK method), with
only the wallpaper changed. The teachers have a further tweaked version of
the same mandatory group profile.

I have two samba/cups printers on the server - both HP lasers, one mono,
one colour. Some users can print to both, some users can print to one of
them, the other appearing with an exclamation mark in a yellow triangle
superimposed on it in "Devices and Printers", and some users can print to
neither, both having the exclamation sign. There seems to be no rhyme or
reason as to which users can and can't print, although once a user can
print, they always seem to be able to on that machine - but I have seen
some users change from being unable to print to being able to print to one
or both of the printers as I've tried to troubleshoot the system over the
last few days, but this seems to have affected some but not others of
nominally identical groups. The PC clients are nominally identical, having
been imaged, and yet I'm seeing inconsistency between machines, too: Some
users can print on some machines and not others.

For both printers I started by uploading a driver to the server, and if I
visit \\servername in windows explorer and right click printername and
click "connect":
1) as a local machine administrator with a server domadmin account then
the printers install.
2) as any other user who can't already print (whether LM admin or domain
admin, both or neither) then a "Connect to servername" username and
password prompt appears, and basically you can't get any further.

If in Windows Explorer I visit \\servername\printers I get a "Connect to
Printer - No driver found" message - suggests a permissions issue, but
I've 777'd /etc/samba/drivers for now, and this hasn't changed.

I have used gpedit.msc on the local machine to set Computer Configuration
- Administrative Templates - Printers - Point and Print Restrictions to
Disabled. (I understand this to be the correct setting for Win7, replacing
the User Configuration - ... setting in WinXP)
I've also used net rpc rights grant to give Domain Users
SePrintOperatorPrivilege.

The relevant extracts from my smb.conf below:
[global]
	workgroup = MUSIC
	server string = BRGS Music Department Server
	map to guest = Bad User
	username map = /etc/samba/smbusers
	unix password sync = Yes
	printcap name = cups
	domain logons = Yes
	os level = 255
	preferred master = Yes
	domain master = Yes
	wins support = Yes
	map hidden = No
	enable privileges = yes
	.......

[printers]
	comment = All Printers
	path = /var/spool/samba
	hosts allow = 192.168.17.0/24, 192.168.0.0/24
	printable = Yes
	browseable = No
	valid users = @music, @teachers, @domadmins

[print$]
	comment = Printer Drivers
	path = /etc/samba/drivers
	write list = root, @teachers, @domadmins
	valid users = @music, @teachers, @domadmins

I've been trying to track this down for a good few hours, now, and I'm
wondering if anyone can help me - I suspect I have missed something silly,
and now can't see the wood for the trees. Insight or experience would be
appreciated.

Many thanks,
Ben


----------
Dr. Ben Clayton
Director
Irax Ltd.
-----