Printing in 2.2.1a

[Gerald Carter]

On Mon, 23 Jul 2001, THIBADEAU,DAN (HP-Roseville,ex1) wrote:

> I removed myself from my local Administrators group, and was able to connect
> to the share and see the queue status correctly.  I added myself back in,
> and it gives me the "access denied" message again.
>
> It seems to me that Samba should "step down" the access if authorization
> fails.  That is, if the client requests Administration access, but isn't
> authorized, they should still be given "guest" access.  I assume this is the
> behavior of Windows.

No.  The client should reissue a request for lesser priviledges if
the access check fails.  The client is failing to do this.  It is
a client bug IMO.

What is happening is that Samba is acting in a way that an NT server
cannot.  You can share a printer on a Samba server with no printer
driver.  This is not possible under NT.

> There are about 80,000 people on my network and nearly all are in thier
> local Administrator group so that they can install applications on thier
> clients.  Is there a solution with Samba 2.2.1a or do I need to go back
> until it is implemented?

I don't know how to fix this other than implementing a parameter for
dropping support for the SPOOLSS RPC's. However, IIRC win2k doesn't like
this too well.  It is a really horrible hack we used in Samba 2.0.x.





cheers, jerry
 ---------------------------------------------------------------------
 www.valinux.com         VA Linux Systems       gcarter_at_valinux.com
 www.samba.org              SAMBA Team              jerry_at_samba.org
 www.plainjoe.org                                jerry_at_plainjoe.org
 --"I never saved anything for the swim back." Ethan Hawk in Gattaca--