[Samba] WinY2k Access Denied on Printing

[Adam Williams]

>What is your printer admin set to ??  

printer admin = @cis @users

where cis is the CIS department and users is just about everyone.  This 
used to be set to just @cis and it worked fine under 2.2.1a (cis has print 
admin, no one else did).  But when we tried to upgrade to 2.2.3a we added 
@users in an attempt to get printing working,  and when we fell back to 
2.2.1a we left this setting.  I'll try removing it and see what happens.

>What is your security set to ??

user, this is the PDC
 
>>I had a problem with 2.2.4 where anyone who fell into the category of
>printer admin was denied access to the properties of the printer BUT it only
>happened to w2k and xp, NT worked fine. 

Hrmmm.  If I didn't have ~200 computers I think I'd ditch SPOOLSS and fall 
back to "use client driver =" but since these clients span two states 
(Michigan and Indiana) that really isn't a very good option.

>I realize this isn't the same error
>but it's worth a try.  

I'll try just about anything.  I really don't want to fall back to 2.2.1a 
again, as I need some of what 2.2.3+ provide.  I was hoping that since 
rpcclient, etc... actually worked in 2.2.4 we wouldn't have the problems 
we had in 2.2.3a,  but alas...

Thanks for your assistance.  I take it that you are not having this 
problem?

Linux littleboy.morrison.iserv.net 2.4.2-SGI_XFS_1.0 #1 Fri Apr 27 
19:30:49 CDT 2001 i686 unknown
Red Hat Linux release 7.1 (Seawolf)
# smbd -V => Version 2.2.4
fs.file-max = 16384

My smb.conf:
--------------------
[global]
   workgroup = BACKBONE
   server string = What NT Should Have Been
   netbios name = barbel
   netbios aliases = littleboy
   printcap name = /etc/printcap
   load printers = yes
   guest account = pcnet
   add user script = /usr/local/bin/php -f 
/etc/samba/add_machine_account.php %u
   security = user
   encrypt passwords = yes
   socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
   local master = yes
   os level = 200
   domain master = yes
   preferred master = yes
   domain logons = yes
   domain admin group = @cis
   logon script = %G.bat
   logon path = \\BARBEL\PROFILES\%U
   logon drive = f:
   logon home = \\SARDINE\HOMEDIR\
   unix password sync = Yes
   passwd program = /usr/local/bin/passwd_sync.sh %u
   passwd chat = *word* %n\n *OK*
   unix password sync = Yes
   passwd chat debug = Yes
   printer admin = @cis @users
   wins support = yes
   wins hook = /usr/local/bin/dns_update
   dns proxy = yes
   log level = 1
   ldap ssl = no
   ldap suffix = o=Morrison Industries, c=US
   ldap port = 389
   ldap server = littleboy
   remote announce = 192.168.10.255/BACKBONE
   deadtime = 15

[netlogon]
        comment = Logon Script and Policy Directory
        path = /usr/local/pcnet/netlogon
        admin users = @cis
        write list = @cis
        read only = No
        browseable = No
        locking = No
        case sensitive = No
        preserve case = Yes
        default case = Yes
        guest ok = Yes

[print$]
        path = /usr/local/pcnet/printers
        guest ok = yes
        browseable = yes
        read only = yes
        write list = @cis,root

[profiles]
        path = /usr/local/pcnet/profiles
        writeable = yes
        create mask = 0600
        directory mask = 0700
        admin users = @cis

[desktops]
        path = /usr/local/pcnet/desktops
        writeable = no
        write list = @cis
        admin users = @cis

[cdrom]
        path = /mnt/cdrom
        guest ok = Yes

[cisps]
        comment = CIS Optra Laser Printer
        path = /tmp
        create mask = 0700
        guest ok = Yes
        printable = Yes

... more printers here