[Samba] Administrator-installed printers unavailable to regular users

jurgen thinger at gmail.com
Fri Aug 12 00:31:12 GMT 2005


Hi,

> In the wonderful world of Windows you can install a network printer as a
> "local" printer. This may have been what you did previously.

I should have been more clear about how the administrator installs
printers to the workstations. They're installed via the "Add Printer"
Wizard. Selecting "Network printer", navigating to the server, and
picking the printer. It asks for a driver, which is manually
installed. The printer is now available to anyone using the machine.

> Normally you would get a message if the proper driver wasn't available.
> Are the users added to the mapped Domain Users group?

Hmm. Yes and no. That's a bit strange. There are two "Domain Users"
groups, and only one is mapped properly:

yarra# net groupmap list
System Operators (S-1-5-32-549) -> -1
Replicators (S-1-5-32-552) -> -1
Guests (S-1-5-32-546) -> -1
Domain Print Operators (S-1-5-21-1073446153-1192918827-1877560073-550)
-> mc_user
Domain Users (S-1-5-21-1752829885-2314611046-3909587037-513) -> mc_user
Admin Support (S-1-5-21-1752829885-2314611046-3909587037-2249) ->
mc_adminsupport
Power Users (S-1-5-32-547) -> -1
Print Operators (S-1-5-32-550) -> mc_user
Administrators (S-1-5-32-544) -> -1
Domain Users (S-1-5-21-3126122381-2164987421-561208686-513) -> -1
Domain Admins (S-1-5-21-3126122381-2164987421-561208686-512) -> -1
Account Operators (S-1-5-32-548) -> -1
Domain Guests (S-1-5-21-3126122381-2164987421-561208686-514) -> -1
Domain Guests (S-1-5-21-1752829885-2314611046-3909587037-514) -> -1
Management (S-1-5-21-1752829885-2314611046-3909587037-3177) -> mc_management
Domain Admins (S-1-5-21-1752829885-2314611046-3909587037-512) -> wheel
Backup Operators (S-1-5-32-551) -> -1
Users (S-1-5-32-545) -> -1

That might be it. I've just:

net groupmap modify sid=S-1-5-21-3126122381-2164987421-561208686-513
unixgroup=mc_user type=domain

to the second Domain Users, but nothing changes.

A regular user (member of Domain Users) gets a "Can't install printer
because you don't have enough privileges to install a driver into this
machine" error. Administrator can install a printer, but other users
can't see it. Even after the Administrator installs a printer
(assuming that installs the driver into the local PC), regular users
can't install the printer, with the same privilege error. Very
confusing.

......jurgen

-- 
thinger at gmail.com is jurgen's gmail address.
Visit http://jurgen.ca/ for more yummy goodness.


More information about the samba mailing list