[Samba] Printer access denied problems

[Jeremy Nelson]

I've had a nagging problem for a long time where I cannot connect to my 
printers from Windows 2000 or XP.  I'm using CUPS printing and Samba 
3.0.14.  I've seen people report a similar problem where they can print, 
but can't open the queue or manage the printers.  The message you get is 
"Operation could not be complete.  Access is denied." 

I found the problem to be an "invalid users" parameter that included 
root.  I'm not positive how to tell Samba to use a different account, 
but removing the root user from the invalid users list fixed the problem.

I would also refer people to page 28 of John Terpstra's excellent Samba 
3 By Example (http://www.samba.org/samba/docs/Samba3-ByExample.pdf), 
where he writes:

Windows 9x/Me are unaffected by the parameter. However, this disables 
the ability to upload printer drivers to a Samba server via the Windows 
NT/200x Add Printer Wizard or by using the NT printer properties dialog 
window. It also disables the capability of Windows NT/200x clients to 
download print drivers from the Samba host on demand. Be extremely 
careful about setting this parameter. The alternate parameter use client 
driver applies only to Windows NT/200x clients. It has no effect on 
Windows 95/98/Me clients. When serving a printer to Windows NT/200x 
clients without first installing a valid printer driver on the Samba 
host, the client is required to install a local printer driver. From 
this point on, the client treats the printer as a local printer and not 
a network printer connection. This is much the same behavior that occurs 
when disable spoolss = yes. Under normal circumstances, the NT/200x 
client attempts to open the network printer using MS-RPC. Because the 
client considers the printer to be local, it attempts to issue the 
OpenPrinterEx() call requesting access rights associated with the logged 
on user. If the user possesses local administrator rights but not root 
privilege on the Samba host (often the case), the OpenPrinterEx() call 
fails. The result is that the client now displays an "Access Denied; 
Unable to connect" message in the printer queue window (even though jobs 
may be printed successfully). This parameter MUST not be enabled on a 
print share that has a valid print driver installed on the Samba server.