[Samba] "printer admin" still working in 3.0.21c?

[Thomas Limoncelli]

Thomas Limoncelli wrote:
> [2006/02/27 18:21:24, 5] rpc_server/srv_spoolss_nt.c:check_printer_ok(5933)
>   check_printer_ok: servername=\\myserver printername=\\myserver\HP Universal Printing PS sharename=myprinter01 portname=Samba Printer Port drivername=HP Universal Printing PS comment=myprinter01 location=
> [2006/02/27 18:21:24, 3] rpc_server/srv_spoolss_nt.c:update_printer(6113)
>   update_printer: printer property change denied by handle 

I'm still pulling my hair out on this one, even after having looked at 
level 10 Samba logs extensively. While there's high chance I'm doing 
something stupid, is there anyone willing to point a lost soul into the 
right direction? What can prevent a printer admin from changing printer 
properties through a Windows client? I can provide level 10 smbd logs, 
Ethereal traces and whatever it may take.

FWIW, smbstatus reports I'm connected as XXX\me and this account is 
granted SePrintOperatorPrivileges at least:

myserver# smbstatus
[...]
17802   XXX\me        XXX\domain users  myclient     (10.11.12.13)

myserver# net rpc rights list accounts -S `hostname` -U 'XXX\me'
[...]
XXX\me
SePrintOperatorPrivilege


The smb.conf is the one from 
http://lists.samba.org/archive/samba/2006-February/118057.html plus:

[global]
	printing = CUPS
         printcap name = CUPS
         cups options = raw
	enable privileges = Yes
	admin users = XXX\me

[printers]
         path = /var/spool/samba
         create mask = 0644
         printable = Yes
         use client driver = Yes
         write list = XXX\me
         guest ok = Yes

[print$]
         comment = Printer Drivers
         path = /var/lib/samba/drivers
         write list = XXX\me


Crying for help,
-TL