[Samba] setdriver fails with WERR_ACCESS_DENIED

[Rob Tanner]

Flavien,

I had a similar problem about a month ago.  Just like you, I could 
execute  "rpcclient enumdrivers", but "rpcclient setdriver" resulted in 
the WERR_ACCESS_DENIED.  In my case, I am using winbind to the fullest 
so that our Windows sysadmin can control access to folders within shares 
based on Active Directory security group memberships.  That means that 
when I mount a share, I'm not identified as simply "rtanner" but rather 
as "CATNET\rtanner", CATNET being the name of the domain. 

I resolved the WERR_ACCESS_DENIED issue in rpcclient by specifying 
"CATNET\rtanner" as a printer admin and authenticating as the user 
"CATNET\rtanner" rather than simply "rtanner" in rpcclient.  The only 
oddity was that the global setting in "printers" was not enough.  I had 
to explicitly declare "CATNET\rtanner" as a printer admin in each 
printer definition in smb.cfg.  And after that, everything was honky dory.

Hope that helps.

-- Rob

Flavien said the following on 07/20/2006 04:50 AM:

>Hi,
>
>
>
>I'm using samba 3.0.22 on a Linux/Debian machine.
>
>I'm trying to get printer drivers on the server automatically picked by
>the XP clients on the server.
>
>    $ rpcclient  localhost -U flavien -c 'enumdrivers'
>    Password:
>    [Windows NT x86]
>    Printer Driver Info 1:
>            Driver Name: [hp1]
>
>The user "flavien" has PrintOperator privileges :
>    $ net rpc rights list flavien -U flavien
>    Password:
>    SePrintOperatorPrivilege
>    SeDiskOperatorPrivilege
>
>I try to set the driver to the printer :
>    $ rpcclient  localhost -U flavien -c 'setdriver hp1 hp1'
>    Password:
>    result was WERR_ACCESS_DENIED
>
>
>Something that looks suspicious to me :
>
>    $ rpcclient  localhost -U flavien -c 'getdriverdir "Windows NT x86"'
>    Password:
>            Directory Name:[\\LOCALHOST\print$\W32X86]
>
>
>Shouldn't it be the netbios name of the server instead of LOCALHOST ?
>
>FWIW, the /etc/samba/drivers dir is writeable by "flavien"
>
>
>I'm pretty stuck here now. Any help appreciated.
>
>
>Flavien.
>  
>

-- 

Rob Tanner
UNIX Services Manager
Linfield College, McMinnville OR