[Samba] Someone change my printer default settings

[Jaume Poch]

Hello,
I'm new in this group, and I can't found the answer of my problem
anywhere. I read the HOWTO and explain something about it but I don't
find the solution.
Ok, the question is that I have SAMBA server with CUPS to share the
printer and home between 34 linux and windowsXP machines. I put the
drivers in a print$ share and all the people can install the driver only
clicking in connect...
The problem is that in some cases the printers default settings are
overwritten for someone (I don't know who) and all the people receive
this new parametres (for exemple not allow to print in both sides) and I
have to go to the printer admin change the properties and then uninstall
and install the printer.
I create a printer admin that is not root or administrator, I tried to
put the driver in read-only mode, but all fails.
I use gentoo (kernel 2.6.17), samba (3.0.22-r3), cups (cups-1.2.6),
openldap (2.3.30-r2).
An extract of my smb.conf (only the relevant):

[global]
        delete user from group script = /usr/sbin/smbldap-groupmod -x "%
u" "%g"
        dns proxy = no
        netbios name = epsi
        netbios aliases = mthics
        dos charset = 850
        Unix charset = ISO8859-1
        local master = yes
        workgroup = nneint
        debug level = 3
        os level = 65
        ldap admin dn = cn=manager,dc=nneint,dc=com
        ldap passwd sync = Yes
        printing = cups
        printcap name = cups
        security = user
        add machine script = /usr/sbin/smbldap-useradd -w "%u"
        max log size = 500
        log file = /var/log/samba/%m.log
        load printers = yes
        ldap user suffix = ou=People
        add group script = /usr/sbin/smbldap-groupadd -p "%g"
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        add user to group script = /usr/sbin/smbldap-groupmod -m "%u" "%
g"
        domain master = yes
        encrypt passwords = yes
        passdb backend = ldapsam:ldap://127.0.0.1/
        wins support = yes
        ldap delete dn = Yes
        ldap group suffix = ou=Groups
        ldap machine suffix = ou=People
        ldap suffix = dc=scytl_int,dc=com
        add user script = /usr/sbin/smbldap-useradd -m "%u"
        set primary group script = /usr/sbin/smbldap-usermod -g "%g" "%
u"
        preferred master = yes
        domain logons = yes
        logon script = logon.bat
        logon path = \\nneinst\%U
        logon drive = H:
        logon home = \\%L\%U
        time server = yes
        admin users = administrator
        printer admin = printadmin
        min protocol = NT
        idmap uid = 10000-20000
        idmap gid = 10000-20000

[printers]
   comment = All Printers
   path = /var/spool/samba
   browseable = no
   guest ok = yes
   writable = no
   printable = yes
   public = yes
   create mode = 0700
   use client driver = no

[print$]
path = /etc/samba/drivers
browseable = yes
guest ok = no
write list = printadmin
read only = yes

Thank you very match in advance