[Samba] Cannot print from Win2003 R2

Fri Apr 4 09:59:18 GMT 2008

Hi,

We have a Windows 2003 R2 server (Enterprise, 64-bit, SP2) and for some reason, cannot print to our samba exported printers.

I can add the printer to the system, all drivers are available, but any
attempt to print results in either "Printing failed when starting
document" (Firefox), "Test page failed to print." when doing a test
page or just a greyed out print button from MS applications (IE, word,
etc).

The same server can print to other printers (non-samba) and to the same
samba printers if using a "local" TCP/IP port (bypassing samba and
CUPS). I am obviosuly authenicated on samba when trying to print and I
can access samba shares on the server that exports the printers.

All other machines (XP, win 2000, including a Windows 2000 TSE) can print fine to any printer on the samba server.

Increasing the logging level and analyzing the results, it seems to point to an authorization issue:

[2008/04/02 17:11:50, 10] lib/util_seaccess.c:se_access_check(233)

  se_access_check: requested access 0x000f000c, for NT token with 17
entries and first sid S-1-5-21-1743362971-2219156043-3858894690-17208.

[2008/04/02 17:11:50, 3] lib/util_seaccess.c:se_access_check(250)

[2008/04/02 17:11:50, 3] lib/util_seaccess.c:se_access_check(251)

  se_access_check: user sid is S-1-5-21-1743362971-2219156043-3858894690-17208

  se_access_check: also S-1-22-2-200

  se_access_check: also S-1-1-0

  se_access_check: also S-1-5-2

  se_access_check: also S-1-5-11

  se_access_check: also S-1-22-2-8013

  se_access_check: also S-1-22-2-40003

  se_access_check: also S-1-22-2-205

  se_access_check: also S-1-22-2-8008

  se_access_check: also S-1-22-2-20

  se_access_check: also S-1-22-2-206

  se_access_check: also S-1-22-2-207

  se_access_check: also S-1-22-2-40000

  se_access_check: also S-1-22-2-8009

  se_access_check: also S-1-22-2-30

  se_access_check: also S-1-22-2-500

  se_access_check: also S-1-22-2-8012

  se_access_check: ACE 0: type 0, flags = 0x02, SID = S-1-1-0 mask = 20008, current desired = f000c

  se_access_check: ACE 1: type 0, flags = 0x09, SID =
S-1-5-21-1743362971-2219156043-3858894690-512 mask = f000c, current
desired = d0004

  se_access_check: ACE 2: type 0, flags = 0x02, SID =
S-1-5-21-1743362971-2219156043-3858894690-512 mask = f000c, current
desired = d0004

  se_access_check: ACE 3: type 0, flags = 0x09, SID = S-1-5-32-544 mask = f000c, current desired = d0004

  se_access_check: ACE 4: type 0, flags = 0x02, SID = S-1-5-32-544 mask = f000c, current desired = d0004

[2008/04/02 17:11:50, 5] lib/util_seaccess.c:se_access_check(314)

  se_access_check: access (f000c) denied.

[2008/04/02 17:11:50, 4] printing/nt_printing.c:print_access_check(5524)

  access check was FAILURE

If I print from another machine, it works fine and the logs show:

[2008/04/03 09:20:50, 10] lib/util_seaccess.c:se_access_check(233)

  se_access_check: requested access 0x00000008, for NT token with 17
entries and first sid S-1-5-21-1743362971-2219156043-3858894690-17208.

[2008/04/03 09:20:50, 3] lib/util_seaccess.c:se_access_check(250)

[2008/04/03 09:20:50, 3] lib/util_seaccess.c:se_access_check(251)

  se_access_check: user sid is S-1-5-21-1743362971-2219156043-3858894690-17208

  se_access_check: also S-1-22-2-200

  se_access_check: also S-1-1-0

  se_access_check: also S-1-5-2

  se_access_check: also S-1-5-11

  se_access_check: also S-1-22-2-8013

  se_access_check: also S-1-22-2-40003

  se_access_check: also S-1-22-2-205

  se_access_check: also S-1-22-2-8008

  se_access_check: also S-1-22-2-20

  se_access_check: also S-1-22-2-206

  se_access_check: also S-1-22-2-207

  se_access_check: also S-1-22-2-40000

  se_access_check: also S-1-22-2-8009

  se_access_check: also S-1-22-2-30

  se_access_check: also S-1-22-2-500

  se_access_check: also S-1-22-2-8012

  se_access_check: ACE 0: type 0, flags = 0x02, SID = S-1-1-0 mask = 20008, current desired = 8

[2008/04/03 09:20:50, 5] lib/util_seaccess.c:se_access_check(308)

  se_access_check: access (8) granted.

[2008/04/03 09:20:50, 4] printing/nt_printing.c:print_access_check(5524)

  access check was SUCCESS

It seems like the Win2003 machine requests "f000c" whereas the other
that works (WinXP) only requests "8". Let me know if it is useful to
post more info from the log.

The server is Solaris 9, Samba 3.0.25a, printers are CUPS imported.

Thanks,

Ricardo

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/