[Samba] Access denied, and other problems, trying to administer printers

[Åke Holmlund]

Hi,

Today I finally got time to do some more testing. I set up a Windows 10
machine but got the same problem (just wanted to make sure...).

I will do more testing tomorrow but I have a question about an error
I'm seeing in the logs. Do You know what
"access DENIED for non-printserver bits" (log level 3) means?

Regards,
Åke

--On 7 mars 2017 19:04:25 +0100 Marc Muehlfeld via samba <samba at lists.samba.org> wrote:

> Hi,
>
> Am 07.03.2017 um 12:55 schrieb Åke Holmlund via samba:
>>> It sounds like the problem that came up last summer, after MS updated
>>> the Windows print spooler.
>>> For details and how to fix it in a Samba AD, see:
>>>
>>> https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clie
>>> nt s#Creating_a_GPO_for_Trusting_the_Print_Server
>>
>> I have seen that but I guess it does not apppy in my situation (NT-domain).
>
> This should affect all print server installations, because it's something MS changed on the
> client and is independently of the type of print server (AD, NT4 domain, standalone)
>
>
>
>>> You can easily figure out if this is your problem: Set up a new Win7
>>> client without applying the
>>> updates. If you can preconfigure drivers and connect to the printers
>>> on this machine, then
>>> MS16-087 is your problem.
>>
>> Tested that but it still fails in the same way. Maybe I should have
>> mentioned that connecting to the printers and using them to print
>  > does work. It's just the management part that fails.
>
> Even if you applied this patch, your users are able to connect the printer and use it - as long
> as the driver is already available on the client. This means, if one of your users connected the
> printer on a workstation before MS16-087, the driver was installed locally. For all users on this
> host that are connecting later to a printer that uses the same driver, the driver is not
> downloaded from the print server again (as long as it is not updated on the server).
>
> Your situation sounds really like it is caused by this MS update. However, if you tested this
> with a fresh install without installing any updates, it's unlikely.
>
>
> Can you please go through the following guides:
> https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server
> https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients
> and make sure that everything matches your environment? Especially that you use an account that
> has the SePrintOperatorPrivilege privilege granted and is able to write to the print$ share. I
> rewrote both guides recently and verified them using Samba 4.5.3 or 4.5.4 on RHEL 7.3. However, I
> only checked Win8 and 10 (both 64-bit), not Win7.
>
>
> If you verified that your settings matches what we have in our documentation and be sure that
> it's not related to the MS update, can you please put a level 10 debug log on pastebin (or any
> other paste service) that contains only the log entries when you click the action that fails?
> Additionally, your [global], [printers], [print$], and the section of an printer would be
> interesting.
>
>
> Regards,
> Marc
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba