[Samba] Access denied, and other problems, trying to administer printers

[Åke Holmlund]

Hi,
Running Samba 4.4.10 as a NT-domain controller. Does anybody know
what the error message "access DENIED for non-printserver bits"
(log level 3) means when trying to add a new printer driver?

Regards,
Åke

--On 14 mars 2017 17:33:30 +0100 Åke Holmlund via samba <samba at lists.samba.org> wrote:

> Hi,
>
> Today I finally got time to do some more testing. I set up a Windows 10
> machine but got the same problem (just wanted to make sure...).
>
> I will do more testing tomorrow but I have a question about an error
> I'm seeing in the logs. Do You know what
> "access DENIED for non-printserver bits" (log level 3) means?
>
> Regards,
> Åke
>
> --On 7 mars 2017 19:04:25 +0100 Marc Muehlfeld via samba <samba at lists.samba.org> wrote:
>
>> Hi,
>>
>> Am 07.03.2017 um 12:55 schrieb Åke Holmlund via samba:
>>>> It sounds like the problem that came up last summer, after MS updated
>>>> the Windows print spooler.
>>>> For details and how to fix it in a Samba AD, see:
>>>>
>>>> https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clie
>>>> nt s#Creating_a_GPO_for_Trusting_the_Print_Server
>>>
>>> I have seen that but I guess it does not apppy in my situation (NT-domain).
>>
>> This should affect all print server installations, because it's something MS changed on the
>> client and is independently of the type of print server (AD, NT4 domain, standalone)
>>
>>
>>
>>>> You can easily figure out if this is your problem: Set up a new Win7
>>>> client without applying the
>>>> updates. If you can preconfigure drivers and connect to the printers
>>>> on this machine, then
>>>> MS16-087 is your problem.
>>>
>>> Tested that but it still fails in the same way. Maybe I should have
>>> mentioned that connecting to the printers and using them to print
>>  > does work. It's just the management part that fails.
>>
>> Even if you applied this patch, your users are able to connect the printer and use it - as long
>> as the driver is already available on the client. This means, if one of your users connected the
>> printer on a workstation before MS16-087, the driver was installed locally. For all users on this
>> host that are connecting later to a printer that uses the same driver, the driver is not
>> downloaded from the print server again (as long as it is not updated on the server).
>>
>> Your situation sounds really like it is caused by this MS update. However, if you tested this
>> with a fresh install without installing any updates, it's unlikely.
>>
>>
>> Can you please go through the following guides:
>> https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server
>> https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clien
>> ts and make sure that everything matches your environment? Especially that you use an account
>> that has the SePrintOperatorPrivilege privilege granted and is able to write to the print$
>> share. I rewrote both guides recently and verified them using Samba 4.5.3 or 4.5.4 on RHEL 7.3.
>> However, I only checked Win8 and 10 (both 64-bit), not Win7.
>>
>>
>> If you verified that your settings matches what we have in our documentation and be sure that
>> it's not related to the MS update, can you please put a level 10 debug log on pastebin (or any
>> other paste service) that contains only the log entries when you click the action that fails?
>> Additionally, your [global], [printers], [print$], and the section of an printer would be
>> interesting.
>>
>>
>> Regards,
>> Marc
>>
>> --
>> To unsubscribe from this list go to the following URL and read the
>> instructions:  https://lists.samba.org/mailman/options/samba
>
>
>
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba