?
Solved

IIS 5.0 Printing - Non Admin Users Install Refused

Posted on 2003-03-20
10
Medium Priority
?
621 Views
Last Modified: 2012-08-14
** Forgive phrases used as I am not familiar with IIS - picking up the pieces from a departed colleague **
The ability for standard domain users to install printers has been lost.

Using the webpage printing selection screen, only administrators can 'connect' (install) printers.

Normal domain users get as far as clicking on 'connect', a dialogue box appears asking if they wish to install it. After they click OK they get the message -

"Printer Installation Failed You do not have enough privilege to complete the printer installation on the local machine."

This DID work ok. I believe SP3 has recently been applied to our print server. Additionally the print server is in a different domain to to our users but so am I as an administrator.
I have tinkered around with some of the directory permissions etc under IIS but to no avail.


Any suggestions gratefully accepted.
0
Comment
Question by:masefield
  • 5
  • 5
10 Comments
 
LVL 34

Expert Comment

by:arbert
ID: 8181938
That's an error from the local box.

 What permissions do these users have--they have to have explicit permissions to be able to install new printers and hardware....
This isn't and IIS issue....


Brett
0
 

Author Comment

by:masefield
ID: 8182028
These users are all members of a general NT group that has "Load and Unload Device Drivers" privilege.

I did wonder if it was a local problem but couldn't understand why it have a blanket effect?
0
 
LVL 34

Expert Comment

by:arbert
ID: 8182106
Can you change one user to be a LOCAL admin of the machine and see what happens?

Brett
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 

Author Comment

by:masefield
ID: 8193841
Yep, that worked.

I realise this mean that IIS is seemingly not the culprit, but it still puzzles me why on an NT network (hundreds of users) normal domain users would suddenly lose the blanket ability to add printers.

Would this function be in a group policy or something?

As I mentioned before all our standard domain users are members of an NT group that allows them 'load unload driver' abilities.

Any ideas?
0
 
LVL 34

Expert Comment

by:arbert
ID: 8195199
Yep, this could definately be a group policy--has someone been playing with policy editor???

Do you guys run SMS in your shop?

Brett
0
 

Author Comment

by:masefield
ID: 8195468
No SMS here I'm afraid.

NT 4.0 servers for logon and file shares and some 2K's for other things.

From the PDC I tried using the Policy editor to open the config.pol that's in the NETLOGON directory. Unfortunately it came back with an error saying - 'cannot open that file it's not in registry format' etc.

It would appear the file is corrupt, hence the loss of policy priviliges?

It looks as though I might have to go through the backups or create a new file!!
0
 
LVL 34

Expert Comment

by:arbert
ID: 8195478
Yep, that's what it sounds like.  Are there any errors in the servers Event or Application log?

brett
0
 

Author Comment

by:masefield
ID: 8195737
Nothing there as far I can see....

Reading Microsoft KB article 231422, it says you can make standard domain users admins of their machines by following those steps?

Advisable?


0
 
LVL 34

Accepted Solution

by:
arbert earned 800 total points
ID: 8195796
Don't ask me lol :)

All depends on what your company's security policies are.  Do you want people to be able to install and remove software?  Add new devices (modems, external storage they bring from home)....

Most of the environments I've worked in have let "power users" or developers be local admins, but usually not the entire user population.

Brett
0
 

Author Comment

by:masefield
ID: 8195877
I see. It allows full admin function on the workstation.

You're right, we wouldn't wan't that really.

A colleague informs me as far as he can remember the Group Policy didn't have all that much in it. So it looks as though it'll be a piece of cake to create a new one (famous last words)

Thanks for all your advice Brett.
0

Featured Post

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Logparser is the smartest tool I have ever used in parsing IIS log files and there are many interesting things I wanted to share with everyone one of the  real-world  scenario from my current project. Let's get started with  scenario - How do w…
Prologue It is often required to host multiple websites on a single instance of IIS, mostly in development environments instead of on production servers. I am sure it is not much a preferred solution on production servers but this is at least a pos…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question