Allow Print Operators to Add Printers to Domain Controllers

I need to arrange for a limited number of our desktop engineers to be able to add printers to our 2K3 SP2 DCs.

I've tried a few things with no success.

1.  Created separate AD group and placed new group as member of Print Operators
2.  Amended the permissions on HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors on each of the DCs to allow Print Operators full control.
3.  Changed domain delegate control so that new AD group has full control over print objects

And whenever those users try to add a printer they're still immediately told on double clicking "Add Printer" that they don't have sufficient rights to add printers to <dc name>.

Any ideas where to look from here?

LVL 3
davewlAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

davewlAuthor Commented:
Also tried giving the Print Operators group ability to load and unload device drivers through Group Policy.

Still not playing.
0
rhandelsCommented:
Hey,

If your users are creating a printer on a server they should have the correct permissions on that server itself, being a member of the print operators locally. It might be that something strange happenend there.
Do you see anything in event viewer when they are trying to add printers?
0
davewlAuthor Commented:
Bear in mind these are DCs so there are no local user groups.  I'm guessing that whatever is wrong it's going to have to be resolved through domain rights.

The event logs also rather unhelpfully show nothing.
0
rhandelsCommented:
hmm... Even if you have a domain, you still have local groups you need to access..
If you look at a server, you will see there is an administrators group. Because the server joins the domain, the domain admins will automatically be added to the local administrators group on that server. This is just a long shot btw, but my guess is you shoul;d be looking at the server itself. Halfway the installation it only asks you to add the printer to the domain.
0
davewlAuthor Commented:
Member servers of a domain continue to have local user groups.

The domain controllers themselves don't - and these are the actual domain controllers and not member servers.

Anyway - the answer to my question seems to be one of patience.  About twelve hours after I amended the delegate control and the group policy change it all suddenly started working.  And this is despite several gpupdate /force runs while I was testing at the time.

So we'll put this one down to some sort of weird and wonderful replication/group policy interval.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.