allow users to change printer ports

I would like to allow users to change the ports their printers use.  I  think subinacl will be the tool to use but not sure how to get this working or if I have the best tool for the job.  I checked AD and there does not appear to be a way of opening the security for a specific group.

Any ideas.

MarkBournAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian PiercePhotographerCommented:
Active directory is not used to manage security on objects such as files, folders or printers.

Thge way to do this is to chnage the security on the printer object (right click and select security), then add the user and grant the "Manage Printers" permission. Normally you woulld put the users into a security group and then grant the permission to the group.

If you want any user to change any printer, then simply grant the Users group (authenticated users or Domain Users) the Manage Printers permission.
0
MarkBournAuthor Commented:
OK.  I might of missed the point I would like to script this.  I know how to do it manually but looking to deploy this out to many clients/  To clarify I would like a specific AD security group to have permissions to change their printer ports.  I think subinacl is the tool to script with just not sure of the syntax to use.
0
hdhondtCommented:
The way I understand it, subinacl is a tool to manage security information. It does not relate to ports. See:

http://www.windowsitpro.com/article/permissions/edit-permissions-with-subinacl.aspx

http://analogduck.com/main/subinacl
0
IT Pros Agree: AI and Machine Learning Key

We’d all like to think our company’s data is well protected, but when you ask IT professionals they admit the data probably is not as safe as it could be.

MarkBournAuthor Commented:
i have read a few articles on Subinacl and it has a /printer option.  It appears there are articles suggestiong people are doing similar to what I need to do but I cannot find an example of this.  

I am looking for a solutioon to how you would go about getting all members of a specific security group access to change their printer ports weather this is the use of subinacl or other methods.  As long as it is a method that I can script or use in AD im am not bothered.

All ideas welcome.
0
hdhondtCommented:
The second link I gave you gives all the commandline options for subinacl, including /printer. It is used to specify the object to provide information on is a printer.
0
hdhondtCommented:
I have a question though: why would you want some users to change the printer port? That will prevent them from printing. And, if users have "manage printer" permissions, they can change ports anyway.
0
MarkBournAuthor Commented:
my users have a printer driver that they use in different branches.  They have multiple tcp/ip ports that pertain to different branches.  They simply need to switch the tcp/ip port to the correct branch.

I have looked at both links and the second link does give detail on this I just need to get a working command line.  I am looking for an easier way to do this as I will have no knowledge of the name of the printer so will have to knock up a script that enumerates the printer list from the print section of the registry that is easy to do and then target each printer with a subinacl command to open the security.  This is doable but the issue with this is If another printer is added further down the line the script will need to be reran.  

I am starting to think it will be easier to make the AD security group concerned part of the local admins or power users group.  Shame windows XP does not have a Print operators group as servers do otherwise I would be on a winner as I could simply give them full control over just printers instead of power user or admin access to the machine.
0
MarkBournAuthor Commented:
I have pushed out a script to make these users AD group part of the local groupo power users.  This allows them to change ports.  It has a side affect of allowing them to change all the printer settings which is what I did not want but on the plus side it does not allow them to add / delete any of the printers.  This is the best I could come up with.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Scripting Languages

From novice to tech pro — start learning today.