Solved

Point and Print Restrictions Missing in Computer Configuration Server 2008 R2

Posted on 2012-03-19
11
5,094 Views
Last Modified: 2012-03-22
Hello all!

I would truly appreciate any help you all can give me on this. I have been working on creating a new print server for my company. It is running on Server 2008 64 bit. I've installed both 64 and 32 bit drivers and am getting ready to deploy to our Windows 7 clients. I have ran into one HUGE!!! problem. Minus our IT department, everyone is a non-admin.

About two weeks ago I began the great Google search to see how to allow this. We have decided that we want to use Group Policy to allow non-admin users to add printers. I found articles about which settings we need to change. I find one in User Configuration -->  Administrative Templates --> Control Panel --> Printers --> Point and Print Restrictions. We disable it, push the group policy out to a non-admin user I created and it works like magic!!

I go to test it on a non-admin user on a new PC. Everything is going fine... until it asks me for the password!!! I do more research and I find out there is a very similar setting in Computer Configuration. I go in there and look in both Administrative Templates --> Printers and Administrative Templates --> Control Panel --> Printers. It's not in either place. Grrrrrr! I do more research and am getting 20 different answers. I get one person saying I can download something and import that policy, I have other saying don't use that setting us this. I think we have changed like 10 setting now for the OU we needs group policy and we can not get it to work.

We would be more than willing to try importing the setting. Our concern becomes if we import more administrative templates, will this remove any settings we have on ones that are still there?

If anyone can offer me any advice, I sure would be appreciative!

Thanks in advance!

Jami
0
Comment
Question by:JamiBenson092279
  • 6
  • 5
11 Comments
 
LVL 3

Expert Comment

by:BigRedRPB
ID: 37742216
I opted for the Computer Policy and I pushed it to all of our desktops/servers.  Using Windows 7 and Group Policy Preferences to push the printers, I've had good luck on all of our non-admin users.  Below is what my settings look like along with my notes (I used to use a VBS login script to push the printers, which also worked fine).

I did not have to import any policy settings in order to make this work, I just edited the policy using a Windows 7 computer and the setting was there.  We are NOT running in Windows 2008 AD mode so you shouldn't have an issue running in 2003 mode.

Group Policy Screenshot
0
 

Author Comment

by:JamiBenson092279
ID: 37742294
I appreciate the post BigRedRPB. Unfortunately we have about 45 printers. Some people stay at their desks, but many of our users have laptops and roam around the plant and building all day, printing to different printers, so a logon script doesn't work. We don't want 45 printers installed on each PC.

We have opened it on a Windows 7 PC and it is still not there.

Thanks for your comment though.
0
 
LVL 3

Expert Comment

by:BigRedRPB
ID: 37742313
Hi Jami,

I probably made our setup sound kind of basic.  We have around 200 printers.  The login script was used to install printers for the user based on which computer they logged onto.  This allowed our users who roam from office to office to have the local printers when they got to that office.  You have a somewhat opposite setup, but still easy to setup as you could install printers by Site, IP, etc.  Group Policy Preferences works pretty well.

Anyway, that's off topic.  :)  So, you're Group Policy doesn't look like this at all?

Policy
0
 

Author Comment

by:JamiBenson092279
ID: 37742409
Howdy again BigRedRPB!

It looks exactly like that. The difference is I don't have many of the options you do. Specifically the point and print restrictions one. Of course that's the one I need, or at least told I need.

I just need users to be able to install printers and drivers they never have before without getting admin prompts.

I've gotten like 20 answers about how to do this and the point and print restrictions seem the simplest.

Thanks so much for the reply.

Jami
0
 
LVL 3

Accepted Solution

by:
BigRedRPB earned 500 total points
ID: 37742457
Very odd.  I just looked up Point and Print restrcitions and found this on the MS site:

The Point and Print Restrictions setting can also be found under User Configuration\Policies\Administrative Templates\Control Panel\Printers. This policy is ignored by Windows 7 and Windows Server 2008 R2, but is enforced by earlier editions of the operation system including versions Windows XP with SP1, Windows Server 2003 with SP1, and Windows Server 2008. We recommend that you change this policy setting in both locations so that all down-level clients have a consistent experience.

http://technet.microsoft.com/en-us/library/cc753269.aspx

Given that only Windows 7 and Windows 2008 R2 can see the setting, is it possible that your Active Directory schema has not been extended to the 2008 R2 version?  If not, that may be the issue.  If it has, perhaps your server/desktop is still seeing the old version of the ADMX file.  Take a look here to download the 2008 R2 versions - http://www.microsoft.com/download/en/details.aspx?id=6243
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 3

Expert Comment

by:BigRedRPB
ID: 37742472
If none of that works, you could always import the policy settings directly into the registry using Group Policy Preferences or a script.  Here is what my policy creates:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint

Registry
0
 

Author Comment

by:JamiBenson092279
ID: 37742483
I had saw that same post myself. I set it in User Configuration already.

I am pretty sure I read about downloading and installing the ADMX stuff before was well. My big concern with this was if I install it, will it overwrite any of the other policies I have in place? I'm not the network admin, just the person that is fixing the issue, so if I ask silly questions just bear with me. I have been a network admin recently for another company, just not here.

Thanks again for your help!
0
 
LVL 3

Assisted Solution

by:BigRedRPB
BigRedRPB earned 500 total points
ID: 37742505
No prob Jami.  Nope, you won't overwrite anything.  The policy files are simply templates that expose registry settings.  All of those registry settings are saved in a file in the policies folder but that file (and, actually, even the policy folder) is not touched when you import a new template.  The template is actually copied to whatever machine you are running GPMC on (desktop or server) and only resides there.  The only thing the template is used for is to expose the settings in the registry file.  You're perfectly safe importing new templates.
0
 

Author Comment

by:JamiBenson092279
ID: 37742527
Thank you, thank you, thank you LOL!!! I figured it was like that. I just hate to recommend something if I don't understand it fully. Last time I was an admin for a network, we used very basic settings and they made us install printers as admins so this never came up.

Thank you so much again! I will have our network guy give this a shot and see what happens. I can't thank you enough!
0
 

Author Comment

by:JamiBenson092279
ID: 37754581
Sorry this took so long to get back to you. This would work for us, so I am totally giving you the points. We actually found a clever little work around. What we did is on a local computer we went into gpedit. We enabled the printer browsing policy. We logged off and back on. When we went back in, the point and print restrictions were there!!!

Our talked our network admin into turning on printer browsing on the domain controller. Low and behold, once we logged after we turned it on, Point and Print is there.

Problem solved..... now to fix the javascript on the printer installation  page to automate....

Thanks again for your suggestions!

Jami
0
 
LVL 3

Expert Comment

by:BigRedRPB
ID: 37754692
Glad to hear it worked and thanks for the points!
0

Featured Post

Do email signature updates give you a headache?

Constantly trying to correctly format email signatures? Spending all of your time at every user’s desk to make updates? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today!

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
connection problems 4 16
AD Replications issues 12 46
Can’t delete a file 14 86
DNS Scavenging configuration 5 22
Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
I had a question today where the user wanted to know how to delete an SSL Certificate, so I thought that I would quickly add this How to! Article for your reference. WHY WOULD YOU WANT TO DELETE A CERTIFICATE? 1. If an incorrect certificate was …
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now