XenApp Terminal Server - Remove Printer in User session removes Printer from all logged on users!
Dear Comunity
I have a strange behavior on my XenApp 7.5 Terminal Server farm.
Some background information:
Citrix XenApp 7.5 on Windows 2012 R2 (all avaliable Windows patches installed)
Running on VMware vSphere 5.5.0
Print Server running on Windows 2012 R2
Printer in use :
Now the following thing is happening. A user on the XenApp server is adding a printer and later the user is removing the printer, the printer is not only removed in the session of the user, the printer gets removed from all users logged on the same terminal server. User has no admin rights.
Printers are not redirected from the client workstations. The printer drivers are installed directly on the terminal server.
Did someone experienced the same issue with Windows 2012 R2?
Best regards
I have a strange behavior on my XenApp 7.5 Terminal Server farm.
Some background information:
Citrix XenApp 7.5 on Windows 2012 R2 (all avaliable Windows patches installed)
Running on VMware vSphere 5.5.0
Print Server running on Windows 2012 R2
Printer in use :
Now the following thing is happening. A user on the XenApp server is adding a printer and later the user is removing the printer, the printer is not only removed in the session of the user, the printer gets removed from all users logged on the same terminal server. User has no admin rights.
Printers are not redirected from the client workstations. The printer drivers are installed directly on the terminal server.
Did someone experienced the same issue with Windows 2012 R2?
Best regards
ASKER
Hi Spike99
Thanks for your answer.
I checked the user permissions and they are not added to Administrators, Print Operators or Power Users.
About your question, how they installed the printer driver. I installed all Printer Drivers on the Terminal Server with my administrator account. This way, the drivers are available if a user attach the printer. User cannot add printers from the Print Server if I did not install previously the printer driver with my administrator account. I checked that to be sure.
About your question: how was this user able to install & then remove a printer on the server without Admin rights? Actually they cannot install or uninstall the printer driver. Users can only attach or detach printers. But if a user detach a printer, the printer is detached on all logged in users.
Many thanks and best regards
Thanks for your answer.
I checked the user permissions and they are not added to Administrators, Print Operators or Power Users.
About your question, how they installed the printer driver. I installed all Printer Drivers on the Terminal Server with my administrator account. This way, the drivers are available if a user attach the printer. User cannot add printers from the Print Server if I did not install previously the printer driver with my administrator account. I checked that to be sure.
About your question: how was this user able to install & then remove a printer on the server without Admin rights? Actually they cannot install or uninstall the printer driver. Users can only attach or detach printers. But if a user detach a printer, the printer is detached on all logged in users.
Many thanks and best regards
the ability to add/remove printers can be delegated to non-admin users. On the Citrix server, open up the Devices and Printers window, single click on any printer to highlight it. Then, click on the "Server Properties," check to see if that user or any group he's a member of a group that has elevated rights for the printers.
By default, the EVERYONE group is allowed "print" & "view server" rights. If his account has "manage server" rights, that might explain why he was able to add & remove a printer that all users could see.
Here's a TechNet article on print server rights:
http://technet.microsoft.com/en-us/library/jj190062.aspx
By default, the EVERYONE group is allowed "print" & "view server" rights. If his account has "manage server" rights, that might explain why he was able to add & remove a printer that all users could see.
Here's a TechNet article on print server rights:
http://technet.microsoft.com/en-us/library/jj190062.aspx
ASKER
Hi Alicia
Thanks for your comment. Let me check this. Many thanks!
Thanks for your comment. Let me check this. Many thanks!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
this patch solved my windows issue
If the printers are not redirected and are installed directly on the Citrix server, unless the printer's security was edited to prevent everyone from seeing it, everyone will see that printer. Then, if it gets removed, it will be removed for everyone.
So, the question is: how was this user able to install & then remove a printer on the server without Admin rights? Look at the groups that user belongs to and make sure none of those groups have admin rights or print operator rights on the server.