Click here to get back home

Allow user to install local printer without print operators member
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Allow user to install local printer without print operators member Ferdy 08-10-2006
Posted by Ferdy on August 10, 2006, 11:44 am
Please log in for more thread options
 Hello people,

I was wondering, is it possible to allow a user, which is not a member of
the built-in print operators group, to install local printer drivers on a
Windows Server 2003 Domain Controller?

I've tried Aaron Margosis' tip (using TweakUI, see:
http://blogs.msdn.com/aaron_margosis/archive/2005/04/18/409105.aspx) but this
didn't work for me...

If anyone knows a way to do this, please let me know!

thanks in advance,

regards
Ferdy

Posted by John on August 10, 2006, 2:19 pm
Please log in for more thread options
 Select Start/All Programs/Administrative Tools/Domain Security Policy
Then select Local Policies/User Right Assignment/Load and Unload device
drivers

Add the user or group and that should work. You can also do this on XP
boxes where the users are a member of the USERS Group and need to install
local drivers. The only difference in the server and client is Domain Sec.
Policy vs. Local Domain Policy.

Hope that helps!
John

"Ferdy" wrote:

> Hello people,
>
> I was wondering, is it possible to allow a user, which is not a member of
> the built-in print operators group, to install local printer drivers on a
> Windows Server 2003 Domain Controller?
>
> I've tried Aaron Margosis' tip (using TweakUI, see:
> http://blogs.msdn.com/aaron_margosis/archive/2005/04/18/409105.aspx) but this
> didn't work for me...
>
> If anyone knows a way to do this, please let me know!
>
> thanks in advance,
>
> regards
> Ferdy

Posted by Ferdy on August 10, 2006, 3:53 pm
Please log in for more thread options
Hi John,

thank you for your reply!

Sadly though, specifying this policy for the user didn't solve the problem...
The user still doesn't get the option to choose "install local printer"
(it's still greyed out...)

"John" wrote:

> Select Start/All Programs/Administrative Tools/Domain Security Policy
> Then select Local Policies/User Right Assignment/Load and Unload device
> drivers
>
> Add the user or group and that should work. You can also do this on XP
> boxes where the users are a member of the USERS Group and need to install
> local drivers. The only difference in the server and client is Domain Sec.
> Policy vs. Local Domain Policy.
>
> Hope that helps!
> John
>
> "Ferdy" wrote:
>
> > Hello people,
> >
> > I was wondering, is it possible to allow a user, which is not a member of
> > the built-in print operators group, to install local printer drivers on a
> > Windows Server 2003 Domain Controller?
> >
> > I've tried Aaron Margosis' tip (using TweakUI, see:
> > http://blogs.msdn.com/aaron_margosis/archive/2005/04/18/409105.aspx) but this
> > didn't work for me...
> >
> > If anyone knows a way to do this, please let me know!
> >
> > thanks in advance,
> >
> > regards
> > Ferdy

Posted by Joe Richards [MVP] on August 11, 2006, 4:45 pm
Please log in for more thread options
You don't want anyone but domain admins installing any kind of system
software including drivers on DCs. That would allow them to completely
do any and everything they wanted to do regardless of anything else, you
might as well make them Enterprise admins because if they want it you
certainly won't be stopping them from getting it.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Ferdy wrote:
> Hello people,
>
> I was wondering, is it possible to allow a user, which is not a member of
> the built-in print operators group, to install local printer drivers on a
> Windows Server 2003 Domain Controller?
>
> I've tried Aaron Margosis' tip (using TweakUI, see:
> http://blogs.msdn.com/aaron_margosis/archive/2005/04/18/409105.aspx) but this
> didn't work for me...
>
> If anyone knows a way to do this, please let me know!
>
> thanks in advance,
>
> regards
> Ferdy

Similar ThreadsPosted
Sharing a Local Printer in Terminal Server December 5, 2006, 2:50 pm
Sharing a Local Printer in Terminal Server December 5, 2006, 2:50 pm
What permissions to change local printer port June 30, 2008, 2:41 pm
Is local system account member of local Administrators group? June 21, 2005, 11:33 am
Printer installation & Group Policy / User Rights November 9, 2005, 8:33 am
Local install permission December 19, 2007, 3:31 am
How to list member of local admin February 6, 2008, 1:23 pm
How to allow standard user to install an application August 18, 2005, 6:51 am
Automatic certificate enrollment for local system failed after upgrading member server to domain controller August 25, 2005, 6:11 pm
How to let user group member to share files and folders August 26, 2006, 12:16 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap