Recursos para Profesionales de TI >
Página principal de foros
>
Terminal Services
>
Printer Redirection not working
Printer Redirection not working
- I have just installed my first Windows Server 2008 Terminal Server into our network. Most of my current production servers are all running Windows Server 2003 R2 SP2 (including our domain controllers). I currently have an existing production terminal server running on Windows Server 2003. Everything works fine on that server. However, the new 2008 TS is not redirecting the client printers.
My client is running Windows XP SP3 with .NET Framework 3.0 SP2 installed. The TS configuration is not configured to prevent printing redirection. The group policies are not configured to prevent printer redirection. The client's configuration is configured to redirect the printers. However, when connected to the TS, if I view the "Printers" folder, all I see is the "Microsoft XPS Document Writer".
Respuestas
- The investigation of Rob's problem was a success, we discovered that the Print spooler security descriptor was altered and thus preventing Terminal Services to read it's state. As a result TS decides that the spooler is not running and disables printer redirection. To work around this problem an ACL that was in the original security descriptor has to be added back. Unaltered SD for print spooler should look like this:
c:\>sc show spooler
D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)
the important ACL in this cases is the one for authenitcated user (AU), since TS runs as a network service it relies on this ACL to be present in order to successfully open the spooler service. Adding the ACL:
(A;;CCLCSWLOCRRC;;;AU)
back fixed the problem. We are unsure what had altered the SD on that machine, so any ideas are welcome.
I also want to hear if anyone else has the same problem on their machine.
Thank You
vladimir
- EditadoJeff Pitsch [MVP]MVP, Moderadorviernes, 24 de julio de 2009 12:49corrected error in command
- Propuesto como respuestaVladimir StoyanovMSFT, Moderadorjueves, 23 de julio de 2009 19:36
- Marcado como respuestaJeff Pitsch [MVP]MVP, Moderadorviernes, 24 de julio de 2009 12:48
Todas las respuestas
- You have to install the drivers of the printer on Terminal servers. For example if your client is attached to a Canon iR C3080/3480/3580 PCL5c printer and you want to get that printer redirected to your terminal server, You have to install the drivers of Canon iR C3080/3480/3580 PCL5c (and not the printer) in the terminal server.
You can perform this action by adding a new printer with Canon iR C3080/3480/3580 PCL5c drivers and deleting it.
or go to the printers server properties in the TS and, drivers tab and add the appropriate driver.
TS 2008 have introduced a new feature called easy print. to bypass these actions. but It will not work with all clients.....
Regards
- Thank you for the reply Abdul. However, I am quite familiar with loading the printer drivers onto the Terminal Server. As mentioned before, I do have a production TS running on a Windows Server 2003.
First of all, I am hoping to use the easy print feature. I do believe that my clients (XP Pro SP3 with .Net 3.0 SP2 & .Net 3.5 SP1) have the minimum requirements to make this work.
Sencondly, I have tried loading the printer drivers onto the Terminal Server, just to see if I could at least get that to work. However, still no luck.
Any other suggestions? - I've just tried logging onto the TS from a Windows Vista client as well as a Windows 7 RC1 client. Neither one of these worked any better.
- Marc,
I am wondering if the event logs on either the client or the server will reveal anything?
Is the Microsoft XPS Document Writer redirected from the client? Or is it installed on the server?
Let us know what you find.
Hope this helps,
Kristin L. Griffin
The Microsoft Windows Server 2008 Terminal Services Resource Kit is available at: http://www.amazon.com/Windows-Server%C2%AE-Terminal-Services-Resource/dp/0735625859/ref=sr_1_1?ie=UTF8&s=books&qid=1245947488&sr=8-1 - Hi Kristin;
The only log added to the client's workstation while establishing a remote desktop session and logging onto the TS is
Log : Security
Type : Success Audit
Event ID : 515
Desc : A trusted logon process has registered with the LSA.
On the Terminal Server, I get 7 "Information" events in the "Application Log", 7 "Audit Success" and 1 "Audit Failure" in the "Security Log", and two "Information" events in the "System" log.
Application Log:
Event ID: 501, Folder Redirection (there are four events like this one)
Description: Successfully applied policy and redirected foler "Videos" to ...
Event ID: 4101, Winlogon
Description: Windows License validated.
Event ID: 9003, Desktop Windows Manager
Desc : The Desktop Window Manager was unable to start because a composited theme is not in use
Event ID: 1, CertificateServicesClient
Desc : Certificate Services Client has been started successfully.
Security Log:
Event ID: 4673, Microsoft Windows security auditing.
Desc: A privileged service was called
Event ID: 4611, Microsoft Windows security authority
Desc : A trusted logon process has been registered with the LSA
Event ID: 4648, Microsoft Windows security auditing
Desc : A logon was attempted using explicit credentials.
Event ID: 4624, Microsoft Windows security auditing
Desc : An account was successfully logged on.
Event ID: 4611, Microsoft Windows security auditing (there are four events like this one)
Desc : A trusted logon process has been registered with the LSA
System Log:
Event ID: 7036, Service Control Manager Eventlog Provider
Desc : The Windows Modules Installer service entered the stopped state.
Event ID: 7036, Service Control Manager Eventlog Provider
Desc : The Windows Modules Installer service entered the running state.
Sorry for maybee giving too much detail. I don't see any real pertinent issues from these events regarding the issues I am having with the Printer redirection, however, I am pulling my hair out with this one and am not making any headway. Any assistance would be greatly appreciated.
As for your second question, the Microsoft XPS Document Writer is not being redirected either from the client. I do see the server's Microsoft XPS Document Writer, but not the client's.
Thanks - For TS Easy Print to work you need to install Terminal Server Role on your server, your client does meet the requirements for Easy Print. It is still puzzling that there's no event log about not finding matching printer drivers. Have you disabled any service? Is "Terminal Services UserMode Port Redirector" service running on the server?
- I have installed the Terminal Server Role on my server. I have not disabled any services and the "Terminal Services UserMode Port Redirector" service is running.
- did you relax the security rights on c:\windows\system32\spool folder?
i noticed something on technet mentioning this with regard to domain controllers.
- Hi - I have also been having this same problem. I get no printer redirection on Windows 2008 Terminal Server at all. I am using 64bit 2008 Server. Same as for Marc, there is absolutely nothing in the events logs to say why. Everything is enabled for default client printer redirection in GPO, all of the devices and services are running on the Terminal Servers, Easy print is set to be used first, etc. Nothing, no client printer redirection, whether they are locally installed or via a (2003) print server. Nothing in the event logs to show the server is even attempting to redirect or why it is failing.
Can anyone please help? - I'm really baffled by these reports, it is defeintely something we haven't seen during development and testing of this feature. At this point I can't say anything about this problem unless I have some sort of remote access to a machine that exhibits the problem.
Hi,
I am having a similar problem, printer redirection is enabled on both the TS and the client. However no printers redirect and no events are logged in the event log. The terminal server has terminal services, easyprint and .net framework 3.5 installed as per microsofts documentation.
However I believe the problem to be related to user rights assigment/service rights as the server I am using has restrictions applied. If I log onto a server that does not have this policy applied the redirection works and if I remove this server from the gpo it works.
Can someone please tell me what user rights and service rights/security easyprint requires to redirect printers?
Thanks- I'm not sure about DCs but regular 2008 servers should be okay once you install the role.
Printing is a pain with Terminal Server, Citrix too (but the Universal driver works well on Citrix - I wish TS had this too!) I have several 64-bit servers and one 32-bit Terminal Servers. I loaded identical drivers & versions for our various printers. Still some users cannot see the printers since those drivers are older or maybe PS where the driver on the terminal server is PCL.
You should see errors on your Terminal Server in the System log and it should be complaining about not having a driver. What would be really helpful would be if the log told us which driver TS is trying to match on the user desktop. - Easy print is the MS equivalent of Citrix's Universal driver. So MS already has that.
Remember, if you don't like easy print you can always use the fallback drivers that were introduced in Win2k3. - Vladimir, I can provide you with access via TS Gateway to one of our Terminal Servers if you are willing to take a look, that would be great. You can email me at rob.ford@chapmantripp.com for access details.
Cheers,
Rob - The investigation of Rob's problem was a success, we discovered that the Print spooler security descriptor was altered and thus preventing Terminal Services to read it's state. As a result TS decides that the spooler is not running and disables printer redirection. To work around this problem an ACL that was in the original security descriptor has to be added back. Unaltered SD for print spooler should look like this:
c:\>sc show spooler
D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)
the important ACL in this cases is the one for authenitcated user (AU), since TS runs as a network service it relies on this ACL to be present in order to successfully open the spooler service. Adding the ACL:
(A;;CCLCSWLOCRRC;;;AU)
back fixed the problem. We are unsure what had altered the SD on that machine, so any ideas are welcome.
I also want to hear if anyone else has the same problem on their machine.
Thank You
vladimir
- EditadoJeff Pitsch [MVP]MVP, Moderadorviernes, 24 de julio de 2009 12:49corrected error in command
- Propuesto como respuestaVladimir StoyanovMSFT, Moderadorjueves, 23 de julio de 2009 19:36
- Marcado como respuestaJeff Pitsch [MVP]MVP, Moderadorviernes, 24 de julio de 2009 12:48
Would specifying the service startup and security option in group policy cause this? Default gpo settings for a service are: Administrators, Interactive and System.
From a command prompt when I type "sd show spooler" I get the program is not recognized. Is this some sort of add-on?
- Thanks once more for all your great effort on this, Vladimir. I have this working now after weeks of pulling my hair out. All of our terminal servers have this problem, so it could well be some application install that has done this but I don't know what at this stage.
The command is "sc", H-NNCSB. - I'm sorry, typo on my side:
c:\> sc sdshow spooler
The default SD for spooler allows admins ( last two letters of the ACL - BA), authenticated users (AU) and system (SY), Network service is not an interactive user and thus will cause this problem. - Hello Vladimir,
I have set up two MS Server 2008 STD server networks in the last two months with TS but let's stick to the one.
I see the redirected printers within the sessions and can select and initiate a print request, however I cannot get any output on my local printers.
The document will show up in the printer queue, spooling, printing,.. deleting. no output to the printer.
I connected the printer directly to the client (an XP OS w/sp3 and .NET3.5sp1), the RDC is set to allow printing and supported P&P devices on both ends, even the external num-keypad works just fine but no printer output. I updated .NET on the server to 3.5sp1 with no effect.
I saw where DOT4 USB printers won't work unles a fix is applied (a MS2003 fix) so I tried that on the XP client with no success... KB link http://support.microsoft.com/default.aspx?scid=kb;EN-US;302361
I checked all the policy settings for terminal services as posted in the KB's one is for MS2008 R2 http://blogs.technet.com/askperf/archive/2007/08/24/terminal-server-and-printer-redirection.aspx but it is essentially the same in MS2008 STD.
I tried the following printers; an HP4000TN, and an HP Color Laserjet 2550 which I hooked up via a USB cable. (this shows up as a DOT4_001 port in printer properties) Had a remote user try with an HP Laserjet 3390. I don't see any errors only warnings (print job in queue is deleted and then the printer is deleted and no longer available to users.. see below) the job runs through the queue as I stated above.
LOG
8- The jobs in the print queue for printer HP LaserJet 3390 Series PCL 6 (redirected 8) were deleted. No user action is required.
4- Printer HP LaserJet 3390 Series PCL 6 (redirected 8) will be deleted. No user action is required.
3- Printer HP LaserJet 3390 Series PCL 6 (redirected 8) was deleted, and users will no longer be able to print to this printer. No user action is required.sc sdshow spooler reports: D:(A;;CCLCSWLORRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
I'm at a loss here... What simple item am i overlooking... any ideas?- EditadoRDPNOGO viernes, 24 de julio de 2009 2:45
- Hi Vladimir,
Yes that has resolved my problem with Printer redirection. Below is the sets I used to resolve the problem. Hopefully this might help other people
Thanks Vladimir for your help!
---------------------------------------------------------------------------------
Terminal server printer redirection not working.Note: Before doing the steps below use RSOP to verify you do not have printer redirection disabled by GPO. Also check that it is not disabled in the RDP-TCP settings in Terminal server configuration manager.Note: This will issue effect both methods of printer redirection (easyprint and standard redirection)The issue: When you set the printer spooler service by group policy this can be cause the Print spooler service permissions to be incorrectly modified. By default when you set a service startup options in GPO the permissions default to
Administrators = FullInteractive = Read
System = FullWhen you run sc sdshow spooler in cmd (command prompt) you receive the followingD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BAA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;IU)The Authenticated user - Read (A;;CCLCSWRPWPDTLOCRRC;;;AU) permissions is missing. This is required for printer redirection to work
To fix: Use GPO edit to configure the print spooler service
Add Authenticated users to the list with Read permissionsWait for the GPO changes to replicate. Then run gpupdate /force on the serverNow run "sc sdshow spooler" you should receive the followingD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)This is the correct security setting.Restart the spooler service and log off the terminal server.Log back on and the printers should be redirected - I may be looking at this sideways and could use some help.... PLEEEASE.
I have set up two MS Server 2008 STD server networks in the last two months with TS but let's stick to the one.
I see the redirected printers within the sessions and can select and initiate a print request, however I cannot get any output on my local printers.
The document will show up in the printer queue, spooling, printing,.. deleting. no output to the printer.
I connected the printer directly to the client (an XP OS w/sp3 and .NET3.5sp1), the RDC is set to allow printing and supported P&P devices on both ends, even the external num-keypad works just fine but no printer output. I updated .NET on the server to 3.5sp1 with no effect.
I saw where DOT4 USB printers won't work unles a fix is applied (a MS2003 fix) so I tried that on the XP client with no success... KB link http://support.microsoft.com/default.aspx?scid=kb;EN-US;302361
I checked all the policy settings for terminal services as posted in the KB's one is for MS2008 R2 http://blogs.technet.com/askperf/archive/2007/08/24/terminal-server-and-printer-redirection.aspx but it is essentially the same in MS2008 STD.
I tried the following printers; an HP4000TN, and an HP Color Laserjet 2550 which I hooked up via a USB cable. (this shows up as a DOT4_001 port in printer properties) Had a remote user try with an HP Laserjet 3390. I don't see any errors only warnings (print job in queue is deleted and then the printer is deleted and no longer available to users.. see below) the job runs through the queue as I stated above.
LOG
8- The jobs in the print queue for printer HP LaserJet 3390 Series PCL 6 (redirected 8) were deleted. No user action is required.
4- Printer HP LaserJet 3390 Series PCL 6 (redirected 8) will be deleted. No user action is required.
3- Printer HP LaserJet 3390 Series PCL 6 (redirected 8) was deleted, and users will no longer be able to print to this printer. No user action is required.sc sdshow spooler reports: D:(A;;CCLCSWLORRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
I'm at a loss here... What simple item am i overlooking... any ideas?
James - RDPNOGO, is your server also a domain controller? If yes, this is a known problem and workaround is available in this article:
http://support.microsoft.com/kb/968605- Propuesto como respuestaRDPNOGO viernes, 24 de julio de 2009 21:48
- Hello Vladimir,
I cannot thank you enough. I overlooked the fact that this is a DC and kept pounding the issue as if it was something wrong with easy print and print redirection.
Steps to correct the issue are in the link http://support.microsoft.com/kb/968605 but I'll give a brief synop;
Either log in as administrator or execute cmd as Administrator
type; cd\windows\system32\spool
type; Cacls.exe PRINTERS /e /g users:C
The response will be; processed dir: C:\Windows\System32\spool\PRINTERS
Reboot the machine and test print through TS to any printer you wish wether a direct connected or IP networked printer.
Now I can sleep again.
James Hello Vladimir;
I've been away for the past 6 weeks. There has been a lot of action on my original thread since I've left for holidays. I have tried everything mentioned here, and still cannot get this to work.
I have verified the permissions on the C:\Windows\System32\Spool\PRINTERS folder and they look fine:
PRINTERS CREATOR OWNER:(OI)(CI)(IO)(R,W,D,WDAC,WO,DC)
NT AUTHORITY\SYSTEM:(OI)(CI)(R,W,D,WDAC,WO,DC)
BUILTIN\Administrators:(OI)(CI)(R,W,D,WDAC,WO,DC)
BUILTIN\Users:(OI)(CI)(M)
I have looked into the ACL for the Print Spooler service. At first, this was not correct. We had a GPO that hat modified the ACL on this service. We've since modified it to inclued the Authenticated Users, but that made no difference. So then, we've tried removing the GPO setting all together, but still no go.
C:\>sc sdshow spooler
D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCR
RC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
I have been pulling my hair out on this all week, not to mention the weeks before I left on holidays!!! Any other Ideas?- I'm just going to toss this out here, because I've just spent the last few hours trying to figure out why my brand new Terminal Server 2008 (not on a Domain Controller) refuses to redirect my printers and this is the best thread I've been able to find regarding this on my too-many-too-count searches.
It's my userid on the domain. I have yet to figure out why, but if I RDP or RemoteApp into my W2k8 TS from either my Vista client or from an XP client using my userid, I get no printers nor do I get any type of error message from either the client or the server.
However, if I use my test account from either XP or from Vista, it works. And it took me hours before I tried that little test, let me tell you.
My main account has admin priviledges on the clients and on some servers, but not on the TS 2008 server.
So right now, I'm at a loss as to why my main userid is preventing Easy Print from redirecting my printers, but I'm going to keep at it. To make things even more funny, if I Remote Desktop into an XP client from my Vista client, my printers are redirected.
Of course, the next test is to actually print. ;)
Vladimir, if you've any suggestions, I'm all ears. I'm just going to toss this out here, because I've just spent the last few hours trying to figure out why my brand new Terminal Server 2008 (not on a Domain Controller) refuses to redirect my printers and this is the best thread I've been able to find regarding this on my too-many-too-count searches.
It's my userid on the domain. I have yet to figure out why, but if I RDP or RemoteApp into my W2k8 TS from either my Vista client or from an XP client using my userid, I get no printers nor do I get any type of error message from either the client or the server.
However, if I use my test account from either XP or from Vista, it works. And it took me hours before I tried that little test, let me tell you.
My main account has admin priviledges on the clients and on some servers, but not on the TS 2008 server.
So right now, I'm at a loss as to why my main userid is preventing Easy Print from redirecting my printers, but I'm going to keep at it. To make things even more funny, if I Remote Desktop into an XP client from my Vista client, my printers are redirected.
Of course, the next test is to actually print. ;)
Vladimir, if you've any suggestions, I'm all ears.
I've struck this before where the User Properties in Active Directory Users and Computers had "Connect client printers at logon" unticked on the Environment tab. Applies to Local Users as well.- Propuesto como respuestaEugB martes, 08 de septiembre de 2009 18:40
I'm just going to toss this out here, because I've just spent the last few hours trying to figure out why my brand new Terminal Server 2008 (not on a Domain Controller) refuses to redirect my printers and this is the best thread I've been able to find regarding this on my too-many-too-count searches.
It's my userid on the domain. I have yet to figure out why, but if I RDP or RemoteApp into my W2k8 TS from either my Vista client or from an XP client using my userid, I get no printers nor do I get any type of error message from either the client or the server.
However, if I use my test account from either XP or from Vista, it works. And it took me hours before I tried that little test, let me tell you.
My main account has admin priviledges on the clients and on some servers, but not on the TS 2008 server.
So right now, I'm at a loss as to why my main userid is preventing Easy Print from redirecting my printers, but I'm going to keep at it. To make things even more funny, if I Remote Desktop into an XP client from my Vista client, my printers are redirected.
Of course, the next test is to actually print. ;)
Vladimir, if you've any suggestions, I'm all ears.
I've struck this before where the User Properties in Active Directory Users and Computers had "Connect client printers at logon" unticked on the Environment tab. Applies to Local Users as well.
Craig - Thank you so much! No idea how that got unchecked on my ID but that was it!Well, thank you all for your help. I've got it figured out. It turns out it was a combination of two thinngs. One: (and this was the real issue) was the problem with the permissions as explained by Vladimir. Two: this was just my stupidity, as Craig mentionned, my own user account had the "Connect Client Printers" unchecked.
Thank you so much Vladimir and Craig!!!
So now, I am attempting to print a document to one of the redirected printers, but it doesn't seem to be using the new "easy print" functionality (ie: the print dialog box is not my client's but the server's). Is there anything else I need to do to turn that feature on?RDPNOGO, is your server also a domain controller? If yes, this is a known problem and workaround is available in this article:
http://support.microsoft.com/kb/968605
Thankyou Vladimir! This solved printing redirection for me.
The additional information is that TS printing worked successfully from installation in August 2008 until a WU download and forced restart sometime around 12 August 2009. It has taken a month to find this solution!
[It is a DC because the client only has one server W2008 X64. It was chosen for TS use before SBS2008 was announced / released.]
Jim Evans
Eclectic Solutions Ltd
Cheshire UK- EditadoEclecticSolutions jueves, 10 de septiembre de 2009 8:09Include Quote
I have a similar issue - Windows 2008 Server with XP clients. If you RDP to the 2008 Server as the local Administrator account, then the printers get redirected as you expect. Any other user, their is no redirection.
This server is not a domain controller and we have the Novell client installed. The "sc sdshow spooler" values look correct. The Group Policy settings (under Terminal Services) have been set.
So, printer redirect works for one user (Administrator which is a local account) and no one else - even though we are set as "administrators".
- Hi Tgcb,
For Domain accounts have you checked that a computer loopback group policy is not cancelling out the printer redirection options or printer redirection is not disabled in Active directory under the Environment tab for each user?
Possibly try running RSOP or gpresult to verify that the GPO setting is correct.
It appears to be something at the domain level if local accounts work.
