none
Point and Print on W2K8R2 terminalserver

    Question

  • Hello,

    I have a Point and Print policy that enables normal users to add print drivers. Thin policy works fine on win7 but not on W2K8R2 terminalserver.

    If a user try’s to add a printer on the ts with not already installed driver he got an error message (German Server, translation below):

    [Window Title]
    Drucker hinzufügen
    Add printer


    [Main Instruction]
    Druckerverbindung herstellen
    Connect to printer


    [Content]
    Druckerverbindung kann nicht hergestellt werden.
    Zugriff verweigert
    Can't connect to printer. Access denied


    [OK]


    Without the policy UAC is prompting for username and password, so the policy is working somehow. As mentioned above this is only a problem on W2K8R2 not on Windows7 Clients.

    I don’t know what I have to configure else on the server to get point and print working as expected on the terminalserver.

    thanks for your ideas
    Andreas

    Tuesday, September 07, 2010 6:59 AM

All replies

  • Does the Windows 7 client and 2008 R2 server get the prompt to install drivers?

    Configuring the Computer Point and Print Restrictions policy allows one to make a connection to a shared printer without any prompts.

    Which Point and Print policy setting are you modifing?


    Alan Morris Windows Printing Team; Search the Microsoft Knowledge Base here: http://support.microsoft.com/search/Default.aspx?adv=1
    Tuesday, September 07, 2010 5:12 PM
  • Hi,

    Thanks for the post.

    Based on your problem description, my understanding is the error message stating "Can't connect to printer. Access denied" is received when trying to add a printer on the TS server. Please correct me if wrong.

    I am wondering if this issue will occur when adding a printer on TS server with Domain Admins account from other clients.

    Please grant the Users group full access to %windir%\system32\spool and sub-folders on TS server. Please also add the Terminal Services Users group.

    In this case, you may also consider using Terminal Services Easy Print

    http://technet.microsoft.com/en-us/library/cc753853(WS.10).aspx

    Hope this helps.

    Miles

     

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Wednesday, September 08, 2010 2:41 AM
  • Does the Windows 7 client and 2008 R2 server get the prompt to install drivers?

    Configuring the Computer Point and Print Restrictions policy allows one to make a connection to a shared printer without any prompts.

    Which Point and Print policy setting are you modifing?


    Alan Morris Windows Printing Team; Search the Microsoft Knowledge Base here: http://support.microsoft.com/search/Default.aspx?adv=1


    It promts to install drivers if the point an print policy is not applied on both systems.

    If the GPO is applied the printer and driver get installed on the Windows7 (this is what die policy should do) but not on the W2K8R2 system if a normal user logs in (Access denied).

    Wednesday, September 08, 2010 11:37 AM
  • Hi,

    Thanks for the post.

    Based on your problem description, my understanding is the error message stating "Can't connect to printer. Access denied" is received when trying to add a printer on the TS server. Please correct me if wrong.

    I am wondering if this issue will occur when adding a printer on TS server with Domain Admins account from other clients.

    Please grant the Users group full access to %windir%\system32\spool and sub-folders on TS server. Please also add the Terminal Services Users group.

    In this case, you may also consider using Terminal Services Easy Print

    http://technet.microsoft.com/en-us/library/cc753853(WS.10).aspx

    Hope this helps.

    Miles

     

     


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Hi miles,

    The problem occurs only when normal users are logged in at the ts and if they try to connect to a printer with no present driver. If the same user log into Windows7 the printer connects and the driver installs without problems. (of course both systems use the same point and print policy).

    I checked permissions on the spool directory on windows7 an w2k8r2 and found no differences. I think it won't help to change something on NTFS rights.

    I also run procmon to see some access problems but no luck.

    Easy Print is no alternative because mostly we use thin clients. (think easy print is only for connecting local printers through RDP)

    thank you so far

    Andreas

    Wednesday, September 08, 2010 11:54 AM
  • I think the failure is when the print drivers are added to the driverstore.  I'm not sure if there are policies that allow users to add drivers to the driver store.  Is the print server 2008 or 2008 R2?  I assume the print drivers installed on the print server are not package aware.

    You can use PkgMgr.exe to add the driver packages to the driverstore on the TS server.


    Alan Morris Windows Printing Team; Search the Microsoft Knowledge Base here: http://support.microsoft.com/search/Default.aspx?adv=1
    Wednesday, September 08, 2010 4:51 PM
  • I think the failure is when the print drivers are added to the driverstore.  I'm not sure if there are policies that allow users to add drivers to the driver store.  Is the print server 2008 or 2008 R2?  I assume the print drivers installed on the print server are not package aware.

    You can use PkgMgr.exe to add the driver packages to the driverstore on the TS server.


    Alan Morris Windows Printing Team; Search the Microsoft Knowledge Base here: http://support.microsoft.com/search/Default.aspx?adv=1


    The print server is R2 too.

    Is there a difference between Windows7 and W2K8R2 in adding print drivers? Because on Windows7 it is working

    I thought point an print is the policy to allow to add drivers to the driver store????

    Now I'm a bit more confused...

    Thursday, September 09, 2010 11:20 AM
  • Is the print driver for the shared printer a packaged driver?

    What is the print driver name?


    Alan Morris Windows Printing Team; Search the Microsoft Knowledge Base here: http://support.microsoft.com/search/Default.aspx?adv=1
    Thursday, September 09, 2010 11:51 PM
  • Hi,

     

    If there is any update on this issue, please feel free to let us know.

     

    We are looking forward to your reply.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Tuesday, September 14, 2010 9:41 AM
  • Hi Alan,

    I think you are right. The problematic drivers are not packaged drivers. Anyway Windows 7 and Windows2008R2 seem to act differently on this kind of drivers.

    What to do with such drivers? Adding them manual on all TS would be the only way?

    Andreas

    Wednesday, September 15, 2010 7:41 AM
  • Hi Andreas,

    I don't know, if you still have this problem, but i'll post my solution, because i've had the same challenge today.


    I've had the problem on a Win2008R2 TS where users should connect their printers over the printserver website http://printserver/printers (win2008 R2 Printserver) but they always got the access denied error.
    After some hours of research I’ve finally created a GPO which affects the IE Protected Mode Settings. I’ve enabled “GPO merge” on TS Servers, so these settings are in the user section of the GPO:

    User --> Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
    Turn on Protected Mode: Disabled

    User --> Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
    Turn on Protected Mode: Disabled

    Everything works fine now and users can connect HP (HP Universal Printer Driver) and Ricoh (Ricoh Universal Printer Driver) Printers within their Terminal Session.

    Christian

    Tuesday, October 19, 2010 1:08 PM
  • Necroing this old post as I came across this issue today and the resolution.

    Just like the GPO for a workstation you set the Point and Print to disabled under computer configuration but you also have 1 more GPO to set.

    Computer Configuration | Policies | Windows Settings | Security Settings | Local Policies| Security Options

    -Devices:  Prevent Users From Installing Printer Drivers

    "Devices: Prevent users from installing printer drivers when connecting to shared printers

    For a computer to print to a shared printer, the driver for that shared printer must be installed on the local computer. This security setting determines who is allowed to install a printer driver as part of connecting to a shared printer. If this setting is enabled, only Administrators can install a printer driver as part of connecting to a shared printer. If this setting is disabled, any user can install a printer driver as part of connecting to a shared printer.

    Default on servers: Enabled.
    Default on workstations: Disabled"

    So for a workstation you didn't have to set this because its disabled by default.  For a 2K8R2 Terminal Server you have to disable this to allow users to make the connection to the networked printer and install the driver.

    ~Chadd

    • Proposed as answer by chadddada Thursday, February 16, 2012 9:21 PM
    Thursday, February 16, 2012 9:21 PM