none
Windows Server 2008: "Access denied" when adding a tcp/ip printer

    Question

  • I have just installed Windows 2008 server, and am attempting to add my network printers.  When I specify the IP address of the printers it searches for a few seconds, and then gives an "Access denied" message.

    I can ping the printers from the server, and can ping the server from elsewhere on the local network.  The server and the printers are on the same subnet.

    I can create a folder in the System32/Spool/Printers directory.

    I am logged in as Administrator.

    There seem to be no error messages in the event log.

    There have been some discussions about User Access Control.   However, this does not seem to apply as I am the Administrator.


    Saturday, July 19, 2008 2:52 AM

Answers

  •  

    Hi,

     

    I am a little unclear about the network printer you mentioned in your post. Does it mean a printer that attaches on a printer server or an independent network printer?

     

    If for the first scenario, please perform the following steps to test the result.

     

    I. Check Group Policy

    ====================

    1. On the server, logon as administrator

    2. Click Start > Run, type gpedit.msc

    3. Locate Computer Configuration > Windows Settings > Security Settings > Local

    Policies > Security Options

    4. On the right panel, double click "Additional restrictions for anonymous

    connections", ensure it is set as "None. Rely on default permissions"

    5. On the right panel, double click "Digitally sign server communication (always)", ensure it is set as "Enabled"

     

    II. Check Group Policy

    =====================

    1. On the client, logon as administrator

    2. Click Start > Run, type gpedit.msc

    3. Locate Computer Configuration > Windows Settings > Security Settings > Local

    Policies > Security Options

    4. On the right panel, double click "Microsoft network client: Digitally sign

    communications (always)", ensure it is set as "Enabled"

     

    III. Check Security Settings

    ===================

    1. On the server, logon as administrator

    2. Click Start > Run, type regedit

    3. Locate the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

    4. On the right panel, double click the entry restrictanonymous, ensure it is set

    as 0

    5. Click Start > Run, type services.msc

    6. Double click Printer Spooler service, ensure its Startup Type is Automatic

    7. Click Logon tab, ensure "Local System account" is selected.

     

    Now reboot both servers and try to install the network printer again.

     

    If error still persists, please help test the following:

     

    1> Use another Windows server 2008 to install this printer. Does this way success?

     

    2> If using Windows server 2003 to install this printer, what is the result?

     

    3> Test if you can add this printer by UNC path?

     

    If for the second scenario, please ensure printer is compatible with Windows server 2008 and inform me the exact model of printer you try to install. Also, help me test the three steps above.

     

    Hope this helps.

    Wednesday, July 23, 2008 9:20 AM
    Moderator

All replies

  •  

    Hi,

     

    I am a little unclear about the network printer you mentioned in your post. Does it mean a printer that attaches on a printer server or an independent network printer?

     

    If for the first scenario, please perform the following steps to test the result.

     

    I. Check Group Policy

    ====================

    1. On the server, logon as administrator

    2. Click Start > Run, type gpedit.msc

    3. Locate Computer Configuration > Windows Settings > Security Settings > Local

    Policies > Security Options

    4. On the right panel, double click "Additional restrictions for anonymous

    connections", ensure it is set as "None. Rely on default permissions"

    5. On the right panel, double click "Digitally sign server communication (always)", ensure it is set as "Enabled"

     

    II. Check Group Policy

    =====================

    1. On the client, logon as administrator

    2. Click Start > Run, type gpedit.msc

    3. Locate Computer Configuration > Windows Settings > Security Settings > Local

    Policies > Security Options

    4. On the right panel, double click "Microsoft network client: Digitally sign

    communications (always)", ensure it is set as "Enabled"

     

    III. Check Security Settings

    ===================

    1. On the server, logon as administrator

    2. Click Start > Run, type regedit

    3. Locate the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

    4. On the right panel, double click the entry restrictanonymous, ensure it is set

    as 0

    5. Click Start > Run, type services.msc

    6. Double click Printer Spooler service, ensure its Startup Type is Automatic

    7. Click Logon tab, ensure "Local System account" is selected.

     

    Now reboot both servers and try to install the network printer again.

     

    If error still persists, please help test the following:

     

    1> Use another Windows server 2008 to install this printer. Does this way success?

     

    2> If using Windows server 2003 to install this printer, what is the result?

     

    3> Test if you can add this printer by UNC path?

     

    If for the second scenario, please ensure printer is compatible with Windows server 2008 and inform me the exact model of printer you try to install. Also, help me test the three steps above.

     

    Hope this helps.

    Wednesday, July 23, 2008 9:20 AM
    Moderator
  • Without doing any of the steps mentioned in Morgan's post I was able to install a TCP/IP printer and share it.  You need to right click on the Printers windows and choose Run as Administrator-->Add Printer.  If you don't do this Win2k8 will give you an access denied error, since the desktop is run as a standard user.  If you use Run as Administrator, you will see the usual add printer dialog box that gives you a choice of adding a local or TCP/IP printer similar to the Win2k3 wizard.


    • Proposed as answer by WolfyUK Thursday, March 04, 2010 2:47 PM
    • Edited by Tesfaye_SI Saturday, April 09, 2011 1:26 PM
    Monday, September 08, 2008 3:17 PM
  • Hi,

    I have a similar situation.  My print server is Win2k3 Standard x32 SP2.  Client is Win2k8 Server x64 SP1. 

    Client receives "Windows cannot connect to the printer. Access is denied." when trying to connect to printer.  Printer is HP9040 configured with HP's Universal Printing PCL 6 Driver.  I don't seem to be having a problem with a shared Dell printer on the same server.

    I've followed steps I, II, and III as recommended in this thread with one exception - Step I number 4.  W2k3 has no "Additional restrictions for anonymous connections". 

    Looking for some more helpful suggestions!

    Thanks
    Wednesday, September 17, 2008 3:49 PM
  • I too am having this problem. It seems to be ok for some time then something triggers the printer definitions to fail. I am getting my printers from a GPO. The printers are defined on a Windows 2003 R2 Domain controller.

    The printers work fine on other systems but i don't have another windows 2008 server to test with.

    Friday, September 19, 2008 3:43 PM
  •  
    Tesfaye_SI said:

    Without doing any of the steps mentioned in Morgan's post I was able to install a TCP/IP printer and share it.  You need to right click on the Printers windows and choose Run as Administrator-->Add Printer.  If you don't do this Win2k8 will give you an access denied error, since the desktop is run as a standard user.  If you use Run as Administrator, you will see the usual add printer dialog box that gives you a choice of adding a local or TCP/IP printer similar to the Win2k3 wizard.

    I'm only commenting because I ran into the same issue and found this page and 10 seconds later realized what the answer was and wanted to post the alternative to changing default settings on the server.

    Yes, I found this was the solution to my problem as well. Took quite some time to find it because I'm not used to "Run as administrator" as I haven't been using Vista at all and only just started working on a Windows Server 2008.

    Also found this useful article as well: Adding a network printer in Windows Server 2008.

    Thanks

    Tuesday, December 30, 2008 6:53 AM
  • THis helped me as well. Thanks! I had turned on automatic elevation for admins but this one threw me!
    Dave
    Thursday, February 26, 2009 7:37 AM
  • Thanks Tesfaye_SI

    Run as Administrator - Exactly, that was all I had to do to resolve the problem. It doesn't make sense that you are already logged-in as administrator and yet you had to tell the system again that you are signed in as administrator.  I mean this is Windows Server 2008! Microsoft should have fixed the problem by now.

    Although logged-in as sys admin, I have come across a couple of situations where you had to use the "Run as Administrator" in order to perform certain functions. Again it doesn't make sense to me why that is so.

    Wednesday, August 12, 2009 7:25 AM
  • Try to disable UAC, Seen this for more cases than adding printers.

    Just had this happen on 2008 SP1, disabled UAC, no problem seen.

    hth
    • Edited by Carsten_Due Wednesday, August 12, 2009 4:41 PM
    • Proposed as answer by Carsten_Due Tuesday, June 28, 2011 8:02 PM
    Wednesday, August 12, 2009 4:40 PM
  • Thanks for the tip DC_Ranger.

    sahalu
    Wednesday, August 12, 2009 9:56 PM
  • Me too - logged in as administrator on a new server - couldn't add printers, all greyed out. Needed "Run as administrator" as well, but with a twist. The server is Windows Storage Server 2008 64. Once I'd opened the printers folder, I searched in vain for anything I could right-click to "Run as...". Eventually I twigged that I had to first press the "alt" key so I could see the menus. Then "Tools, Folder Options, View, Always show menus". Once done, I could finally take the "Files" menu where the first option is "Run as administrator, Add printer".

    Thanks to Tesfaye_SI for this.

    Phew.

    Only cost an hour pi**ing about! Sigh!

    Richard
    RS
    Tuesday, January 26, 2010 7:46 PM
  • Thanks Tesfaye_SI

    Run as Administrator - Exactly, that was all I had to do to resolve the problem. It doesn't make sense that you are already logged-in as administrator and yet you had to tell the system again that you are signed in as administrator.  I mean this is Windows Server 2008! Microsoft should have fixed the problem by now.

    Although logged-in as sys admin, I have come across a couple of situations where you had to use the "Run as Administrator" in order to perform certain functions. Again it doesn't make sense to me why that is so.

    In Windows Vista, 7, 2008, and 2008R2 even though you may be an administrator on the machine, you are generally (I think always) run as a standard user until you explicitly allow a switch to a user context with full admin rights.  Notepad is a perfect example, you can't save or modify a file to c:\, c:\windows or any other protected location as an administrator with UAC enabled and no auto-elevation settings in place.  If you grant Users the Modify permission on a text file in a protected location and then try opening, editing and then saving that file, it will work without a problem.  I personally like the safe guard.  I may be careful about what I do on a server, but I'm not guaranteed that others will be.

    Monday, August 23, 2010 4:45 PM
  • I was tried your differents solutions, but when i want to install printer wiht UNC path in Local port, i have a message who say that my account is not authorize to install this printer. I was tried without UAC, i am login in domain administrator or local administrator but i don't arrive.

     

    Do you have a solution please ?

    Thanks.

    Tuesday, August 31, 2010 6:12 AM
  • I'm another one who from a Domain Admin account could not install a printer on SBS 2008 (Windows 2008 R1) with SP2 and all Windows Updates.  I turned on always show menus, but Control Panel, Printers still did not have a Run as Administrator option.  I disabled UAC and had no trouble after that.  I don't mind UAC asking me if I really want to do what I asked to do, but I should not have to disable UAC.
    Tuesday, September 14, 2010 10:36 PM
  • You can probably just login as Administrator install from that account.

    Tuesday, August 07, 2012 6:54 PM
  • This was my issue, strange thing I was having was some printers would install others would not. Thanks for your answer!
    Tuesday, January 26, 2016 11:03 PM
  • you can try this !! It could solve your problem.

    http://www.geeksontech.com/an-error-occurred-during-port-configuration-access-is-denied/

    Friday, February 10, 2017 2:44 PM