2K3 Domain Controller - Can't add local printer

[RogieRog]

Hello fellow geeks!

I'm having a strange issue. I cannot add a local printer (it is greyed out) on my Windows 2003 Domain Controller. I am logged into the server with the Domain Administrator account. I have looked through gpedit.msc and can't really find anything pertaining to my issue and google has not helped me much on this one. any help you guys could give me would be greatly appreciated!

Thank you in advance!!

~Roger

 

[nsanto17]

Move your username and computer account to a different OU that does not have any Group Policies applied.

 

[RogieRog]

Neither the computer account nor the administrator account are in OUs that GPOs are applied to!

 

[nsanto17]

Is this the only Server in your domain or do you have any other DC's or member servers?

 

[w33mhz]

Check your installed windows components. There maybe a security pack installed on the server that is not allowing you to add a local printer. Also check what security template you are using.

 

[w33mhz]

The Secure and HiSecure templates removes all users from the Power users group. So you could just check the local groups and verify that domain admins are in those groups.

 

[RogieRog]

There are no local groups on this server as it is a domain controller.

 

[RogieRog]

I have other Domain Controllers and member servers. On every 2K3 Domain Controller I am unable to install local printers. On 2K3 member servers I can install local printers just fine.



On 2000 Domain Controllers and member server I can install local printers fine.

 

[nsanto17]

I am not sure if this will help but check the setting in the Default Domain Controller Seurity Settings in the Admin Tools.

 

[RogieRog]

NSanto:

Nothing in there....

 

[Titleist]

Make sure the Spooler service is running....

 

[RogieRog]

Spooler is running!

I am losing more hair on this!

 

[nsanto17]

What about if you log into the server with a different user ID that has Admin Rights?

 

[RogieRog]

I've tried logging into the server with my personal account, which is a member of Domain Admins. Same result.

 

[nsanto17]

Try this...

From your workstation while logged in as an account that has admin rights

start --> Run --> //<servername>

double click on printers and faxes and click add printer.

see if that works.

That should let you add a printer to a remote machine.

 

[RogieRog]

Hmmm,
Interesting. While logged in as my personal account (part of domain admins), I get "you do not have sufficient provileges to add a printer on \\servername. Do you want to run this command as a different user?"


I say Yes, and type in domain\administrator and get the following error "Operation could not be completed. Access is denied."


This has got me confused!

 

[nsanto17]

That leads me to believe that it is a security issue of some sort? Did you build this server or did someone else?

I am still thinking on this... It has me stumped too.

 

[w33mhz]

OK, here's what you need to do, open up your local group policy settings, expand Computer Configuration, expand windows settings, expand local policies, expand security options. There is a setting in there called "Devicesrevent Users from installing printer drivers." If it is enabled change it to disabled. You may need to check that it is not set in a group policy somewhere that is applied to that server, if that doesn't work.

 

[RogieRog]

Someone else configured this server...





That local policy is disabled. There are no GPOs that have that policy configured....grrrr

 

[nsanto17]

The only other thing i can thik of is some sort of Registry key/and or Hive has been played with.

Call Microsoft.