Problems with print managment feature on Win2k3 R2

[pauljb]

Hi everyone I hope someone can shed some light on this I am stumped!
We have a win2k3 domain and 2 win2k3 R2 domain controllers in a cluster, the cluster is a print server, one of the nodes is using the print management msc.

I am trying to deploy some new printers via GP to our client machines, so i thought I'd use the new printer management feature of R2 which is great, the only thing is our users aren't local admins, some have power user rights but most are standard users. So as we know when you add a printer connection you need to load drivers to the client machine even if it's a network printer i.e. \\printerserver\printer.
If our users try to do this by browsing to \\printerserver\printer, right clicking and connecting they get the usual message that it has been restricted etc. So when I try deploy the printer via GP I get this error logged on the client machine:

"... Found Deployed Printer Connection setting \\sts-fpsc\MFD-Projects01 in Active Directory.
... Registry search for installed printers failed. The system cannot find the file specified.
... Deploying per machine connection \\sts-fpsc\MFD-Projects01"

Then we get the printer in the printers and faxes window but it says unreachable, if you log in as admin re-start the print spooler then log back in as the user it works!

I understand why it doesn't work, because the user has no rights to install the driver but why provide a tool that only works if you allow users admin privileges?

So my question is: Is this printer management tool relevant in a domain with clients who don't have admin rights, and don't have rights to install printers? and if it is relevant then how the heck do you get it to work!?

Any thoughts would be greatly appreciated

 

[pauljb]

ok I found the answer:
Had to specify exact print server that users were allowed to point and print to in Group Policy under:

User Configuration
Administrative Templates
Control Panel
Printers

Policy Setting:
Point and Print Restrictions: Enabled
Users can only point and print to machines in their forest: Enabled
Users can only point and print to these servers: Enabled
Enter fully qualified server names separated by semicolons: <print server name>

By default, this policy setting is not configured. If you do not configure this policy setting, users cannot download Point and Print drivers from computers that are not in their Active Directory forest. The result of not configuring the setting is the same as enabling the policy and setting it to Users can only Point and Print to machines in their Forest.

This certainly wasnt the case for us, I had to explicitly specify which print server users were allowed to print to in the GP setting. The print server was the DC and we only have one forrest..... V strange :-|