Published Printers to AD not showing up

[candyman200]

I've got several printers being shared on a print server and even though the "Publish Printers to AD" is checked they are not showing up anywhere in AD U&C. Using the Add Printer Wizard nothing shows up when I search the directory. I have a location entered on all printers and even if I filter by location nothing comes up. The only way I can add printers is to browse for it using \\servername\ (after typing the last "\" I get the list of available printers).

I've notice printers "disappearing" from AD on-and-off for a while so I'm guessing there's a domain replication SNAFU happening but I can't find/document it.

Any suggestions would be helpful.


*** Fix what's broken, whether it's a machine or a process. People don't need to be burdened by problems that could be corrected.

 

[ITPangaeaArchitect]

I assume you attempted publishing the printer manually in AD as well?

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.

 

[candyman200]

I found a TechNet article on manually publishing printers to AD using pubprn.vbs - we're running Server 2003 and it does not work with it (forgot to include that detail). If you know of another way, please let me know. I have 2 printers on other print servers that are published so I'm thinking it's a deeper issue.

I found a GPO that might address this issue - Checked Publish State is by default not configured which (appears) to indicate published printers are only checked on startup so if a replication occurs that wipes out published printer, unless you reboot the print server the printers will remain MIA.

Let me know your thoughts.




*** Fix what's broken, whether it's a machine or a process. People don't need to be burdened by problems that could be corrected.

 

[ITPangaeaArchitect]

are you setting any printer related policies that you are aware of?

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.

 

[candyman200]

Thanks ADgod for following up on this one ...

No policies for printers are set up. I've seen this before and it appears to correct it self over time. Because of that I'm thinking it could be because AD is not refreshing the published printers until there's a reboot. In that case, if a remote print server (also a DC) reboots it will refresh it's list then replicate it thru the domain. If local print servers (DCs too) don't reboot they'll only know the remote server's printers. I just tested this theory ... we had to reboot a server at one location and now all their printers are showing up.

We don't add a lot of printers here but having them searchable in AD is a lot easier. It looks like we've found a solution - now to test it.

*** Fix what's broken, whether it's a machine or a process. People don't need to be burdened by problems that could be corrected.

 

[ITPangaeaArchitect]

print spooler should not be running on the DC...major security risk If at all possible, you should move print server functions away from being hosted on a DC.

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.

 

[candyman200]

I agree, plus if you need to bounce the print server you won't mess up and DC functionality. ... but my boss wants it that way so that's how we're running it. If you can offer up some security risk points I'd be glad to move away from this model. Thanks for pointing this out.


*** Fix what's broken, whether it's a machine or a process. People don't need to be burdened by problems that could be corrected.

 

[ITPangaeaArchitect]

the print spooler service has several vulnerabilities, most of which involve the ability to take control of a system. Your entire company will be down if a new exploit occurs and you are exploited.

The print spooler can also have the effect of utilizing resources needed by the DC.

Now if you are in a small environment, its probably not a big deal.



-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Sr. Infrastructure Management Analyst
Distributed Systems Engineering
ACS, Inc.

 

[Dareaper9]

Hey Candyman,

what was the solution you came up with? I have just run into this problem as well...I have a W2k3 print cluster, and you can't see printers when you browse. You can see them if use the UNC path though...

 

[candyman200]

We haven't tested this yet but it seems to be the solution:

Default Domain Controller GPO: Computer Configuration / Administrative Template / Printers … Checked Publish State is "Not Configured" which is described "Directs the system to periodically verify that the printers published by this computer still appear in Active Directory. This setting also specifies how often the system repeats the verification. By default, the system only verifies published printers at startup. This setting allows for periodic verification while the computer is operating." My understanding is that if we enable this policy and set a specific time then AD will verify printers marked as "Publish" will be refreshed in AD.

We had to reboot a print server and the printer list was republished. Setting the GPO to refresh the priniter list seems to be the most logical fix.

Sorry for the late listing - since we didn't test I didn't want to post a "WAG".

*** Fix what's broken, whether it's a machine or a process. People don't need to be burdened by problems that could be corrected.

 

[Dareaper9]

No problem...There are also a couple other settings that you may want to look into besides the Checked Publish State...

You may want to make sure "Printer Browsing" is enabled, and you may want to disable "Pruning of Published Printers."

Let me know how it goes...I will certainly give you an update on how it unfolds on my side...Thanks again for the tips...