Trying to resolve a TS Printing issue

[1RobDog1]

I have a client that is setup for Terminal Server Windows 2000 sp4. It is a billing company and they use Medisoft for the billing software. We setup the users all on the default users group on the server. When the user is not an administrator Medisoft will not allow them to print with an access violation error. We found out that medisoft needs the user to be an administrator to print. It works great that way for printing. We cannot afford them to be an administrator since they can do damage and see all the competitors printers and print to them. Medisoft was designed to work on a network LAN environment but not TS. So, I am assuming that is why the user has to be set up as an administrator. The users are launched right into medisoft so they don't see the servers desktop at all. So, my delima now is how do you restrict the client to only see their redirected print(s) or the printers you want them to see and use? I am attempting writing a vbs script to do this but I am having difficulty there trying to find out current logged in user and session. How would you hide the printers you dont want them to see? Here is a script I started with on Microsofts site. I understand it but I am afraid I am looking at it from the wrong angle. Thanks so much for any help at all....

Code:
Set WshNetwork = CreateObject("WScript.Network&quot

Select Case WshNetWork.UserName

Case "Username1"

PrinterPath = "\\Server\Printer1"
PrinterDriver = "PrinterDriver"
WshNetwork.AddWindowsPrinterConnection PrinterPath, PrinterDriver

WshNetwork.SetDefaultPrinter "\\Server\Printer1"

Case "Username2"

PrinterPath = "\\Server\Printer2"
PrinterDriver = "PrinterDriver"
WshNetwork.AddWindowsPrinterConnection PrinterPath, PrinterDriver

WshNetwork.SetDefaultPrinter "\\Server\Printer1"
End Select

-Robert

Thanks
-Robert
System Analyst/Programmer

 

[scquan]

What OS is the client?
Are the printers connected to Servers or clients?
Windows 98 clients have problems when printing to any printers attached to client machines on a domain.


Steve...

 

[dmcse]

Why don't you create a Group for them and give full permissions on the printers to the group?

 

[1RobDog1]

To SCQUAN they have win9x, win2k, winxp. But the Client PCs that have the printer locally attached are on Win2k and Winxp. I came in on someone else's setups and now properly setting up their systems. So, with that being said they have one client that connects to the server under 1 login account through TS. The account is PEDS. So, you have many PEDS listed in the TS manager when they all get connected. They rule they understand is that the PC with the printer attached has to be connected to the server in order for the printer redirection to take place. When that happens all are able to print to it if they have admin privs at the moment. << leading back to my previous issue. To answer your questions the printers are connected to the clients PC's.

To DMCSE I could create a group and have full permissions. The problem is how do you do this on the Session printers. The printers are connected locally to the clients PC when the client connects over the WAN a session printer is created and disappears after they disconnect. I have tried to apply permissions to it but since it gets destroyed on logout. It doesn't retain the permissions each time. That is setting it up from the server in admin mode. It would be nice to hide all printers except the ones you want that account to see. There has got to be away. That is why I was going to try from a admin script approach.

Thanks so much for the replies I hope to learn more about printer redirection and the way TS handles printers etc...

Thanks
-Robert
System Analyst/Programmer

 

[1RobDog1]

To SCQUAN >> Correction to They rule they understand is that the PC with the printer attached has to be connected to the server in order for the printer redirection to take place.

Corrected:
The rule they understand is that the same printer driver needs to be installed on the server and client PC that is connected to the server through TS. Also that same client PC needs to have the printer connected on lpt com or usb.

Thanks
-Robert
System Analyst/Programmer

 

[1RobDog1]

I setup group policies today and it didn't seem to work. Unless there is a admin template file I could download for this issue...

Thanks
-Robert
System Analyst/Programmer

 

[1RobDog1]

Ok, my vbs code has evolved into this. I plan to make it user specific based on the case username above. I can get the printer name from the session printer. Now if I can figure out how to only show that printer. I will post what I come up with later for other to use unless I find another way ))

dim regedit, DefaultPrinter, whereIsComma, TSPrinterName
set regedit=CreateObject(&quot;WScript.Shell&quot

DefaultPrinter=regedit.RegRead(&quot;HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device&quot

'Extracts the printer name on the TS. Example: HP LaserJet 5/machinename/Session 1
whereIsComma = InStr(DefaultPrinter,&quot;,&quot - 1
TSPrinterName = Left(DefaultPrinter,WhereIsComma)

PosTemp = InStr(TSPrinterName,&quot;/&quot
EndTemp = Len(TSPrinterName) - PosTemp
TempStr = Right(TSPrinterName, EndTemp)
PosTemp = InStr(TempStr,&quot;/&quot
EndTemp = Len(TempStr) - PosTemp
TempStr = Right(TempStr,EndTemp)
Pos2 = InStr(TempStr,&quot; &quot
End3 = Len(TempStr) - Pos2
SSID = Right(TempStr,End3)
ShareName = &quot;TSPrinter&quot; + SSID
TSPrinterName = chr(34) + TSPrinterName + chr(34)

Set WshNetwork = CreateObject(&quot;WScript.Network&quot
PrinterPath = Left(DefaultPrinter,WhereIsComma)

msgbox PrinterPath

'Convert forward slashes to back slashes for the proper unc
'For i = 1 To Len(&quot;/&quot
' ' Replace the i-th unwanted character.
' PrinterPath = Replace(PrinterPath, Mid(&quot;/&quot;, i, 1), &quot;\&quot
'Next

'WshNetwork.AddWindowsPrinterConnection PrinterPath

'WshNetwork.SetDefaultPrinter TSPrinterName

Thanks
-Robert
System Analyst/Programmer

 

[1RobDog1]

Ignore the last piece of code that has been commented out. I am experiementing with the AddWindowsPrinterConnection and Remove function. It doesn't work on TS session printers. It can't find \\SERVER\PrinterName\MachineName\Session1. So I can't use those to add or remove like...

PrinterPath = &quot;\\SERVER\PrinterName\MachineName\Session1&quot;
WshNetwork.AddWindowsPrinterConnection PrinterPath

Thanks again for any help you can assist...


Thanks
-Robert
System Analyst/Programmer

 

[scquan]

Hi,

You have not stated wheteher or not you are on a domain or a workgroup. From the problems you are having it sounds like you are on a workgroup.

If you are a on a domain your users do not need to be administrators to use the printers. Make sure that thay are a member of a group that is a member of Domain Users and print Operators. Then assign that group to to each printer on the server by default everyone has rights to access the printers on a domain. If you want to assign different users to different printers and deny access to others then set up a group for each printer and assign the users to that group.

If you are on a workgroup then EVERY user that needs to use that printer has to be added to EACH workstation that has a printer attached. It is much easier to manage if it is on a domain.

I have also found that if you log on locally to the Terminal Server (not through terminal services) and add the printers they are not allocated a session and stay permanent.

Steve...

 

[1RobDog1]

SCQUAN Im sorry they are on a domain. By default the users can print from within the TS if medisoft is not loaded. Once medisoft is loaded they can't with default permissions or any others including Printer operators. Medisoft is somehow unable to print with any other permissions other than administrators. This is my delima. I have not tried just assigning say Sally to the administrators group and only assigning the Sally account to her printer. I will try that and see what happens. This may not work since the printers are destroyed on logout unless its stored in the profile. Crossing my fingures...

Thanks
-Robert
System Analyst/Programmer

 

[Digit611]

RobDog, I was wondering if you were having these issues with Medisoft version 7.02?

 

[smartertechnology]

Has anyone been able to figure out how to solve this problem? RobDog, please post if you have!

I have a similar situation and Microsoft Support is currently stumped!!

I have a term. server on a workgroup, clients connect via the Internet. Some of them need Power User rights to run a particular application (RunAs didn't work, BTW.) But as Power Users, they see all the redirected printers on the server, which is bad because some belong to other people (plus it's just plain confusing for them.) So to reiterate:

Is there a way to change the default permissions assigned to redirected printers (on a Win2K Advanced terminal server?)

Thanks all for any help. If Microsoft gets back to me, I'll be sure and post the result.

 

[VinceF]

There is a cool utility call TQ RunAs. It is great for working around these types of issues.

Basically it replaces the executable with its own sript like file and you can set the user permissions, in this case it could be an administrator.

The benefit here is that you run the app with admin rights, but everything else is still controlable, and the printers become a non-issue.

 

[smartertechnology]

I found a solution to my problem:

The terminal server needed to be set in Windows NT 4.0 permissions compatiblity mode so the legacy applications could run without me having to set the users as Power Users. Since they're regualr users, they only see the printers their individual workstations redirect.