samba - Mar 2017 - Access denied, and other problems, trying to administer printers

Hi all.

We are running Samba 4.4.10 as an NT-domain server on Solaris 10. The server is
also used to store printer preferences and drivers. We are using LDAP as the
passdb backend.

Now we need to change some printing preferences and change one printer driver,
however I can not do any of those things any more (last time I did it we was
running Samba 3.x...).

When I log in to a Win 7 computer as a domain administrator but when I try
to add a new driver, using the Print Management tool, I get Access Denied.
When I try to look att the printing defaults for a printer, I get a message
telling me that the printing defaults can not be shown. Same thing happens
when I try to look att det print settings for a printer.

I have tried "everything" but can not get it to work! Any ideas?

Regards,
Åke Holmlund

Hi Åke,

Am 06.03.2017 um 15:02 schrieb Åke Holmlund via samba:
> Now we need to change some printing preferences and change one printer
> driver, however I can not do any of those things any more (last time
 > I did it we was running Samba 3.x...).
>
> When I log in to a Win 7 computer as a domain administrator but when I try
> to add a new driver, using the Print Management tool, I get Access Denied.
> When I try to look att the printing defaults for a printer, I get a message
> telling me that the printing defaults can not be shown. Same thing happens
> when I try to look att det print settings for a printer.

It sounds like the problem that came up last summer, after MS updated 
the Windows print spooler. For details and how to fix it in a Samba AD, see:

https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients#Creating_a_GPO_for_Trusting_the_Print_Server

You can easily figure out if this is your problem: Set up a new Win7 
client without applying the updates. If you can preconfigure drivers and 
connect to the printers on this machine, then MS16-087 is your problem.

You can have a look at the *.admx files in C:\Windows\PolicyDefinitions\ 
on your Windows client to figure out what registry keys the two group 
policies update and manually set them using a *.reg file on each machine 
or by using NT4 policies. I think this should work.

If it works, please provide me the *.reg file with the settings and I 
will enhance the documentation to work around this problem in non-AD 
environments.


Regards,
Marc

Hi Marc.
> It sounds like the problem that came up last summer, after MS updated the
Windows print spooler.
> For details and how to fix it in a Samba AD, see:
>
>
https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Client
> s#Creating_a_GPO_for_Trusting_the_Print_Server
I have seen that but I guess it does not apppy in my situation (NT-domain).
> You can easily figure out if this is your problem: Set up a new Win7 client
without applying the
> updates. If you can preconfigure drivers and connect to the printers on
this machine, then
> MS16-087 is your problem.
Tested that but it still fails in the same way. Maybe I should have mentioned
that connecting to the printers and using them to print does work. It's just
the management part that fails.

Regards,
Åke