samba - Oct 2017 - RSAT Print Management won't show shared printers under the "Printers" section

Hai Mard ans Tomas, 

Just out of interest and maybe this helps also for bug 12761.

Are you still able to test this on a VM? Can you try my samba 4.6.8 package. 

That one contains a patch for printer driver problems. This bug report.
https://bugzilla.samba.org/show_bug.cgi?id=12761  ( reported my Marc itself. ) 
Its more about the 32bit driver upload and delete of drivers, but who knows, i
suggest try it.
Because i dont see this beheavior on my print server with the 4.6.8 package.

My setup is same as yours, i use RSAT in win7 64b for RSAT tools. 
Debian stretch, samba 4.6.8. cups in Point and print setup with kerberos auth
configured.
This server started as debian jessie with samba 4.2.x. has seen 4.5.8 on stretch
and now 4.6.8.

I only noticed on thing, as you if a new printer is added, it takes some time,
but a refesh after about 2-4 sec,
in the printer manager view, shows the printer and i can configure it. 

My apt info : http://apt.van-belle.nl
For Stretch: (4.6.x)
 echo "deb http://apt.van-belle.nl/debian stretch-backports main contrib
non-free" | sudo tee -a /etc/apt/sources.list.d/van-belle.list
 echo "deb http://apt.van-belle.nl/debian stretch main contrib
non-free" | sudo tee -a /etc/apt/sources.list.d/van-belle.list

Now import the public key with :
 wget -O - http://apt.van-belle.nl/louis-van-belle.gpg-key.asc | apt-key add -
And update and run dist-upgrade since samba 4.6 has some extra packages to be
installed.
Make a good backup or /var/lib/samba and /var/cache/samba and /etc/samba 
That, if needed gives the options to revert back to the debian packages. 
> For anyone finding this via Google, as Marc pointed out, the 
> workaround seems to be:
> > As a workaround, on Win 7 you can still assign drivers 
> without using the Print Management console:
Any domain admin, on any windows ( domain joined) pc, can configure the printer
as show above.


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Thomas Keppler via samba
> Verzonden: zondag 8 oktober 2017 19:33
> Aan: Marc Muehlfeld
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] RSAT Print Management won't show 
> shared printers under the "Printers" section
> 
> Hello Marc.
> 
> thanks for the workaround. Seems to work for me.
> I will probably use Windows 8.1 on a management VM just so I 
> can use the Windows 8.1 RSAT tools to work around the issue 
> in the mean time.
> 
> > Can you please open a bug report against Samba 4.7 (see
> > https://wiki.samba.org/index.php/Bug_Reporting) and include the 
> > information from this thread and a level 10 debug log. Thanks.
> I will do my best to open up a bug report during the upcoming 
> week (I want to setup a clean environment for testing and 
> logging). Shall I mention you in it?
> 
> > It seems like a bug or maybe an incompatibility introduced 
> by a recent 
> > Windows 7 update.
> 
> I have tried the Windows 7 IE11 Virtual Machine provided 
> directly by Microsoft. It was last updates on 26th November 
> 2014 by default (Last update: KB2835361). Installed most 
> recent version of RSAT tools on that and I've got the same 
> problem. It might be an issue in the Print Management snap-in 
> itself, though. But we'll find that out sooner or later 
> during the bug report. :-)
> 
> For anyone finding this via Google, as Marc pointed out, the 
> workaround seems to be:
> > As a workaround, on Win 7 you can still assign drivers 
> without using 
> > the Print Management console:
> > - Start / Run
> > - Enter \\print_server_name\, click "OK"
> > - Press the "View remote printers" button There you can 
> right-click to 
> > printers and manage them same as in the console. Win7 was the last 
> > version where you can manage printer this way.
> Alternatively, you can use Windows 10 or Windows 8.1's RSAT tools.
> One caveat by using the technique above seems that printer 
> preferences aren't persisted or only in a way Windows 7 can see it.
> 
> Thank you for being so helpful so far and quick to respond. I 
> hope the bug hunt will reveal what the real issue is here.
> 
> --
> Best regards
> Thomas
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>

Hi Louis,

Am 09.10.2017 um 09:36 schrieb L.P.H. van Belle via
samba:
> That one contains a patch for printer driver problems. This bug report.
> https://bugzilla.samba.org/show_bug.cgi?id=12761  ( reported my Marc
itself. )
> Its more about the 32bit driver upload and delete of drivers,
> but who knows, i suggest try it. >
> Because i dont see this beheavior on my print server with the 4.6.8
package.
I compiled 4.6.8 including the v2 patch from the bug report. However,
it's the same behaviour on Win7: No printers in Print Management Console.


> My apt info : http://apt.van-belle.nl
> For Stretch: (4.6.x)
>  echo "deb http://apt.van-belle.nl/debian stretch-backports main
contrib non-free" | sudo tee -a /etc/apt/sources.list.d/van-belle.list
>  echo "deb http://apt.van-belle.nl/debian stretch main contrib
non-free" | sudo tee -a /etc/apt/sources.list.d/van-belle.list
Unfortunately, I can't test your package. My whole test environment is
RHEL7-based.



Regards,
Marc

Hello Louis,
> On 9. Oct 2017, at 09:36, L.P.H. van Belle via samba <samba at
lists.samba.org> wrote:
> 
> Just out of interest and maybe this helps also for bug 12761.
> 
> Are you still able to test this on a VM? Can you try my samba 4.6.8
package.
I did try out your package (just upgraded Samba), but nothing changed in
behaviour.
Printers are still not showing up in Print Management.
> My setup is same as yours, i use RSAT in win7 64b for RSAT tools. 
> Debian stretch, samba 4.6.8. cups in Point and print setup with kerberos
auth configured.
> This server started as debian jessie with samba 4.2.x. has seen 4.5.8 on
stretch and now 4.6.8.
Hm, how odd... There must be a difference between our setups.

--
Best regards
Thomas

Hm, I really am wondering now:

@Louis: How "recent" is your version of the RSAT tools on Windows 7?
Everything up to date?
If you, in turn, try out the standard Debian 4.5.8 version of Samba, can you
still see printers?
Do you have WINS enabled and working?

@Marc: Good that you can replicate my scenario. :-D

I don't have WINS support just yet with my domain.

--
Best regards
Thomas

Hai Tomas, 

And Marc thank for having a look also.

@ Tomas, now i think you setup is ok, but review it based on my setup below. 
Now, i am using samba 4.6.8 here, but this is working as of 4.2.x.
There where a few small problems, i just cant recall exact what these where. 
If you want to stay in the 4.5 line, then its an option to try my 4.5.14 package
if needed.

I did some testing also, my steps, 
add printer in cups through webinterface, ( other network printers / HP Jet
direct )
Add socket: socket://hostname:9100 
Ext, name disc loc connection: ( socket ) 
Enabled Share This Printer. 

Driver RAW. 
Model Raw Queue
Add printer, banner none. 
Cups result : Printer Test default options have been set successfully.  

Changing to Win7 64Bit pc, start Print management. ( logged in as Admin ( member
of domain admins) )
And.. No Test printer..  When you look directly after creating the printer in
cups.
But, i've waited about 5-10 min, after i added the printer in cups. 
Then a refresh and it did show up in my printer list. 
And from that point i linked the driver, ( the view in Print management does not
show it. )
A manual refresh and the printer is shown with with the driver. 

Now, i browse with my windows explorer to the print server, the test printer is
there.
And as a normal domain user, i connected to this printer and its installed.
*Note, the driver was already deployed to the pc.
So except it takes some "waiting" time, this works fine for me. 

The is a snap of my config(s)

This is my smb.conf. 

[global]
    log level = 0
    workgroup = YOURNTDOM
    security = ADS
    realm = CHANGE.TO.YOUR_REALM
    preferred master = no
    domain master = no
    host msdfs = no

    interfaces = 192.168.0.5 127.0.0.1
    bind interfaces only = yes

    tls enabled = yes
    tls keyfile = /etc/ssl/private/XXXXXXXXXX.key.pem
    tls certfile = /etc/ssl/certs/XXXXXXXXXX.cert.pem
    tls cafile = /etc/ssl/certs/XXXXXXXXXX-ca.pem

    # !Note, samba 4.6.x idmap setup.
    idmap config * :backend = tdb
    idmap config * :range = 2000-9999
    idmap config YOURNTDOM : backend = ad
    idmap config YOURNTDOM : schema_mode = rfc2307
    idmap config YOURNTDOM : range = 10000-3999999
    idmap config YOURNTDOM : unix_nss_info = yes

    dedicated keytab file = /etc/krb5.keytab
    kerberos method = secrets and keytab
    winbind refresh tickets = yes
    winbind trusted domains only = no
    winbind use default domain = yes
    winbind offline logon = yes
    winbind expand groups = 4

    username map = /etc/samba/samba_usermapping
    usershare path 
    vfs objects = acl_xattr
    map acl inherit = yes
    store dos attributes = yes

    veto files = /.bash_logout/.bash_profile/.bash_history/.bashrc/
    hide unreadable = yes

    rpc_server:spoolss = external
    rpc_daemon:spoolssd = fork
    spoolss:architecture = Windows x64
    load printers = yes

    enumports command = /etc/samba/bin/show-ports.sh

# (optional) I change these path locations to my own. 
[print$]
   comment = Printer Drivers
   path = /home/samba/printing/drivers
   acl_xattr:ignore system acl = yes
   browseable = yes
   writable = yes
   guest ok = no
   write list = root, administrator, @"Domain Admins", @lpadmin,
@"Print Operators"

[printers]
   comment = All Printers
   path = /home/samba/printing/spool
   acl_xattr:ignore system acl = yes
   browseable = yes
   printable = yes
   printing = CUPS

# Optional 
The path steps, normaly not needed, but this is how i did setup. 
mkdir -p /home/samba/printing/{drivers,spool}
cp -R /var/lib/samba/printers/* /home/samba/printing/drivers
chmod -R 755 /home/samba
chmod -R 2777  /home/samba/printing/spool


My /etc/cups/cupsd.conf

LogLevel warn
MaxLogSize 0
# Allow remote access 
Port 631
Listen /var/run/cups/cups.sock
ServerName FQDN
ServerAlias *
ServerTokens None
ServerCertificate /etc/cups/ssl/server.crt
ServerKey /etc/cups/ssl/server.key
Browsing Off
BrowseLocalProtocols none
DefaultAuthType Negotiate
WebInterface Yes

The other settings in cupsd.conf are unchanged, i use the debian default where
possible.
The certificates for cups are the same as in samba, but symlinked. 


The "show-port.sh" , uses dedicated hostname for my printers in the
DNS, A and PTR records.
#!/bin/bash
# To change the ports, only adjust the ip range in the line
# for ip in {10..40} ...
# means, start ip 10 until end ip 40
# Your local range is autodetected. ( like 192.168.0 )
# sample, ptr-010 = 192.168.0.10

# We dont want to lose the old printer ports..
echo "Samba Printer Port"
# Default local domain. ( rotterdam.bazuin.nl )
IPRANGE=$(hostname -i | cut -d"." -f1,2,3)
DOMAIN=$(hostname -d)
for ip in {10..40}
do
 echo "${IPRANGE}.${ip}"
 echo "ptr-0${ip}.${DOMAIN}"
Done
## optional. 
# Other remote location
#IPRANGE="10.1.2"
#DOMAIN="other.domain.tld"
#for ip in {11..23}
#do
# echo "${IPRANGE}.${ip}"
# echo "loc-ptr-0${ip}.${DOMAIN}"
#done

( kinit Administrator ) 
SePrivileges, i've set the followin for BUILTIN\Administrators
net rpc rights list accounts -k -S NETBIOS_HOSTNAME 
BUILTIN\Administrators
SeMachineAccountPrivilege
SeTakeOwnershipPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeRemoteShutdownPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege
SeSecurityPrivilege
SeSystemtimePrivilege
SeShutdownPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeSystemProfilePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeLoadDriverPrivilege
SeCreatePagefilePrivilege
SeIncreaseQuotaPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeManageVolumePrivilege
SeImpersonatePrivilege
SeCreateGlobalPrivilege
SeEnableDelegationPrivilege

AND more important is this one. 
# all SePrivileges set for the FQDN. 
net rpc rights list accounts -k -S $(hostname -f)
BUILTIN\Print Operators
SePrintOperatorPrivilege

BUILTIN\Account Operators
No privileges assigned

BUILTIN\Backup Operators
No privileges assigned

BUILTIN\Server Operators
No privileges assigned

NTDOM\Domain Admins
SeMachineAccountPrivilege
SeTakeOwnershipPrivilege
SePrintOperatorPrivilege
SeDiskOperatorPrivilege
SeSecurityPrivilege

BUILTIN\Administrators
SeMachineAccountPrivilege
SeTakeOwnershipPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeRemoteShutdownPrivilege
SePrintOperatorPrivilege
SeAddUsersPrivilege
SeDiskOperatorPrivilege
SeSecurityPrivilege
SeSystemtimePrivilege
SeShutdownPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeSystemProfilePrivilege
SeProfileSingleProcessPrivilege
SeIncreaseBasePriorityPrivilege
SeLoadDriverPrivilege
SeCreatePagefilePrivilege
SeIncreaseQuotaPrivilege
SeChangeNotifyPrivilege
SeUndockPrivilege
SeManageVolumePrivilege
SeImpersonatePrivilege
SeCreateGlobalPrivilege
SeEnableDelegationPrivilege

Everyone
No privileges assigned


Greetz, 

Louis

> -----Oorspronkelijk bericht-----
> Van: samba [mailto:samba-bounces at lists.samba.org] Namens 
> Thomas Keppler via samba
> Verzonden: maandag 9 oktober 2017 20:55
> Aan: Marc Muehlfeld
> CC: samba at lists.samba.org
> Onderwerp: Re: [Samba] RSAT Print Management won't show 
> shared printers under the "Printers" section
> 
> Hm, I really am wondering now:
> 
> @Louis: How "recent" is your version of the RSAT tools on 
> Windows 7? Everything up to date?
> If you, in turn, try out the standard Debian 4.5.8 version of 
> Samba, can you still see printers?
> Do you have WINS enabled and working?
> 
> @Marc: Good that you can replicate my scenario. :-D
> 
> I don't have WINS support just yet with my domain.
> 
> --
> Best regards
> Thomas
> --
> To unsubscribe from this list go to the following URL and read the
> instructions:  https://lists.samba.org/mailman/options/samba
>