Lock down printer based on ad security groups

[0x9h3]

Hi,

I need some help locking down a printer for a certain department. I know this can be done as I have done it in previous jobs. I want to lock it down to only certain PC's can print to it.

 

Everytime I remove the 'everyone' group from security settings the printer no longer maps and users recieve an access denied message when trying to map the printer. What am I doing wrong!?

 

Thanks,

[Steve21]

Do you mean only certain pcs can print to it? Or only certain users?

 

If you mean computers it's generally going to be easier just to map it only to those and leave security alone (If you're not publishing the printer to AD no-one should find it anyway).

 

If you mean to certain users you'll have to re-add them in to the security once you remove everyone, but you'll still need to configure the GPOs to apply to auth users for delegation

 

Steve

[0x9h3]

Certain PC's - I know it can be done because I have done it I just can't remember how!

 

I've removed the printer by unticking the box for 'List in directory' but when going to add a printer in devices and printers, then for network printers the device still shows.

Thanks

[Davit2005]

Have you the Department PCs in specific computer group?

[0x9h3]

Yes, I've created a new ad group for those PC's but that doesn't work. If I remove the 'everyone' group from the security settings then no one can print and the printer won't map.

[derf]

A couple of points of you remove everyone from the printer security:

1. The security group on the printer needs, to paraphrase as I'm not at work, "Manage this printer" ticked (as well as the other security options).

2. The group policy needs to 'run in the user context' checked, otherwise windows will connect as the system account and be denied by the printer

 

Then, the printer should add correctly and only that group will be able to print