Printer Permissions - denying access

Craggus2000 · March 30, 2010

Hi all,

Have a query with regards to printer security permissions on our 2003 domain...

I have a printer that I need to deny access to. Basically kids printing to it from other areas of the school (should only be the computers in that room that can print to it).

This is what I've done: added computer accounts that shouldn't print to it to a security group. Added that security group to the printer, with a deny 'print' tick box. However, I was still able to add the printer and print to it from one of those PCs!

Where am I going wrong?

Thanks!

danrhodes · March 30, 2010

It's a hard one to do because as Allow takes presendence over Deny the user account has Allow so will overwrite the computer account which has Deny.

D

stevenwba · March 30, 2010

Wouldnt it be easier for you to add a gpo for all student users not to be able to add printers? only leaving them with the ones you allocate?

danrhodes · March 30, 2010

Yeah I think that is probably the way to go along side some print maangement software - We use PCounter I recommend it highly.

See http://support.microsoft.com/kb/234270 for how to cinfigure your GPO to remove the Add Printer Wizrd.

And see http://www.altman.co.uk/printmanagement/index.php for the print management software. Tell them I told you to ring ;-)

D

Edited March 30, 2010 by danrhodes

stevenwba · March 30, 2010

just wondered if you also using a script to map these printers every time or if you just add them manually?

danrhodes · March 30, 2010

just wondered if you also using a script to map these printers every time or if you just add them manually?

We use this to add a permenant connection to a machine remotly:

RUNDLL32 PRINTUI.DLL,PrintUIEntry /c \\ICT1-01 /ga /n "\\server2.curriculum.airedalehigh.com\ITC-1"

Or this to do it on the machine:

rundll32 printui.dll,PrintUIEntry /ga /n \\server2\itc-1

D

Craggus2000 · March 30, 2010

It's a hard one to do because as Allow takes presendence over Deny the user account has Allow so will overwrite the computer account which has Deny.

D

Oh,

I thought deny always took precedence?

Craggus2000 · March 30, 2010

Wouldnt it be easier for you to add a gpo for all student users not to be able to add printers? only leaving them with the ones you allocate?

I did think about that, but then with our kids, restrictions present a challenge for them to overcome, which they inevitably will, with reg hacks etc...

danrhodes · March 30, 2010

Oh,

I thought deny always took precedence?

I suppose we're both correct from what I've read here?

Because of the fact that users have can have many different rights settings and objects can have many different permission settings, it is possible that conflicting permission settings might apply to a particular object and access method. When this occurs, the system must engage in a process of resolving the various permissions to determine which ones should govern the access.

Here are some rules for resolving permissions conflicts:

"Deny" permissions generally take precedence over "allow" permissions.

Permissions applied directly to an object (explicit permissions) take precedence over permissions inherited from a parent (for example from a group).

Permissions inherited from near relatives take precedence over permissions inherited from distant predecessors. So permissions inherited from the object's parent folder take precedence over permissions inherited from the object's "grandparent" folder, and so on.

Permissions from different user groups that are at the same level (in terms of being directly-set or inherited, and in terms of being "deny" or "allow") are cumulative. So if a user is a member of two groups, one of which has an "allow" permission of "Read" and the other has an "allow" of "Write", the user will have both read and write permission--depending on the other rules above, of course.

Although Deny permissions generally take precedence over allow permissions, this is not always the case. An explicit “allow” permission can take precedence over an inherited “deny” permission.

The hierarchy of precedence for the permissions can be summarized as follows, with the higher precedence permissions listed at the top of the list:

Explicit Deny

Explicit Allow

Inherited Deny

Inherited Allow

Also true:

File permissions override folder permissions, unless the Full Control permission has been granted to the folder.

jsnetman · March 30, 2010

We have many colour printers here, we do not deploy them to pupils because of the cost and the way they can waste ink/paper and so on. Instead we publish them via IIS and password protect the actual connection page for each printer. So each department has there own user and password for their colour printer. Staff get them deployed. Each dept is responsible for the password. Edited March 30, 2010 by jsnetman

danrhodes · March 30, 2010

We have many colour printers here, we do not deploy them to pupuls because of the cost and the way they can waste ink/paper and so on. Instead we publish them via IIS and password protect the actual connection page for each printer. So each department has there own user and password for their colour printer. Staff get them deployed. Each dept is responsible for the password.

Excellent idea! They used to do this at the school I attended as a wee child may years ago!

D

jsnetman · March 30, 2010

We also create 2 shared drivers for each colour printer and set one to only print in greyscale and deploy them to pupils as their default printer per room. If they want colour they need the password from the teacher.

Danlewis3 · March 30, 2010

a script i have cutdown.

Messy yes!

Public menutype, obj, WshNetwork, fs, adsDomainGroups

Set obj = CreateObject("WScript.Shell")

Set WshNetwork = CreateObject("WScript.Network")

domain = WshNetwork.UserDomain

Set adsDomainGroups = GetObject("WinNT://" & domain)

Set fs = CreateObject("Scripting.FileSystemObject")

regkey = "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\"

' If an error occurs in the script, the script carries on to the next section. Comment out to Fault find.

On Error Resume Next

' Reads the room registry key

room = obj.regread("HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\room")

' Reads the room key and if it = "SERVER" stops the script running. Put the word "SERVER" in all servers room keys

If room = UCase ("SERVER") Then

Msgbox "This is the " & room & "." & vbTab & "Stopping the script" & vbCr & "Right click the script and select edit"

WScript.quit

Else

End If

' Sets / collects fixed setings

UserName = UCase(WshNetwork.UserName)

server = "\\wbnas01" 'Change to match the users server

homeserver = "\\wbnas01"

printserver = "\\Print-server"

officeversion = "2003" 'Change to match the users office version

home = "N:" ' Put the users home drive letter here.

' Enumerates printer connections and deletes them

Set oPrinters = WshNetwork.EnumPrinterConnections

For Counter = 0 to oPrinters.Count - 1

IF mid(oPrinters.Item(Counter + 1), 1, 2) = "\\" Then

PrinterPath = oPrinters.Item(Counter + 1)

WshNetwork.RemovePrinterConnection PrinterPath, True, True

End If

If room = "ROOM 7" Then

PrinterPath1 = printserver & "\suite 7 Multifunctional"