Printers showing up for all users - how to fix?

Hi,

All of my TS users see all printer attached to theirs and other users
sessions when they go to print something. I'm aware that this is caused by
them being members of the power users or administrators group. I have them
set up as power users because we run a couple of 3rd party apps that require
power user privledge to run properly.
Is there a way to set the global permissions for users to domain user and
allow certain apps to run as power user for a given user? My goal would be
to have each TS user only see the printers they should see, and not all
printers.

Thanks,

Mike

 

Mike <Mike@discussions.microsoft.com> wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hi,
>
> All of my TS users see all printer attached to theirs and other users
> sessions when they go to print something. I'm aware that this is
> caused by them being members of the power users or administrators
> group. I have them set up as power users because we run a couple of
> 3rd party apps that require power user privledge to run properly.
> Is there a way to set the global permissions for users to domain user
> and allow certain apps to run as power user for a given user? My
> goal would be to have each TS user only see the printers they should
> see, and not all printers.
>
> Thanks,
>
> Mike<!--colorc--><!--/colorc-->

You're chasing the wrong problem here. Power User is pretty
indistinguishable from Administrator. Anything you can do, they could undo,
and it's silly to court trouble like this when you have alternatives.

Find out what the 3rd party applications expect to have permissions to,
within the registry and/or file system, and adjust it manually. This really
shouldn't be all that difficult - either the software vendors can tell you
what to adjust, or you can figure it out yourself - there is a nice
Sysinternals (now Microsoft) utility called Process Monitor that can help
out with this.

 

As mentioned, give your users normal rights and use Process Monitor to see
where the problem is.
There is a section on the guide I wrote (Terminal Services A to Z, available
for free at ) that shows how to use the tool and what
to look for.

Cheers.

Cláudio Rodrigues
CEO, WTSLabs Inc.


Citrix CTP
Quest Provision Networks VIP


"Mike" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hi,
>
> All of my TS users see all printer attached to theirs and other users
> sessions when they go to print something. I'm aware that this is caused by
> them being members of the power users or administrators group. I have them
> set up as power users because we run a couple of 3rd party apps that require
> power user privledge to run properly.
> Is there a way to set the global permissions for users to domain user and
> allow certain apps to run as power user for a given user? My goal would be
> to have each TS user only see the printers they should see, and not all
> printers.
>
> Thanks,
>
> Mike
> <!--colorc--><!--/colorc-->

 

Claudio,

I will check it out. Thanks so much!

"Cláudio Rodrigues [MVP]" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> As mentioned, give your users normal rights and use Process Monitor to see
> where the problem is.
> There is a section on the guide I wrote (Terminal Services A to Z, available
> for free at ) that shows how to use the tool and what
> to look for.
>
> Cheers.
>
> Cláudio Rodrigues
> CEO, WTSLabs Inc.
>
>
> Citrix CTP
> Quest Provision Networks VIP
>
>
> "Mike" wrote:
> <!--coloro:green--><span style="color:green <!--/coloro-->
> > Hi,
> >
> > All of my TS users see all printer attached to theirs and other users
> > sessions when they go to print something. I'm aware that this is caused by
> > them being members of the power users or administrators group. I have them
> > set up as power users because we run a couple of 3rd party apps that require
> > power user privledge to run properly.
> > Is there a way to set the global permissions for users to domain user and
> > allow certain apps to run as power user for a given user? My goal would be
> > to have each TS user only see the printers they should see, and not all
> > printers.
> >
> > Thanks,
> >
> > Mike
> > <!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->

 

As always, thanks for the advice Lanwench!

"Lanwench [MVP - Exchange]" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Mike <Mike@discussions.microsoft.com> wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
> > Hi,
> >
> > All of my TS users see all printer attached to theirs and other users
> > sessions when they go to print something. I'm aware that this is
> > caused by them being members of the power users or administrators
> > group. I have them set up as power users because we run a couple of
> > 3rd party apps that require power user privledge to run properly.
> > Is there a way to set the global permissions for users to domain user
> > and allow certain apps to run as power user for a given user? My
> > goal would be to have each TS user only see the printers they should
> > see, and not all printers.
> >
> > Thanks,
> >
> > Mike<!--colorc--><!--/colorc-->
>
> You're chasing the wrong problem here. Power User is pretty
> indistinguishable from Administrator. Anything you can do, they could undo,
> and it's silly to court trouble like this when you have alternatives.
>
> Find out what the 3rd party applications expect to have permissions to,
> within the registry and/or file system, and adjust it manually. This really
> shouldn't be all that difficult - either the software vendors can tell you
> what to adjust, or you can figure it out yourself - there is a nice
> Sysinternals (now Microsoft) utility called Process Monitor that can help
> out with this.
>
>
> <!--colorc--><!--/colorc-->

 

Mike <Mike@discussions.microsoft.com> wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> As always, thanks for the advice Lanwench!<!--colorc--><!--/colorc-->

You're welcome. Post in one of the Windows server groups if you're having
trouble figuring the required permissions out. It can take a while to get
comfortable with Process Monintor but it's a godsend.
<!--coloro:blue--><span style="color:blue <!--/coloro-->
>
> "Lanwench [MVP - Exchange]" wrote:
><!--coloro:green--><span style="color:green <!--/coloro-->
>> Mike <Mike@discussions.microsoft.com> wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> Hi,
>>>
>>> All of my TS users see all printer attached to theirs and other
>>> users sessions when they go to print something. I'm aware that
>>> this is caused by them being members of the power users or
>>> administrators group. I have them set up as power users because we
>>> run a couple of 3rd party apps that require power user privledge to
>>> run properly.
>>> Is there a way to set the global permissions for users to domain
>>> user and allow certain apps to run as power user for a given user?
>>> My goal would be to have each TS user only see the printers they
>>> should see, and not all printers.
>>>
>>> Thanks,
>>>
>>> Mike<!--colorc--><!--/colorc-->
>>
>> You're chasing the wrong problem here. Power User is pretty
>> indistinguishable from Administrator. Anything you can do, they
>> could undo, and it's silly to court trouble like this when you have
>> alternatives.
>>
>> Find out what the 3rd party applications expect to have permissions
>> to, within the registry and/or file system, and adjust it manually.
>> This really shouldn't be all that difficult - either the software
>> vendors can tell you what to adjust, or you can figure it out
>> yourself - there is a nice Sysinternals (now Microsoft) utility
>> called Process Monitor that can help out with this.<!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->