• [Samba] Access denied, and other problems, trying to administer pri

    From =?UTF-8?Q?=C3=85ke_Holmlund?= via s@21:1/5 to samba@lists.samba.org on Tue Mar 14 17:40:02 2017
    Hi,

    Today I finally got time to do some more testing. I set up a Windows 10
    machine but got the same problem (just wanted to make sure...).

    I will do more testing tomorrow but I have a question about an error
    I'm seeing in the logs. Do You know what
    "access DENIED for non-printserver bits" (log level 3) means?

    Regards,
    Åke

    --On 7 mars 2017 19:04:25 +0100 Marc Muehlfeld via samba <samba@lists.samba.org> wrote:

    Hi,

    Am 07.03.2017 um 12:55 schrieb Åke Holmlund via samba:
    It sounds like the problem that came up last summer, after MS updated
    the Windows print spooler.
    For details and how to fix it in a Samba AD, see:

    https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clie
    nt s#Creating_a_GPO_for_Trusting_the_Print_Server

    I have seen that but I guess it does not apppy in my situation (NT-domain).

    This should affect all print server installations, because it's something MS changed on the
    client and is independently of the type of print server (AD, NT4 domain, standalone)



    You can easily figure out if this is your problem: Set up a new Win7
    client without applying the
    updates. If you can preconfigure drivers and connect to the printers
    on this machine, then
    MS16-087 is your problem.

    Tested that but it still fails in the same way. Maybe I should have
    mentioned that connecting to the printers and using them to print
    does work. It's just the management part that fails.

    Even if you applied this patch, your users are able to connect the printer and use it - as long
    as the driver is already available on the client. This means, if one of your users connected the
    printer on a workstation before MS16-087, the driver was installed locally. For all users on this
    host that are connecting later to a printer that uses the same driver, the driver is not
    downloaded from the print server again (as long as it is not updated on the server).

    Your situation sounds really like it is caused by this MS update. However, if you tested this
    with a fresh install without installing any updates, it's unlikely.


    Can you please go through the following guides: https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clients
    and make sure that everything matches your environment? Especially that you use an account that
    has the SePrintOperatorPrivilege privilege granted and is able to write to the print$ share. I
    rewrote both guides recently and verified them using Samba 4.5.3 or 4.5.4 on RHEL 7.3. However, I
    only checked Win8 and 10 (both 64-bit), not Win7.


    If you verified that your settings matches what we have in our documentation and be sure that
    it's not related to the MS update, can you please put a level 10 debug log on pastebin (or any
    other paste service) that contains only the log entries when you click the action that fails?
    Additionally, your [global], [printers], [print$], and the section of an printer would be
    interesting.


    Regards,
    Marc

    --
    To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba



    --
    To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?UTF-8?Q?=C3=85ke_Holmlund?= via s@21:1/5 to samba@lists.samba.org on Mon Mar 20 08:40:02 2017
    Hi,
    Running Samba 4.4.10 as a NT-domain controller. Does anybody know
    what the error message "access DENIED for non-printserver bits"
    (log level 3) means when trying to add a new printer driver?

    Regards,
    Åke

    --On 14 mars 2017 17:33:30 +0100 Åke Holmlund via samba <samba@lists.samba.org> wrote:

    Hi,

    Today I finally got time to do some more testing. I set up a Windows 10 machine but got the same problem (just wanted to make sure...).

    I will do more testing tomorrow but I have a question about an error
    I'm seeing in the logs. Do You know what
    "access DENIED for non-printserver bits" (log level 3) means?

    Regards,
    Åke

    --On 7 mars 2017 19:04:25 +0100 Marc Muehlfeld via samba <samba@lists.samba.org> wrote:

    Hi,

    Am 07.03.2017 um 12:55 schrieb Åke Holmlund via samba:
    It sounds like the problem that came up last summer, after MS updated
    the Windows print spooler.
    For details and how to fix it in a Samba AD, see:

    https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clie
    nt s#Creating_a_GPO_for_Trusting_the_Print_Server

    I have seen that but I guess it does not apppy in my situation (NT-domain). >>
    This should affect all print server installations, because it's something MS changed on the
    client and is independently of the type of print server (AD, NT4 domain, standalone)



    You can easily figure out if this is your problem: Set up a new Win7
    client without applying the
    updates. If you can preconfigure drivers and connect to the printers
    on this machine, then
    MS16-087 is your problem.

    Tested that but it still fails in the same way. Maybe I should have
    mentioned that connecting to the printers and using them to print
    does work. It's just the management part that fails.

    Even if you applied this patch, your users are able to connect the printer and use it - as long
    as the driver is already available on the client. This means, if one of your users connected the
    printer on a workstation before MS16-087, the driver was installed locally. For all users on this
    host that are connecting later to a printer that uses the same driver, the driver is not
    downloaded from the print server again (as long as it is not updated on the server).

    Your situation sounds really like it is caused by this MS update. However, if you tested this
    with a fresh install without installing any updates, it's unlikely.


    Can you please go through the following guides:
    https://wiki.samba.org/index.php/Setting_up_Samba_as_a_Print_Server
    https://wiki.samba.org/index.php/Setting_up_Automatic_Printer_Driver_Downloads_for_Windows_Clien
    ts and make sure that everything matches your environment? Especially that you use an account
    that has the SePrintOperatorPrivilege privilege granted and is able to write to the print$
    share. I rewrote both guides recently and verified them using Samba 4.5.3 or 4.5.4 on RHEL 7.3.
    However, I only checked Win8 and 10 (both 64-bit), not Win7.


    If you verified that your settings matches what we have in our documentation and be sure that
    it's not related to the MS update, can you please put a level 10 debug log on pastebin (or any
    other paste service) that contains only the log entries when you click the action that fails?
    Additionally, your [global], [printers], [print$], and the section of an printer would be
    interesting.


    Regards,
    Marc

    --
    To unsubscribe from this list go to the following URL and read the
    instructions: https://lists.samba.org/mailman/options/samba



    --
    To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba



    --
    To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)