Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Printers can be administered three ways:

• Use the Printers folder, which
  can be accessed on the local machine by
  Start Printers and Faxes. New printers can be created in
  this folder using Add Printer, while existing ones can be
  administered by right-clicking on the printer icon. If you
  aren't physically located at the print server,
  don't despair: as long as you are logged on with
  Administrator credentials (or as a user with Manage Printers
  permission for the printers on your network), you can manage shared
  printers on remote print servers located anywhere on your network.
  First, find the printer using any of the methods outlined under
  

  Find a Printer later in this section, and then
  right-click on its icon to select a task or open its properties
  sheet.

• Use a web browser running on any computer. The functionality is more
  limited than using the Printers folder and uses a web-based interface
  instead of dialog boxes.

• Use the command line (very limited administrative capability this
  way).

While administering printers using the Printers folder is the faster
and most familiar method, administration using a web browser has some
advantages:

• Printers can be managed from any computer on the network regardless
  of which operating system it is running, as long as it is running a
  web browser.

• The web pages displayed can be printed out to generate reports that
  display the status of print devices managed by a given print server
  or display the contents of a printer queue.

• The web interface can be customized by creating additional HTML pages
  to display information such as a floor plan indicating where print
  devices and print servers are located.

But the disadvantages are:

• Only a few printer settings are displayed, and none of them can be
  modified. This will probably be corrected later in a service pack.

• Like most web interfaces, more mouse work is generally required to
  accomplish a task than by using the standard Windows dialog boxes and
  shortcut menus.

To install and configure a printer, you need to be a member of the
Administrators group. To administer a printer, you need to have
either Manage Printers or Manage Documents permission for that
printer, depending on the kind of administration you want to perform.

You can also control printer administration through the use of Group
Policies. These policies can be used to do the following:

• Modify the default behavior of the Add Printer Wizard

• Prevent new printers from being published by default in Active
  Directory

• Disable web-based management of printers and Internet printing

For more information, see

Group

Policy earlier in this chapter. If you
can't perform some administrative task involving
printers, there may be a Group Policy defined to prevent you from
doing so.

Add a Printer

Start Printers and Faxes Add Printer

This opens the Add Printer

Wizard,
which can be used to either:

• Install printer software directly on a print server. Microsoft calls
  this "installing a printer."

• Install printer software on a client computer. Microsoft calls this
  "making a printer connection."

In addition, when installing a printer on a print server, you can
choose which of the following to install:

• A local print device, which is directly attached to the server using
  a serial, parallel, or USB cable

• A network interface print device, which is directly connected to a
  TCP/IP network using a network card installed in the printer

Install a Printer for a Local Print Device

Make sure the print device

is attached to the print server
and is turned on in case it is Plug and Play. Start the Add Printer
Wizard, select "Local printer,"
then follow the steps that involve selecting a port to which the
print device is attached (usually LPT1), selecting the manufacturer
and model, specifying the name of the printer, and so on. Make sure
you share the printer if you plan to allow client machines to connect
to it and print from over the network.

Install a Printer for a Network Interface Print Device

Make sure the print device is

connected
to the network and is turned on. Start the Add Printer Wizard on the
print server and select "Local
printer" (clear the Plug and Play checkbox). On the
Select the Printer Port page of the wizard, select Create a new port
Standard TCP/IP Port. This opens another wizard called Add
Standard TCP/IP Printer Port. Specify the IP address of the print
device (a port name is generated automatically from this information)
and the type of network card the print device uses (try Generic if
you're not sure). Clicking Finish closes this wizard
and returns to the previous one, which you must then complete as in
the previous section.

Connect to a Remote Printer

There are lots of ways you
can connect a client computer to a
shared printer that is managed by a remote print server (i.e., create
a network printer on a client computer that lets users submit jobs to
the print server). Once you have connected to the printer, you can
print to it as if it was physically connected to your client
computer. Once your WS2003 Professional client computer connects to
the remote print server, it automatically downloads the necessary
printer driver files to create the connection.

You can connect to a remote printer in several ways. On the client
computer:

Start Printers and Faxes Add Printer Network printer

Then specify the remote printer you want to connect to by either
locating it in Active Directory, browsing for it on the network,
typing its name, or specifying its URL:

Start Search Other search options Printers, computers, or people Printers on the network enter search criteria Find Now select desired printer right-click Connect

Open the Active Directory Users and Computers console and:

Right-click on a domain Find Find Printers enter search criteria Find Now select desired printer right-click Connect

You can also do:

Start Run
http://printservername/printers OK click on Printer link Connect

Start Run http://printservername/printer/printersharename/printer/ Connect

where printservername is the DNS name of
the remote print server. This lets you connect to printers over the
Internet, provided you have appropriate permissions on that printer
and the remote print server is running Internet Information Services
(IIS).

You can also find the remote printer in Windows Explorer, right-click
on it, and select Connect from the shortcut menu.

Finally, you can find the remote printer in Windows Explorer, and
drag its icon into the Printers window.

Configure Clients for Printing

The configuration needed on


client computers depends on the
operating system installed on them:

WS2003/2000/XP/Me/98/95 clients

No client configuration is necessary. The first time the client
computer makes a connection to the shared printer, it automatically
downloads the appropriate printer driver (provided you have made this
driver available on the print server).

NT/3.x and MS-DOS clients

First, you need to manually install the printer driver on the client
computer.

Macintosh clients

Services for Macintosh must be installed and configured.

Unix clients

TCP/IP Printing (LPD) must be installed and configured.

NetWare clients

File and Print Services for NetWare must be installed and configured.
(This must be obtained separately.)

Configure Properties for a Printer

Start Printers and Faxes right-click on

printer Properties

This opens the printer's properties sheet to allow
you to configure various printer settings. The following are the most
popular settings configured by administrators.

• Setting priorities between printers for different groups of users

• Creating a printer pool to handle increased load

• Sharing an additional printer to handle increased load

Let's look at some highlights from the various tabs.
Note that some printers may have additional device-specific tabs. For
example, a color printer will have an additional tab called Color
Management. Other tabs may be supplied by the
vendor's printer driver.

General

Printing preferences set on print servers will be default settings
for all users. Users can override these settings by opening their own

Printers folders, right-clicking on a printer
icon, and selecting Printing Preferences. Assigning a location to a
printer helps users find it in Active Directory.

Sharing

See

Share a Printer later in this section.

Ports

This lets you specify and

configure
the port to which the print device is attached. To redirect a printer
to a different port or device, see

Redirect a
Printer later in this section. To add a TCP/IP port for a
network interface print device, see

Add a
Printer earlier in this section.

Printer pooling lets you connect one logical printer to multiple
physical print devices. Jobs that are sent to the printer are then
distributed between the different print devices according to
availability. This might be an option if your users make heavy
demands on an existing printer and are frequently standing in line to
pick up jobs. To make use of printer pooling, you must ensure that
all printers in the pool use the same printer driver. (The best is to
use identical print devices, but similar devices that use the same
driver are acceptable.) To enable printer pooling, check the
"Enable printer pooling" checkbox
and select the ports to which the print devices are attached.

Advanced

If several printers send jobs to the same print device, you can
control what happens by specifying the printer priority and available
print times for each printer. Priorities range from 1 (lowest) to 99
(highest), and jobs from printers with higher priority are printed
first. To assign different printer priorities to two different groups
of users, you must create a printer for each group, assign a priority
to each printer, set permissions so each group can use only one of
the printers, and then instruct each group concerning which printer
to use.

Spooling documents returns control to the application sooner than
printing directly to the printer, but you must ensure you have
adequate disk space for the spooling process. Mismatched documents
occur, for example, when a letter-size document is being printed to a
device whose only tray contains legal-size paper. Keeping printed
documents causes them to remain in the queue so they can be
resubmitted, but this can use up disk space quickly (if you have this
feature enabled, disabling it will purge the print queue). Enabling
the advanced printing feature is recommended unless printing problems
occur relating to page order, pages per sheet, or other advanced
features.

Clicking the New Driver button starts the Add New Printer Driver
Wizard, which lets you install new or updated printer drivers for
your print device. Note that this is not the same as the Additional
Drivers button on the Sharing tab, which lets you install drivers for
clients running other versions of Windows. You can also update
printer drivers over the Internet by using Windows Update (Start
Windows Update). Whatever way you do it, you need to be a
member of the Administrators group to update a driver.

A separator page is a file that contains printer commands and is used
to switch between different printing modesfor example, from
PostScript to PCLand to separate print jobs with a printed
page identifying the document being printed. Table 4-46 lists the different types of separator pages
available. Note that some printers can automatically detect which
language a print job uses and switch modes accordingly.

In order to use the Printing Defaults button to set default choices
for page orientation, default printer tray, number of copies, and
other settings, you must have Manage Printers permission. However,
users who have Print permission can override these default settings
and configure their own personal printing settings by:

Start Printers and Faxes right-click on printer Printing Preferences

Security

See

Assign Printer Permissions later in this
section.

Device Settings

A form is a paper size such as letter, legal, A4, envelope#10, and so
on. If your printer has multiple trays, you can assign a form to a
particular tray or let WS2003 automatically detect the paper tray for
each form.

Find a Printer

To administer a printer, you
first
need to find it. Information about shared printers is stored in
Active Directory and can be found by opening the Active Directory
Users and Computers console, right-clicking on the OU or domain in
which the printer is located (if known), and then:

Find Find Printers specify search criteria Find Now

You can also find a printer simply by browsing My Network Places
until you locate the remote print server managing the desired
printer. Once you have found the appropriate server, double-click on
its icon to see the shared printers on the server.
Don't stop here, however, as opening the properties
sheet for one of these shared-printer icons gives only minimal
information. Instead, you need to double-click on the
Printers folder that is displayed for the remote
print server you are viewing, and then right-click on a printer icon
to administer it or open its properties sheet.

Once you've found the Printers folder on a remote print server in My Network Places, simply drag this folder into your own local Printers folder to provide a quick way of finding and administering remote printers on your network.

Pause a Printer

Start Settings Printers right-click on printer Pause Printing

Pause a printer if there is a

problem
with the device, such as a paper jam. Pausing a printer
doesn't delete jobs pending in the queue. To resume
or restart printing after you have fixed the problem, repeat the
steps listed earlier.

Taking a printer offline also pauses printing. See

Use a
Printer Offline later in this section.

Redirect a Printer

If a print device fails, you

can
redirect the pending jobs to a different print device as long as the
new printer uses the same printer driver as the current one. You can
even redirect jobs to a print device managed by a different print
server than the one you normally use. To do this, open the properties
sheet for the printer and:

Ports tab Add Port Local Port New Port

\\printservername\printsharename

If the new print device is managed by the same print server as the
current one, redirecting jobs is easier: just change the port
selected to the port used by the new printer.

Share a Printer

WS2003 shares printers

by default
when you create them (XP Professional doesn't), but
if you decided not to share the printer when you created it, you can
share it later:

Start Printers and Faxes Printers right-click on printer Sharing Shared As specify share name

If your shared printer will be used not just by XP Professional
client machines but also by client machines running legacy versions
of Microsoft Windows (NT 3.1/3.51/4.0 or Windows 95/98), you will
need to install additional drivers for these legacy operating systems
on your shared printer. To do this, use the Additional Drivers button
on the Sharing tab. The WS2003 CD includes printer drivers for
WS2003, W2K, NT 4.0, XP, Windows 98, and Windows 95.

Select the List in the Directory checkbox if you want to publish the
printer in Active Directory (which is what you probably want to do).
This makes it easier for users to find specific printers on the
network. You can't publish a printer unless it has
been shared first.

If you are running a mixed-mode network with some computers running
legacy versions of Microsoft Windows, you can publish information
about non-WS2003 shared printers in Active Directory so that clients
can search for them. To do this, open the Active Directory Users and
Computers console, right-click the OU or other container in which you
want to publish the printer, and proceed as follows:

New Printer enter UNC path to printer

There is also a sample script,

\Winnt\System32\pubprn.vbs , which shows how to
use the Windows Scripting Host to publish non-WS2003 printers from
the command line.

You can also stop sharing a printer. Be sure to notify users,
however, so that their jobs aren't lost.

How printer drivers are updated on the client depends on the
particular Windows client operating system being used:

• Every time an XP Professional or NT 4.0 Workstation client connects
  to the WS2003 print server to print a document, it checks to make
  sure that it has the latest version of the driver. If the server has
  a newer driver, the client automatically downloads and installs it.

• NT 3.51 Workstation clients check for new drivers on the server only
  when the local spooler service on the client is restarted (typically
  when the machine is rebooted).

• Windows 95 and Windows 98 clients can't
  automatically download new drivers from the server; you must install
  these drivers manually on the clients.

Take Ownership of a Printer

Start Printers and Faxes right-click on a printer Properties Security Advanced Owner choose a new owner

The only users listed on

the
Owner tab are the currently logged-on user and the Administrators
group. You must have Manage Printers permission on a printer to be
able to take ownership of it. This permission is granted by default
to Administrators, Print Operators, Server Operators, and Power
Users.

Use a Printer Offline

Start Printers and Faxes right-click on printer Use Printer Offline

This is similar to pausing a

printer
except that pending jobs remain in the print queue even if you shut
down and restart the print server.

Assign Printer Permissions

Printer permissions are a

means
for controlling the level of access to shared printers on a WS2003
network. Printers must be shared on the network for printer
permissions to be assigned to them. To assign printer permissions,
you must first be able to access the icon of the shared printer. You
can do this using Windows Explorer, My Network Places, or from the
Search Results of the Search Assistant accessed through Start
Search For Printers. The following procedures
assume you have already located the icon for the shared printer whose
permissions you want to assign or modify.

Assign Standard Printer Permissions

Right-click on shared printer Properties Security Add select domain select user or group Add allow or deny printer permissions

Unless you allow or deny different permissions, when you assign
printer permissions to a user or group, the default permission
assigned is Allow Print.

When you try to allow or deny different combinations of printer
permissions, you will discover that not all combinations are allowed.
For example, if you try to allow Manage Printers, the Print checkbox
under Allow also automatically becomes checked. Table 4-47 shows the permissible combinations of printer
permissions that can be assigned using the Security tab. These
combinations work only if you are allowing permissions; if you both
allow and deny permissions, other combinations are possible.

Assign Special Print Permissions

Right-click on shared printer Properties Security Advanced Add select domain select user or group allow or deny special permissions

Like assigning standard print permissions, assigning a special
printer permission by selecting one checkbox may cause others to
magically become selected or deselected as well (i.e., not all
combinations of special print permissions are possible). Furthermore,
you can't allow and deny a permission at the same
time.

You also have the option of applying your special permissions to:

• This printer and documents (the default)

• This printer only

• Documents only

Modify Standard Printer Permissions

Right-click on shared printer Properties Security select name allow or deny printer permissions

For more information, see the previous section.

Modify Special Printer Permissions

Right-click on shared printer Properties Security Advanced select name View/Edit

For more information, see the earlier

Assign Special Print
Permissions .

Manage a Print Queue

To open a print queue for a given printer, do the following:

Start Printers and Faxes double-click on the printer icon

Once the print queue window is open, you can manage documents pending
for that printer. Select a document in the queue, then use the
Documents menu to pause, resume, cancel, or restart a job. You might
pause a document if there is a problem printing it (e.g., margins too
small), while you pause the printer itself if a problem such as a
paper jam occurs. Resuming a paused document starts printing it from
where it left off, while restarting a paused document prints the
entire document again from the beginning. You can also drag jobs to
change their print order, depending on your permissions and whose
jobs are in the queue.

Documents Properties lets you specify a print priority and
printing schedule for the selected job. This overrides the settings
on the Advanced tab of the printer's properties
sheet, which specifies the default priority and schedule for all jobs
printed using that printer. You can also specify a logon name to
indicate which user will be notified when the job is done (the logon
name of the user who submitted the job is entered by default). Also,
make sure that notifications are enabled on the print server.

Configure a Print Server

Start Printers and Faxes File Server Properties

This opens the Printer Server
Properties box. Here are some
highlights of the various tabs.

Forms

In addition to displaying available forms for the device, you can
create new ones by specifying the paper size. Be sure to save your
form definition if you want to use it again.

Ports

Similar to the Ports tab on the properties sheet for a printer, but
this lets you only create and configure ports, not assign them to a
specific printer. The information shown in the three columns of the
listbox here are:

Port

The name of the available port

Description

The port monitor associated with the port

Printer

The printers that use the port

The types of ports you can add are as follows:

Local port

Typically used to add a new local port when you want to redirect the
jobs pending in the printer's queue to another print
device. See

Redirect a Printer earlier in this
chapter for more information. We describe the types of local ports
you can create later in this section.

Standard TCP/IP port

Used for network interface print devices that have their own built-in
Ethernet card.

LPR port

Used for printers managed by Unix print servers. You must first
install Print Services for Unix on the WS2003 computer before you can
create an LPR port, and you must know the full DNS name or IP address
of the network interface print device or the Unix server running LPD
to which it is connected. See the sidebar Print Services for Unix for more information.

Hewlett-Packard network port

Used for older HP network interface print devices with JetDirect
cards that use DLC instead of TCP/IP. You must install the DLC
protocol on the WS2003 computer before you can create a
Hewlett-Packard network port.

AppleTalk printing device port

Used for printing from Macintosh clients. You must install the
AppleTalk protocol on the WS2003 computer before you can create an
AppleTalk printing device port.

You can also add new ports when running the Add Printer Wizard.

You can create three kinds of local ports on a WS2003 print server as
discussed in the following list.

A filename

(e.g.,

C:\path\filename ). Any job sent to this
port is written to the specified file, overwriting previous ones
(this is essentially printing to a file).

A shared printer

(e.g.,

\\printserver\printer ). Any job sent to
this port is handled by the specified remote printer (this is
essentially redirecting a printer).

NUL

This sends jobs to never-never land. It's used
mainly for testing purposes.

Parallel and serial ports are also local ports, but WS2003 generally detects this hardware automatically.

Drivers

This lists the various printer drivers installed on the server. If a
printer driver somehow becomes corrupt, you can update (reinstall) it
here by clicking Add to start the Add New Printer Driver Wizard. You
can also use this wizard to add (install) drivers for legacy Windows
clients such as NT, 98, or 95.

Select an installed driver and click Properties to list the various
files that make up the printer driver and see where they are stored
on the server.

You can also install printer drivers from the Sharing tab of each printer's properties sheet. The main advantage of doing this here on the Drivers tab of Server Properties is that if your print server is used to manage multiple print devices of the same type, you can update drivers for these in one step.

Advanced

This lets you specify the location where jobs will be spooled. This
is useful if your current drive is filling up and you want to move
the spool folder to a different drive. Make sure you stop the spooler
service prior to moving the spool folder, and restart the spooler
service or reboot the server afterward. Use the Services node in
Computer Management to stop and start the spooler service.

Don't locate the spool folder on the %SystemRoot% volumethat is, the volume where the \Windows folder is located (typically the C : drive). If users print lots of long jobs, it could fill up all available space on the drive and cause the system to hang.

By default, spooler events are logged to the
System log in Event Viewer. You may want to turn off information
events to reduce the amount of noise in the log. If you make changes
to these settings, you must stop and restart the spooler service.

You can specify that notifications be sent when
printing jobs are finished. These notifications can be sent to either
the users or the computers submitting the jobs. If notifications are
sent to computers and the user who submitted the job has logged off
her client machine, the next user who logs on to the machine will
receive the notification. So you should generally specify that users
instead of computers be notified if roaming user profiles are
configured on the network. Again, be sure to stop and restart

the
spooler service after changing this setting.