Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Printers

You can create multiple printers
for a given print device. One reason for doing so is if you have two
different groups with different needs and privileges who are using
the same print device. Different permissions, print priority, print
times, and so on may be assigned to each group. For example, managers
may be allowed to print documents at any time with top priority,
while the large jobs submitted by accounts have low priority and can
be run only at night.

When viewing a print queue using a web browser, the page is
automatically refreshed when jobs enter or leave the queue.

If a printer is added and then deleted from a print server, the
printer driver is not deleted from the hard disk. If you then
reinstall the printer, you have the option of either keeping the
existing driver or replacing it with a new one. This can be useful
for troubleshooting problems associated with printer drivers.

When adding a printer, keep the printer name short (no more than 31
characters) to ensure legacy applications will be able to print to
it.

If you can't find a printer using the Find Printers
box, you may have deselected the List in the Directory checkbox on
the Sharing tab of the printer's properties sheet.

Many of the options available when you right-click on a printer icon
in the Printers folder are also available from:

• The File menu of the Printers window when the desired printer is
  selected in that window

• The Printer menu of the print-queue window for the selected printer

You can't redirect selected jobs to a different
print device; you can redirect only all jobs.

When enabling printer pooling for print devices having different
speeds, add the port for the fastest print device first, since this
will be the default device to which jobs are sent when all devices in
the pool are idle.

If you configure a printer's port as File, jobs will
be printed to a file on the client machine, and users will be
prompted for a filename.

If you do use printer pooling, make sure the pooled devices are
physically near each other, not on different floorsunless you
want to give your users lots of exercise climbing stairs!

Using separator pages can be a good idea if you have multiple users
printing to the same print device. These pages help users identify
their jobs and can decrease the crowd around the device.

Selecting View Details in the Printers window allows you
to quickly see the status of all printers managed by the print
server.

To pause or resume a printer, take a printer offline, share a
printer, or perform many other common administrative tasks involving
printers, you need Manage Printers permission.

The standard port monitor, which connects a WS2003 printer to a
TCP/IP network interface print device, is a big improvement over the
old LPRMON print monitor of NT. LPRMON must still be used, however,
for printing to print devices connected to Unix print servers.

The Performance console (which replaces the NT tool called System
Monitor) includes a Print Queue object, which can be used for remote
monitoring of print queues, as well as giving administrators useful
statistics about job errors, cumulative pages printed, and so on.

If printing fails because a job becomes stuck in the print spooler,
you can try stopping and restarting the print spooler. If printing
still fails, stop the spooler again and manually delete the print job
from the spooler folder, then restart the spooler. To stop or restart
the spooler you can open the Computer Management console and select
Services and Information Services Print Spooler
Action Start or Stop. Alternatively, you can
open a command prompt and type net stop
spooler or net start spooler.
Stopping the print spooler may stop other services such as the Fax
Service, which will need to be restarted afterward.

The document currently being printed can't be
redirected.

When accessing a printer using a web browser to print over the
Internet, WS2003 first tries to connect to the remote printer using
RPCs (in case it is on the local LAN or intranet). If this fails, it
uses the Internet Printing Protocol (IPP), which is encapsulated by
HTTP. Either way, the end result is transparent to the user printing
the document.

USB, IEEE 1394, and IR print devices are automatically detected by
WS2003 when you connect them to the appropriate port on the computer.
The Found New Hardware Wizard is then invoked to walk you through the
process. You need to use Add Printer in the Printers folder only when
your print device is not detected by the operating system. Ports for
these devices aren't listed on the Ports tab unless
the device is already installed.

Parallel-port print devices aren't automatically
detected when you attach them to an LPT port on a WS2003 computer.
However, when you run the Add Printer Wizard, make sure that
"Automatically detect my printer"
is selected, which should successfully detect and help install most
modern, bidirectional, parallel-port print devices.

Printer Permissions

Printer permissions may be allowed or

denied,
and denied permissions override allowed ones. For example, if you
deny Print permission to Everyone, then no one will be able to print
to the printer.

All users are allowed to print by default, since Print permission is
assigned to Everyone. You may want to remove this permission and
assign Print permission to the Users group instead, so that only
authorized users who have logged on to the network are allowed to
connect to the printer and print to it.

Alternatively, you may want to limit access to some printers to
specific groups of users. For example, you could grant Print
permission to use the color laser printer to the Managers group only.

Printer permissions are most important with print devices used to
print sensitive business information, such as payroll checks. Make
sure you restrict permissions accordingly for such devices, and be
sure to locate them in secure areas as well.

Users with Manage Documents permission don't have
the privilege of printing documents unless they are also explicitly
given Print permission. Users with Manage Printers permission do,
however, also have the privilege of printing documents.

If you have Macintosh clients on your network and Print Services for
Macintosh is installed on your print server, these clients can print
without restriction. In other words, there is no control of printer
access for Macintosh clients.

Inheritance is not an issue with printer permissions.

Don't assign special permissions unless absolutely
necessary. Keep permissions simple to ease troubleshooting when
things go wrong.

Print Queues

The Printer menu is similar to what you get when you right-click on
the printer icon within the Printers folder.

You can also right-click on a printer icon within the Printers folder
if you want to pause or resume a printer instead of just a particular
document or if you want to cancel all documents pending for a
printer.

If you cancel all documents for a printer, the job currently printing
will finish.

If you are an ordinary user, you will be able to manage only your own
jobs within the print queue, not those of other users.

You need at least the Manage Documents printer permission if you want
to configure priority, schedule, and notifications for all documents
sent to the printer.

Double-clicking on a job in the queue also opens the properties for
that document.

If the spooler folder is located on an NTFS volume, make sure Change
permission is assigned to the Users group. Otherwise, they
won't be able to print.

To delete a form you created, you must first deselect Create a New
Form.

See Also

lpq, lpr, net
print,

Permissions ,
prncnfg, prndrvr,
prnjobs, prnmngr,
prnqctl