Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Printing terminology in Microsoft Windows can be confusing for users
familiar with other operating-system platforms:

Printer

Not a printer in the
usual
sense, but instead a software interface on the client machine that
manages the printing process. This is sometimes called a logical
printer but is usually just referred to as a printer. A printer must
first be created on a client machine for that machine to be able to
print documents. Printers are also used to configure print devices by
specifying things like print schedule, job priority, who to notify
when the job is done, which paper tray to use, which print quality to
use, and so on.

Print device

A piece of hardware that generates printed documents; in
common parlance, this is called a printer.

Print server

The computer that is
actually responsible for managing the
print device. The print server receives print jobs from the client
machines, formats them accordingly, and passes them to the print
device to generate printed output. You need a print server in order
for client computers to use a printer over the network.

Printer driver

Software installed on
the print server that processes jobs
received from client computers and turns them into a series of
printer commands, which can be understood by the particular type of
print device being used.

Print queue

Software utility used to view print jobs waiting to be printed by a
particular print device.

Local Versus Network Printers

WS2003 supports the same


two kinds of print devices that were
supported by earlier versions of Microsoft Windows:

Local print device

A printer directly connected to the print server using a serial,
parallel, USB, or other physical port on a print server.

Network-interface print device

A printer directly connected to the network using its own network
card. The print server manages the print device but is not directly
connected to it.

Network Printing Process

The basic process of printing
over the network is:

1. The user clicks the Print button on an application or performs some
   other action to print a document.

2. The printer driver on the client computer creates a print job by
   rendering the document into a series of printer commands, and then it
   spools (temporarily stores) the job for printing. By default, on
   WS2003, the document is only partially rendered at this point,
   resulting in an enhanced metafile format (EMF) file. EMF is a kind of
   universal printer-command format. Typically, non-Windows clients
   fully render the document into a RAW file consisting of actual
   machine-specific printer commands. EMF can be disabled in WS2003 to
   use RAW instead, but EMF is preferred because a spooled EMF job
   typically occupies less disk space than a similar RAW one.

3. The client computer forms a connection with the appropriate print
   server using remote procedure calls (RPCs) and then forwards the job
   to the print server.

4. The print server receives the job and spools it for further
   processing and until a print device becomes available.

5. The print provider (software on the print server) finishes processing
   the job by converting it from EMF into RAW format (if necessary).

6. When a print device becomes available, the job is despooled to the
   appropriate print monitor (more software on the print server), which
   then forwards the rendered document to the print device, which
   finally turns it into a printed document.

Printer Permissions

To manage user access to

printers
attached to the local computer or connected to the network, you
assign printer permissions. These permissions can also be used to
specify who is allowed to manage printers and their documents. There
are three levels of printer permissions:

Print

Assigns ordinary users permissions for connecting to printers,
printing documents, and managing their own documents

Manage Documents

Delegates the job of managing all documents to users with limited
administrative privileges

Manage Printers

Provides complete administrative control over all aspects of printers
and the printing process

Table 4-43 gives more detail concerning the
specific privileges conveyed by each of the previous three types of
printer permissions. These permissions can be assigned to both users
and groups, but assigning them to groups is preferred since it
reduces the amount of administration needed. Note that printer
permissions are effective only when the printer is shared for use
over the network.

Default Printer Permissions

The printer permissions

assigned
by default to a newly created printer are shown in Table 4-44. In order to modify these permissions, you
must either be the owner of the printer or have the Manage Printers
permission.

Advanced Printer Permissions

The three basic printer

permissions
described previously are actually comprised of combinations of six
advanced printer permissions, as shown in Table 4-45. This is a bit confusing since three of these
advanced permissions have the same names as the basic printer
permissions. Advanced permissions can be applied either to:

• This printer only

• Documents only

• This printer and documents

Advanced printer permissions can also be selectively modified to
provide a group of users with special (custom) printer permissions,
if desired. However, it is highly unlikely that you will need (or
want) to do this.

Planning Printer Permissions

Like access to any other shared resource, access to print devices is
controlled by assigning permissions to groups and users. The best way
of doing this is to:

1. Create a domain local group for a print device. Give the group a
   recognizable name such as HP5L Users (using the type or model of the
   device) or Barney Users (if you give your printers friendly names).

2. Assign the local group Print permission.

3. Put global groups into the local group to give users access to the
   printer.

Also, be sure to assign suitable permissions to Administrators or
Print Operators so they can manage the device and its print queues.