Access Denied on a shared printer but prints okay

[Guest]

I have a new user on a W2ksp4 computer with a W2k3 SBS server. There are two
shared printers on the server that this user is connected to. The Everyone
group has all permissions and she has all the capabilities of manage printer,
manage documents, and print but it shows an "Unable to connect. Access
Denied" error message. Everyone else is okay but she gets this error message
even though she can print.

Occasionally from Word she will print a document with an unusual font and
it'll come out with incorrect characters and garbled. I delete the printer
and then reconnect it then it works fine again.

Does anyone have any ideas about this?

 

[Guest]

Also, I noticed these Event Log entries ont the Windows 2003 Small Business
Server:

Source: Kerberos
Category: None
Event ID: 5
Description: The kerberos client received a KRB_AB_ERR_TKT_NYV error from
the server USERS_COMPUTER. This indicates that the ticket used against that
server is not yet valid (in relationship to that server time). Contact your
system administrator to make sure the client and server times are in sync,
and that the KDC in realm USERS_DOMAIN is in sync with the KDC in the client
realm.

Source: LSASRV
Category: SPNEGO (Negotiator)
Event ID: 40960
Description: The Security System detected an authentication error for the
server cifs/USERS_COMPUTER.USERS_DOMAIN. The failure code from authentication
protocol Kerberos was "{Operation Failed} The requested operation was
unsuccessful. (0xc0000001)".

 

[Alan Morris\(MSFT\)]

The Print Server does not have access to the Win2k SP4 computer. The server
communicates print status through authenticated, then anonymous back to the
client.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Bruce Sanderson]

Well, that sound to me like the time on the client computer is too different
than that on the server - actually I think it says that the time on the
client is in the future.

The Kerberos authentication protocol is time sensitive, so time
synchronization between client and server computers is important.

Check the date and time on both the problematic client and the server with
the printer. Last year we had a set of new computers delivered to us with
their BIOS clock so far in the future that the Windows Time service refused
to synchronize the time with the domain controller.