Inherited permissions for printers

[Paul Hadfield]

All,

I realise this is a printing question, but I think it's probably GPO/AD
related too.

Is there any way that permissions for printers on a Windows 2000 server can
be set to inherit in the same way that files and folders can?

I'm trying to set up our servers so that when a power user creates a new
printer the correct permissions are automatically assigned to it and all the
power user needs to is add relevant user groups with print access.

Thanks again,
Paul.

 

[Lanwench [MVP - Exchange]]

All,

I realise this is a printing question, but I think it's probably
GPO/AD related too.

Is there any way that permissions for printers on a Windows 2000
server can be set to inherit in the same way that files and folders
can?

I'm trying to set up our servers so that when a power user creates a
new printer the correct permissions are automatically assigned to it
and all the power user needs to is add relevant user groups with
print access.

Thanks again,
Paul.

There are no power users in AD/Win2k server. Where is this printer being
created?

 

[Paul Hadfield]

Sorry, I should have explained myself a little clearer.

We have a Windows 2000 domain. The print queues are set-up on Windows 2000
member servers, which of course have their local security groups and
accounts still active. I have set-up a security group on the 2000 domain in
active directory of which all of my IT Helpdesk staff are members. I have
used GPO to make the domain security group "IT Helpdesk staff" members of
the local Power Users group on the member servers that have print queues
installed.

So the "IT Helpdesk staff" have domain user rights, but also have elevated
Power User rights on some of the member servers. This allows me to grant
full control over certain advanced rights on the member servers, without
compromising the security of the DC's and other servers in the domain.

It's these member servers that I am trying to give custom security
privileges to new printers that are created by these Power Users. Can this
be done?

Thanks in advance,
Paul




"Lanwench [MVP - Exchange]"