"Printer Installation Failed" - Please Help

[berstian]

Hi,

I've been knocking my head against this one for a few days now, and I
can see that it's been asked a few times in various forums but no-one
seems to have provided a definitive answer. So I guess I'm praying
that there's a guru out there who sees this message!

I've read the MS article on Effectively Using IPP Printing and followed
the directions. In fact I've re-read it three times to make sure. For
at least half of the printers that I've set up on the print server,
when the client goes to the http://servername/printers web page and
tries to connect to the printer they receive a "Printer Installation
Failed - you do not have enough privileges to install this printer on
the local machine" (may not be exact - I'm quoting from memory).

I had most of these printers set up on a test server (2003 server, same
as production) and I could install ALL of them without problem. I've
since even tested some of the troublesome ones on another 2003 server
box and they installed without issue from there as well. The problem
is, I need them to be available from the nominated print server, and
this is the box that I'm having the trouble with.

I've concluded that it must be something to do with the server, seeing
as I can do it from the other two without a problem.

Is anyone able to tell me what I should be looking for, what settings
or what shares I should double (actually, make that quadruple-check)?
I'm going nuts looking for what's causing this issue.

All help appreciated.

Cheers,
Ben.

 

[Rick]

I assume you are connecting to the IPP printers from a Windows XP machine.
If so, the local user account logged into the XP machine needs the proper
permissions to add printers.
By default, a basic user with XP does not have permissions to do so, so you will
need to either change the user to Administrator or change the local group
policy.

This is true even if you are using anonymous Web site permissions, if you by
chance are also using Basic authentication then the user accounts will also need
a domain or local account on the 2003 server

Hi,

I've been knocking my head against this one for a few days now, and I
can see that it's been asked a few times in various forums but no-one
seems to have provided a definitive answer. So I guess I'm praying
that there's a guru out there who sees this message!

I've read the MS article on Effectively Using IPP Printing and followed
the directions. In fact I've re-read it three times to make sure. For
at least half of the printers that I've set up on the print server,
when the client goes to the http://servername/printers web page and
tries to connect to the printer they receive a "Printer Installation
Failed - you do not have enough privileges to install this printer on
the local machine" (may not be exact - I'm quoting from memory).

I had most of these printers set up on a test server (2003 server, same
as production) and I could install ALL of them without problem. I've
since even tested some of the troublesome ones on another 2003 server
box and they installed without issue from there as well. The problem
is, I need them to be available from the nominated print server, and
this is the box that I'm having the trouble with.

I've concluded that it must be something to do with the server, seeing
as I can do it from the other two without a problem.

Is anyone able to tell me what I should be looking for, what settings
or what shares I should double (actually, make that quadruple-check)?
I'm going nuts looking for what's causing this issue.

All help appreciated.

Cheers,
Ben.

 

[berstian]

Hi Rick,

I've got the exact same printers set up and shared on two other W2003
servers, in exactly the same way (same drivers, etc) - I followed the
same steps to set all of them up. A regular user, with no
modifications to permissions is able to install the printers from both
of these other W2003 servers. There is just the one box, ironically
the one I NEED it to work from, where the installations fail for most
printers.

Thanks for any further suggestions.

Cheers,
Ben.

 

[Rick]

From my testing, the workstation connecting to the IPP printers was not part of
the W2003 workgroup. If the user account and/or computer you are logged in has
an account on the W2003 servers and not the reported troubled one. then its
possible the account is using the group policy from the server and not the local
group policy.

Also, the XP workstation was professional with SP 2. That might have an
effect.

But the issue you are reporting is a permissions issue.

Hi Rick,

I've got the exact same printers set up and shared on two other W2003
servers, in exactly the same way (same drivers, etc) - I followed the
same steps to set all of them up. A regular user, with no
modifications to permissions is able to install the printers from both
of these other W2003 servers. There is just the one box, ironically
the one I NEED it to work from, where the installations fail for most
printers.

Thanks for any further suggestions.

Cheers,
Ben.

 

[berstian]

I agree about the permissions issue, that's all I can think of. There
is another complication that I haven't mentioned so far: the client and
the server are on different domains. The following summarises my
testing so far:

Client -> Domain 1 (install printer success)
Client -> Domain 2 (install printer MOSTLY fails)
Client -> Domain 3 (install printer success)

Client is on Domain 3.

There are trust relationships in existence between all domains except
between Domains 1 and 2 (domain 1 is a test domain, domain 2 is the
production domain that domain 1 is used as testing for, and domain 3 is
the enterprise NT domain).

I've created my user that I'm testing with on all three domains to make
sure the circumstances are consistent. I am also using Windows XP Pro
SP2 on the workstation as we're in the middle of testing for a Managed
Operating Environment rollout - hence the desire to get the print
services working on the nominated server ASAP.

We're trying to move away from NDPS (Novell) printing services to
Windows (IPP) printing for precisely the reason that NDPS requires
Admin access to install print drivers/queues on client machines and
IPP, so far as we were aware, does not as long as the site that the
printers are installed from is in a Medium-Low security zone in IE.

Thanks for you help so far.

Ben.

 

[berstian]

Hi again,

This is for anyone who's reading this post. Firstly, thanks Rick for
your help.

It turns out there's a GP setting located under the User Configuration
node here:
Administrative Templates\Control Panel\Printers\Point-and-Print
restrictions

For the two servers where installing printers via IPP simply worked, no
change was necessary to this setting. To get this service working from
the server on Domain 2 (see above post), where I need it to work from,
I need to change this setting from Not Configured to Disabled. This
effectively tells the client it's allowed to install printers from any
location. Not terribly secure, but solved the problem.

It also worked to create an LMHOSTS file on the client (in
Windows\system32\drivers\etc) with a reference to the IP address of the
DC of Domain 2, the name of the domain and adding the #PRE tag (to
ensure the LMHOSTS file gets PREloaded). Once this is created, enabled
it in the WINS tab of the TCP/IP properties (Advanced) of the client's
NIC. I think the setting is something like "Allow LMHOSTS lookup".

Once the LMHOSTS file is created and enabled, the above GP setting
(Point-and-Print restrictions) can be changed to Enabled with the
following settings:
Check - "Users can only point and print to these servers:"
Enter the FQDN of the print server in the text box (eg.
printsvr.domain2.site.com)

Very convoluted, but it works in our environment. I believe it means
there's some communication issue between our primary domain (where all
the workstations live) and Domain 2 where the print server is located,
but at this point I'm just happy that it works.

Hope this helps someone else in the same position.

Cheers,
Ben.