Cannot install new printer drivers

[Guest]

Windows XP Home. "Printer drive was not installed. Access is denied." I get
this when I hit Finish whenever I try to install any printer that needs a
driver that isn't already installed. Microsoft can install new drivers; when
I installed the new Office trial I got a new OneNote driver.

It all started when I installed an HP LaserJet Plus driver for a Brother
printer on LPT1, as a shared printer with an additional driver for Win9x. I
then connected to it from a Win98 laptop on the network. Then I uninstalled
the LJPlus and tried to install a LaserJet Series II driver. That's when I
started getting that error message.

The reason I installed the LaserJet drivers was that I had some problems
after the Brother laser came back from repair. I had physically moved
printers around and reconfigured drivers. When I switched everything back,
DTP jobs sent from a Win98 laptop to the Brother printer on the XP were only
partially printed, hanging the printer in mid-page. I thought an alternative
driver might work better. I think it did, but I can't verify that now,
because I followed some advice to remove all potentially interfering printer
drivers, and now the XP machine has no drivers that could work on the Brother
laser.

Any ideas, suggestions, explnnations, etc.?

 

[Alan Morris [MSFT]]

Can you copy a file to \windows\system32\spool\drivers\w32x86\3?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

Yes, I can copy a file to that folder. I even copied to it the two genibm9.*
files for the Generic IBM Graphics 9pin printer, and merged in the registry
keys for that printer (as copied from another XP machine), and the printer
appeared in the Printers and Faxes list -- but -- the printer doesn't work.

Next question?

Can you copy a file to \windows\system32\spool\drivers\w32x86\3?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Windows XP Home. "Printer drive was not installed. Access is denied." I
get
this when I hit Finish whenever I try to install any printer that needs a
driver that isn't already installed. Microsoft can install new drivers;
when
I installed the new Office trial I got a new OneNote driver.

It all started when I installed an HP LaserJet Plus driver for a Brother
printer on LPT1, as a shared printer with an additional driver for Win9x.
I
then connected to it from a Win98 laptop on the network. Then I
uninstalled
the LJPlus and tried to install a LaserJet Series II driver. That's when I
started getting that error message.

The reason I installed the LaserJet drivers was that I had some problems
after the Brother laser came back from repair. I had physically moved
printers around and reconfigured drivers. When I switched everything back,
DTP jobs sent from a Win98 laptop to the Brother printer on the XP were
only
partially printed, hanging the printer in mid-page. I thought an
alternative
driver might work better. I think it did, but I can't verify that now,
because I followed some advice to remove all potentially interfering
printer
drivers, and now the XP machine has no drivers that could work on the
Brother
laser.

Any ideas, suggestions, explnnations, etc.?

 

[Guest]

OK, let me ask an interesting question. I can create and delete files in that
folder. I can also add entries in all the places in the Windows registry that
(a) I can see and (b) seem to be relevant to the printer driver.

But each key in the registry has permissions, including read permissions.
Suppose that by some obscure accident the Administrators group was denied
permission to read certain keys, and suppose those keys were important for
printer installation. How would I know that I didn't have permission to see
those keys? How could I get permission to read and write keys that I don't
even know exist?

And where are those registry permissions kept, anyway?

 

[Alan Morris [MSFT]]

the permissions are on the keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

Is that where the permissions are recorded, or is that what they apply to? I
exported that key I don't see anything about permissions.

Anyway, I gave Users full control of that key, propagated to all subkeys,
and I still get "permission is denied" when I try to add a printer.

Am I seeing all the necessary subkeys? Environments has several subkeys
including Windows NT x86, which has subkeys Drivers and Print Processors.
Drivers has subkeys Version-2 and Version-3, and all the printer drivers are
subkeys of Version-3. Print Processors has 4 subkeys: BRPPROC, BrPrint (both
of which I guess are for the Brother laser printer, OneNotePrint2007 (which I
guess came with Office 2007 trial) and winprint (whatever that is). Do I need
any more there?

Administrators and SYSTEM had and still have full control everywhere, Users
did not but does now. CREATOR OWNER has neither allow nor deny. All OK? (I'm
not worried about Users having full control because in there are no Users who
are not also Administrators, and they both have passwords).

the permissions are on the keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

OK, let me ask an interesting question. I can create and delete files in
that
folder. I can also add entries in all the places in the Windows registry
that
(a) I can see and (b) seem to be relevant to the printer driver.

But each key in the registry has permissions, including read permissions.
Suppose that by some obscure accident the Administrators group was denied
permission to read certain keys, and suppose those keys were important for
printer installation. How would I know that I didn't have permission to
see
those keys? How could I get permission to read and write keys that I don't
even know exist?

And where are those registry permissions kept, anyway?

 

[Alan Morris [MSFT]]

You get the same access denied error just adding one of the drivers that
shipped with XP using the Add Driver Wizard rather than the Add Printer
Wizard, correct?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Is that where the permissions are recorded, or is that what they apply to?
I
exported that key I don't see anything about permissions.

Anyway, I gave Users full control of that key, propagated to all subkeys,
and I still get "permission is denied" when I try to add a printer.

Am I seeing all the necessary subkeys? Environments has several subkeys
including Windows NT x86, which has subkeys Drivers and Print Processors.
Drivers has subkeys Version-2 and Version-3, and all the printer drivers
are
subkeys of Version-3. Print Processors has 4 subkeys: BRPPROC, BrPrint
(both
of which I guess are for the Brother laser printer, OneNotePrint2007
(which I
guess came with Office 2007 trial) and winprint (whatever that is). Do I
need
any more there?

Administrators and SYSTEM had and still have full control everywhere,
Users
did not but does now. CREATOR OWNER has neither allow nor deny. All OK?
(I'm
not worried about Users having full control because in there are no Users
who
are not also Administrators, and they both have passwords).

the permissions are on the keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

OK, let me ask an interesting question. I can create and delete files
in
that
folder. I can also add entries in all the places in the Windows
registry
that
(a) I can see and (b) seem to be relevant to the printer driver.

But each key in the registry has permissions, including read
permissions.
Suppose that by some obscure accident the Administrators group was
denied
permission to read certain keys, and suppose those keys were important
for
printer installation. How would I know that I didn't have permission to
see
those keys? How could I get permission to read and write keys that I
don't
even know exist?

And where are those registry permissions kept, anyway?

 

[Guest]

You mean the Add Printer Driver Wizard I get when I hit the New Driver button
in a printer property sheet? Yes, but instead of "Printer driver was not
installed. Access is denied" I get "Unable to install [driver name]. Access
is denied." Slightly different message, same error.

You get the same access denied error just adding one of the drivers that
shipped with XP using the Add Driver Wizard rather than the Add Printer
Wizard, correct?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

...

 

[Alan Morris [MSFT]]

I assume you are admin on the system, if not this is by design.

Open Secpol.msc
Local Policies, Security Options, User Rights Assignment, Load and unload
device drivers

Administrator should have this privilege.


--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

You mean the Add Printer Driver Wizard I get when I hit the New Driver
button
in a printer property sheet? Yes, but instead of "Printer driver was not
installed. Access is denied" I get "Unable to install [driver name].
Access
is denied." Slightly different message, same error.

You get the same access denied error just adding one of the drivers that
shipped with XP using the Add Driver Wizard rather than the Add Printer
Wizard, correct?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

...

 

[Guest]

I am admin on the system because Administrator can't log on to Windows XP
Home Edition except in Safe Mode. This is by design....?

I can't find secpol.msc. It is rumored not to be available in Windows XP
Home Edition. This is by design.

Is there any other way of doing the same thing? Can secpol.msc be installed
in Windows XP Home? There is a system running Windows XP Pro on my home
network; could that be used to fix my system?

I assume you are admin on the system, if not this is by design.

Open Secpol.msc
Local Policies, Security Options, User Rights Assignment, Load and unload
device drivers

Administrator should have this privilege.


--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

You mean the Add Printer Driver Wizard I get when I hit the New Driver
button
in a printer property sheet? Yes, but instead of "Printer driver was not
installed. Access is denied" I get "Unable to install [driver name].
Access
is denied." Slightly different message, same error.

You get the same access denied error just adding one of the drivers that
shipped with XP using the Add Driver Wizard rather than the Add Printer
Wizard, correct?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

message ...

 

[Alan Morris [MSFT]]

I have this feeling if you copied the secpol.msc file from the Pro machine
to the Home machine , it would not work. If the file is not on Home, I
don't see how the security policies would have been altered.

But you can always give it a try. Is this a new machine or did you inherit
it?

When you installed the LaserJet II driver that started the problem, I
assume this was the inbox XP version of the driver.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

I am admin on the system because Administrator can't log on to Windows XP
Home Edition except in Safe Mode. This is by design....?

I can't find secpol.msc. It is rumored not to be available in Windows XP
Home Edition. This is by design.

Is there any other way of doing the same thing? Can secpol.msc be
installed
in Windows XP Home? There is a system running Windows XP Pro on my home
network; could that be used to fix my system?

I assume you are admin on the system, if not this is by design.

Open Secpol.msc
Local Policies, Security Options, User Rights Assignment, Load and unload
device drivers

Administrator should have this privilege.


--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

You mean the Add Printer Driver Wizard I get when I hit the New Driver
button
in a printer property sheet? Yes, but instead of "Printer driver was
not
installed. Access is denied" I get "Unable to install [driver name].
Access
is denied." Slightly different message, same error.

:

You get the same access denied error just adding one of the drivers
that
shipped with XP using the Add Driver Wizard rather than the Add
Printer
Wizard, correct?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

in
message ...

 

[Guest]

Right, copying secpol.msc didn't work. I got a little pop-up titled Microsoft
Management Console that said

Snap-in failed to initialize.
Name: <unknown>
CLSID: {big long hes string}

and then a bigger window titled Local Security Settings said Snap-in
Creation Failed.

But I thought a Windows XP Pro system could do administrative tasks on other
computers in the same LAN. Alternatively, maybe secpol.msc makes changes in
the Registry that could be made by mucking about directly in the Registry.

What do you mean by "inbox XP version of the driver"?

Th eprinter I installed just before the trouble started was an HP LaserJet
Plus. I selected the driver from the list that comes up in the Add Printer
Wizard. At the bottom of the window it says "The driver is digitally signed."

But at some point I was asked whether I wanted to install additional
drivers. I installed a Windows 98 driver, but I don't remember where I got
it. I just tried to run the Wizard again telling it that the printer was on
LPT1 and I wanted to share it, but I didn't got to that point before the
printer was "not installed."

The first printer I was unable to install was an NP LaserJet Series II, also
from the Wizard's list, also digitally signed.

The computer was new in 2003, delivered with the current Windows XP
installation. I added another hard drive with partitions from the computer I
had before, including partitions from the computer before that, etc. Those
other partitions should not have affected Windows XP. But when I tried to use
System Restore right after the trouble started, it failed, because System
Restore was monitoring every little partition, and it suspends monitoring on
all partitions if any monitored partition doesn't have enough free space, and
of course I didn't want to waste free space on inactive partitions....

I have this feeling if you copied the secpol.msc file from the Pro machine
to the Home machine , it would not work. If the file is not on Home, I
don't see how the security policies would have been altered.

But you can always give it a try. Is this a new machine or did you inherit
it?

When you installed the LaserJet II driver that started the problem, I
assume this was the inbox XP version of the driver.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

I am admin on the system because Administrator can't log on to Windows XP
Home Edition except in Safe Mode. This is by design....?

I can't find secpol.msc. It is rumored not to be available in Windows XP
Home Edition. This is by design.

Is there any other way of doing the same thing? Can secpol.msc be
installed
in Windows XP Home? There is a system running Windows XP Pro on my home
network; could that be used to fix my system?

:
....

 

[Alan Morris [MSFT]]

I'm going to have to bail on this one. It looks like it's more than just a
spooler issue. Unsure how remote security administration is performed

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Right, copying secpol.msc didn't work. I got a little pop-up titled
Microsoft
Management Console that said

Snap-in failed to initialize.
Name: <unknown>
CLSID: {big long hes string}

and then a bigger window titled Local Security Settings said Snap-in
Creation Failed.

But I thought a Windows XP Pro system could do administrative tasks on
other
computers in the same LAN. Alternatively, maybe secpol.msc makes changes
in
the Registry that could be made by mucking about directly in the Registry.

What do you mean by "inbox XP version of the driver"?

Th eprinter I installed just before the trouble started was an HP LaserJet
Plus. I selected the driver from the list that comes up in the Add Printer
Wizard. At the bottom of the window it says "The driver is digitally
signed."

But at some point I was asked whether I wanted to install additional
drivers. I installed a Windows 98 driver, but I don't remember where I got
it. I just tried to run the Wizard again telling it that the printer was
on
LPT1 and I wanted to share it, but I didn't got to that point before the
printer was "not installed."

The first printer I was unable to install was an NP LaserJet Series II,
also
from the Wizard's list, also digitally signed.

The computer was new in 2003, delivered with the current Windows XP
installation. I added another hard drive with partitions from the computer
I
had before, including partitions from the computer before that, etc. Those
other partitions should not have affected Windows XP. But when I tried to
use
System Restore right after the trouble started, it failed, because System
Restore was monitoring every little partition, and it suspends monitoring
on
all partitions if any monitored partition doesn't have enough free space,
and
of course I didn't want to waste free space on inactive partitions....

I have this feeling if you copied the secpol.msc file from the Pro
machine
to the Home machine , it would not work. If the file is not on Home, I
don't see how the security policies would have been altered.

But you can always give it a try. Is this a new machine or did you
inherit
it?

When you installed the LaserJet II driver that started the problem, I
assume this was the inbox XP version of the driver.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I am admin on the system because Administrator can't log on to Windows
XP
Home Edition except in Safe Mode. This is by design....?

I can't find secpol.msc. It is rumored not to be available in Windows
XP
Home Edition. This is by design.

Is there any other way of doing the same thing? Can secpol.msc be
installed
in Windows XP Home? There is a system running Windows XP Pro on my home
network; could that be used to fix my system?

:
....

 

[Guest]

I guess this is where I bail too. Linux, here I come!

 

[Paul Baker [MVP, Windows - SDK]]

Martin,

I am not sure about how to handle this either, but if everyone else is going
to bail, I'll give it a shot.

When Alan says "inbox driver", he means a driver that came with Windows XP
(I know because I asked him the same thing in another post!). If you
installed a printer driver for Windows 98 that you got elsewhere, it is
possible that it also updated the Windows XP version of the driver and that
you no longer have an "inbox driver". In that case, it might just be
something quirky about the driver or driver installation that was not tested
by Microsoft.

Did you try just installing the Generic / Text Only driver or one that came
with Windows XP you know you haven't messed with?

I don't know what effect Safe Mode is supposed to have, but I'd like to hear
more about what you were saying about that.

In Windows Vista, as Alan explained to me, anyone can add a printer or
"inbox driver". In Windows XP, however, you must be a member of the
Administrators or Power Users group and also be given the "Load and unload
device drivers" right, which is given by default to Administrators (except
that anyone can add a connection to a network printer).

Are you an Administrator? Is your computer part of a domain or not?

Shortcuts to Administrative Tools are in this folder:
C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools

You can add it to your Start Menu by right-clicking on the Start button,
choosing Properties, then Customize, then Advanced, then look at the choices
for System Administrative Tools.

Computer Management:

From the root, choose Action > Connect to another computer to administer
remotely.
Look for log entries in System Tools\Event Viewer at the times where a
failure occurs.
System Tools\Local Users and Groups will show you users group membership.

Local Security Policy:

This will show you Local Policies\User Rights Assignment.

For other MMC-based tools, use Start/Run to run MMC, then File > Add/Remove
Snap-in, then Add.

Group Policy Object Editor:

This lists group policies and can be used to administer remotely. I am not
sure whether any of these are relevant here.

These instructions were intended for Windows XP Professional. It may be
different or unavailable in Windows XP Home Edition. But you can use the
remote option.

Paul

I guess this is where I bail too. Linux, here I come!

I'm going to have to bail on this one. It looks like it's more than just
a
spooler issue. Unsure how remote security administration is performed

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

 

[Guest]

Paul,

Let me get you up to speed by answering your questions.

INBOX DRIVERS: I guessed that "inbox driver" meant anything that came with
Windows but I wanted to be sure.

The HP LaserJet Plus and HP LaserJet Series II drivers I originally had
trouble with still show a note that says the driver is digitally signed. Just
in case that didn't really mean what it implied, and that the drivers were
changed behind the curtain, I tried a generic driver.

The Text-Only driver is no test because I have one installed already, and
the Add Printer Wizard just picks up the existing driver. I don't want to
tell it to change the driver because then I might lose the Text-Only printer
I already have.

I tried the Generic IBM Graphics printer and that failed the same way as the
others. I also tried some other "inbox drivers"; they also failed the same
way. I really can't add any printer drivers I don't already have installed.

SAFE MODE: I don't really have anything to add. A few sites on the web (but
not Microsoft) answered questions about not being able to log on as
Administrator, pointing out that in XP Home (but not XP Pro) Administrator
can only log on in Safe Mode.

So I tried Safe Mode. I logged on as Administrator. I opened Printers and
Faxes. I clicked on Add Printer. I got a little pop-up that said Printer
Spooler wasn't running so I couldn't add any printers. I opened Services and
tried to start the Print Spooler service. I got another message that the
spooler couldn't be started in Safe Mode. So I can't install printers as
Administrator.

ADMINISTRATOR: The account I always use is a member of the Administrators
group (if, technically, there is such a thing as a group in XP Home). I also
created another account in the same group; that one can't install new printer
drivers either. The point is, I was installing printers and a few minutes
later I couldn't.

"LOAD AND UNLOAD DRIVERS RIGHT": the funny thing is, I found that I could
delete printers but not install them. What kind of access control is that?

DOMAIN: My computer is not in a domain. MS Knowledge Base article 304718
says "Microsoft Windows XP Home Edition-based computers cannot join Microsoft
Windows NT 4.0-based, Windows 2000-based, or Windows Server 2003-based
domains."

ADMINISTRATIVE TOOLS: Administrative Tools\Computer Management is on my
Start Menu, and I've been exploring it. Start, Properties, Customize, check
(was not checked) Display Administrative Tools has no effect; either way,
Start\Programs\Accessories\Adminstrative Tools has six entries.

I went to the XP Pro system on my home network and didn't see Admnistrative
Tools in the Accessories menu. I entered mmc in Run, loaded compmgmt.msc and
connected to my XP Home system. It gave me the same set of snapins as on the
Home system, but they all either just showed nothing, said access denied, or
something vacuous like that. No help there, it seems, even if I could access
the Home system. And Security Policies (secpol.msc) is only local (on the Pro
machine); no option to connect to another system.

REMOTE ADMINISTRATION: I think that's a false lead. Article 304718 leads me
to believe that the Administration Tools Pack is intended only to manage
systems with "server" in the Windows OS name, and Remote Desktop just allows
a remote user to log on as though seated at the console, which wouldn't help.

WHAT NEXT? I don't know what we can do from here.

The amazing part of it is that I can remove printer drivers but not install
them. Maybe something that's needed in the process of installing printer
drivers (but not needed for removing them) is missing or corrupted. It might
(or might not) have been messed up either when I added an additional driver
to the shared printer, when I connected to it from a Win98 system, or when I
removed the driver (without first disconnecting the Win98 system, I don't
remember). I think the devil is in the details of one or more of those
processes.

Martin,

I am not sure about how to handle this either, but if everyone else is going
to bail, I'll give it a shot.

When Alan says "inbox driver", he means a driver that came with Windows XP
(I know because I asked him the same thing in another post!). If you
installed a printer driver for Windows 98 that you got elsewhere, it is
possible that it also updated the Windows XP version of the driver and that
you no longer have an "inbox driver". In that case, it might just be
something quirky about the driver or driver installation that was not tested
by Microsoft.

Did you try just installing the Generic / Text Only driver or one that came
with Windows XP you know you haven't messed with?

I don't know what effect Safe Mode is supposed to have, but I'd like to hear
more about what you were saying about that.

In Windows Vista, as Alan explained to me, anyone can add a printer or
"inbox driver". In Windows XP, however, you must be a member of the
Administrators or Power Users group and also be given the "Load and unload
device drivers" right, which is given by default to Administrators (except
that anyone can add a connection to a network printer).

Are you an Administrator? Is your computer part of a domain or not?

Shortcuts to Administrative Tools are in this folder:
C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools

You can add it to your Start Menu by right-clicking on the Start button,
choosing Properties, then Customize, then Advanced, then look at the choices
for System Administrative Tools.

Computer Management:

From the root, choose Action > Connect to another computer to administer
remotely.
Look for log entries in System Tools\Event Viewer at the times where a
failure occurs.
System Tools\Local Users and Groups will show you users group membership.

Local Security Policy:

This will show you Local Policies\User Rights Assignment.

For other MMC-based tools, use Start/Run to run MMC, then File > Add/Remove
Snap-in, then Add.

Group Policy Object Editor:

This lists group policies and can be used to administer remotely. I am not
sure whether any of these are relevant here.

These instructions were intended for Windows XP Professional. It may be
different or unavailable in Windows XP Home Edition. But you can use the
remote option.

Paul

I guess this is where I bail too. Linux, here I come!

I'm going to have to bail on this one. It looks like it's more than just
a
spooler issue. Unsure how remote security administration is performed

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

 

[Paul Baker [MVP, Windows - SDK]]

Martin,

Thanks for the information. You are right, the various administrative tools
are not helping.

The built-in Administrator account may behave differently than one you added
yourself, though I don't know much about that. If I were you, I would
continue your tests with an administrative account you added rather than the
built-in one. I found these related articles:
http://support.microsoft.com/kb/314412/en-us
http://support.microsoft.com/kb/298252/en-us
http://support.microsoft.com/kb/926183/en-us

Yes, there is an built-in Administratrors group in Windows XP Home Edition
that a new user is added to when you choose the "Administrative user" radio
button in the Users and Accounts Control Panel.

What changed between the time it worked and the time it didn't work? Did you
log off? Reboot? Install software? Or just use the bathroom and come back to
find everything went to heck?!

Did you check the permissions in the C:\WINDOWS\system32\spool\drivers
folder, especially C:\WINDOWS\system32\spool\drivers\w32x86\3? You may find
it easier to examine if you use Folder Options to turn off "Use Simple File
Sharing".

You can turn on auditing of successes and failures (or can you in Windows XP
Home Edition?) to see what the last thing it succeeded in doing was and the
first thing that failed. You can also use a tool like File Monitor or
Registry Monitor from Sysinternals to produce a log of file or registry
access.

Unfortunately, in Windows XP Home Edition, some security features are
missing, some are hidden but can be shown and some are hidden eg. in the
registry. For security-specific questions, you could try
microsoft.public.platformsdk.security. But it would probably be preferable
to continue this thread as long as it is productive instead of explaining it
all over again.

Paul

Paul,

Let me get you up to speed by answering your questions.

INBOX DRIVERS: I guessed that "inbox driver" meant anything that came with
Windows but I wanted to be sure.

The HP LaserJet Plus and HP LaserJet Series II drivers I originally had
trouble with still show a note that says the driver is digitally signed.
Just
in case that didn't really mean what it implied, and that the drivers were
changed behind the curtain, I tried a generic driver.

The Text-Only driver is no test because I have one installed already, and
the Add Printer Wizard just picks up the existing driver. I don't want to
tell it to change the driver because then I might lose the Text-Only
printer
I already have.

I tried the Generic IBM Graphics printer and that failed the same way as
the
others. I also tried some other "inbox drivers"; they also failed the same
way. I really can't add any printer drivers I don't already have
installed.

SAFE MODE: I don't really have anything to add. A few sites on the web
(but
not Microsoft) answered questions about not being able to log on as
Administrator, pointing out that in XP Home (but not XP Pro) Administrator
can only log on in Safe Mode.

So I tried Safe Mode. I logged on as Administrator. I opened Printers and
Faxes. I clicked on Add Printer. I got a little pop-up that said Printer
Spooler wasn't running so I couldn't add any printers. I opened Services
and
tried to start the Print Spooler service. I got another message that the
spooler couldn't be started in Safe Mode. So I can't install printers as
Administrator.

ADMINISTRATOR: The account I always use is a member of the Administrators
group (if, technically, there is such a thing as a group in XP Home). I
also
created another account in the same group; that one can't install new
printer
drivers either. The point is, I was installing printers and a few minutes
later I couldn't.

"LOAD AND UNLOAD DRIVERS RIGHT": the funny thing is, I found that I could
delete printers but not install them. What kind of access control is that?

DOMAIN: My computer is not in a domain. MS Knowledge Base article 304718
says "Microsoft Windows XP Home Edition-based computers cannot join
Microsoft
Windows NT 4.0-based, Windows 2000-based, or Windows Server 2003-based
domains."

ADMINISTRATIVE TOOLS: Administrative Tools\Computer Management is on my
Start Menu, and I've been exploring it. Start, Properties, Customize,
check
(was not checked) Display Administrative Tools has no effect; either way,
Start\Programs\Accessories\Adminstrative Tools has six entries.

I went to the XP Pro system on my home network and didn't see
Admnistrative
Tools in the Accessories menu. I entered mmc in Run, loaded compmgmt.msc
and
connected to my XP Home system. It gave me the same set of snapins as on
the
Home system, but they all either just showed nothing, said access denied,
or
something vacuous like that. No help there, it seems, even if I could
access
the Home system. And Security Policies (secpol.msc) is only local (on the
Pro
machine); no option to connect to another system.

REMOTE ADMINISTRATION: I think that's a false lead. Article 304718 leads
me
to believe that the Administration Tools Pack is intended only to manage
systems with "server" in the Windows OS name, and Remote Desktop just
allows
a remote user to log on as though seated at the console, which wouldn't
help.

WHAT NEXT? I don't know what we can do from here.

The amazing part of it is that I can remove printer drivers but not
install
them. Maybe something that's needed in the process of installing printer
drivers (but not needed for removing them) is missing or corrupted. It
might
(or might not) have been messed up either when I added an additional
driver
to the shared printer, when I connected to it from a Win98 system, or when
I
removed the driver (without first disconnecting the Win98 system, I don't
remember). I think the devil is in the details of one or more of those
processes.

Martin,

I am not sure about how to handle this either, but if everyone else is
going
to bail, I'll give it a shot.

When Alan says "inbox driver", he means a driver that came with Windows
XP
(I know because I asked him the same thing in another post!). If you
installed a printer driver for Windows 98 that you got elsewhere, it is
possible that it also updated the Windows XP version of the driver and
that
you no longer have an "inbox driver". In that case, it might just be
something quirky about the driver or driver installation that was not
tested
by Microsoft.

Did you try just installing the Generic / Text Only driver or one that
came
with Windows XP you know you haven't messed with?

I don't know what effect Safe Mode is supposed to have, but I'd like to
hear
more about what you were saying about that.

In Windows Vista, as Alan explained to me, anyone can add a printer or
"inbox driver". In Windows XP, however, you must be a member of the
Administrators or Power Users group and also be given the "Load and
unload
device drivers" right, which is given by default to Administrators
(except
that anyone can add a connection to a network printer).

Are you an Administrator? Is your computer part of a domain or not?

Shortcuts to Administrative Tools are in this folder:
C:\Documents and Settings\All Users\Start Menu\Programs\Administrative
Tools

You can add it to your Start Menu by right-clicking on the Start button,
choosing Properties, then Customize, then Advanced, then look at the
choices
for System Administrative Tools.

Computer Management:

From the root, choose Action > Connect to another computer to administer
remotely.
Look for log entries in System Tools\Event Viewer at the times where a
failure occurs.
System Tools\Local Users and Groups will show you users group membership.

Local Security Policy:

This will show you Local Policies\User Rights Assignment.

For other MMC-based tools, use Start/Run to run MMC, then File >
Add/Remove
Snap-in, then Add.

Group Policy Object Editor:

This lists group policies and can be used to administer remotely. I am
not
sure whether any of these are relevant here.

These instructions were intended for Windows XP Professional. It may be
different or unavailable in Windows XP Home Edition. But you can use the
remote option.

Paul

I guess this is where I bail too. Linux, here I come!

:

I'm going to have to bail on this one. It looks like it's more than
just
a
spooler issue. Unsure how remote security administration is performed

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

 

[Guest]

Paul,

To avoid repeating myself: "what changed" is described in the first post in
this thread. Permissions in the folder you asked about are covered in the
third post (my second post), but briefly, I can read/write/delete in that
folder.

I looked up auditing of events on the web and it seems to involve group
policies and local security policy, neither of which exist in Win XP Home.

I downloaded and ran Process Monitor (which supersedes File Monitor and
Registry Monitor in Win XP) from Sysinternals. A lot of other processes are
active: svchost, mozybackup, nprotect, winlogon, . It seems that explorer.exe
is doing all the work of installing the printer driver. There are a lot of
SUCCESSes and a few other things, but the non-SUCCESSes look as though they
might be intended to find something if it's there, or to make sure it's not
there, so I can't say I've found a smoking gun.

It would help if I could identify to the microsecond when the installer
declares failure, so I could know where to look in the Process Monitor
output. What's the process that sets up the Access denied message?

 

[Paul Baker [MVP, Windows - SDK]]

Martin,

I had to use Google Groups to find old posts that I had deleted, but I got
the information I needed.

I do think it is Explorer that is getting the access denied error, as this
is the process hosting the Add Printer Wizard. It must go through the
AddPrinterDriver and AddPrinter Winspool APIs. So if the Print Spooler
service or any components it is using is compromised in any way, it could
cause failure here. So I would advise deleting all the stuff the Print
Spooler service might be using with this Cleanspl utility, then try again.
It will delete the Brother driver that may have started this all, for one
thing.

http://www.microsoft.com/downloads/...69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en

In Process Monitor, you probably don't need to be concerned with NOT FOUND
messages, only ACCESS DENIED messages. You may post the log here if you want
us to examine it, noting the approximate time of failure.

Paul

 

[Guest]

That spooler cleaner doesn't work. The download page says it's supported in
Windows XP Home and XP Home SP1. I have SP2. It kept giving me "not found"
and "cannot delete" messages. I deleted manually the files it said it
couldn't delete, but when it got to "Unable to get the sub key names of the
registry key
'\\Martin\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
4.0\Drivers'. More data is available." I didn't know how to help it.

There's a manual procedure for cleaning the spooler at
http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm - do you think it
might help?

The only ACCESS DENIED message I saw that had anything to do with the
printer installation was for a registry key that had been successfully
accessed milliseconds before and again milliseconds later. I don't know what
that might mean, if anything.

Meanwhile I still can't install printers and all the printers that used to
work are deleted. I do have a restore point and a copy of the whole spool
folder, so I might be able to get back the ones that were working.