How to delegate the permission to create printers on DC ?

[printer admin]

Does anybody know how I can delegate the permission to
install printers on my W2K servers (and DC's) in my
AD domain ?
I want to delegate this (and nothing more) to printer
administrators on the remote sites.

Tried Policy settings :
- Load and unload drivers...
- Prevent users to install printers ...

Searched the Knowledge base

No success and getting pretty tiered of it.

 

[Chriss3]

Do you mean delegate the right to create a printer object in AD or logon to
the Domain Controller and install a printer and share it?

Use Delegate of Control Wizard to delegate creation of objects in the Active
Directory. Other wise they may should be member of the Built-in Printer
Operators Group to perform an installation of a printer device since Printer
Operators are allowed to logon locally to Domain Controllers by default.

Step-by-Step Guide to Using the Delegation of Control Wizard
http://www.microsoft.com/windows2000/techinfo/planning/activedirectory/delegsteps.asp

 

[pinter admin]

Thanks for the reply, but...

I don't want them to create the objects, but to logon on
the DC (this works fine) and to install a printer on it
that can be shared to the users.
They must as well be able to manage the printer afterwards.

When they logon (via Terminal Svcs) and want to create the
printer, the 'local printer' option is grayed out.
The network printer option is available.

I don't want to use the built in Printer Operators group,
because I have multiple sites with each an own DC and
servers. Those local admin should not be able to manage
the servers on remote sites (this is, not able to install
printers on it).

 

[Chriss3]

Then you may want to modify the Allow Logon Locally Right within a Group
Policy. You can here use different policies for different sites this provide
some security if you create your own group like Printer Operators Site1 and
add them to GPO SITE1 and link it to the Site object. Feel free to post
back. Have a nice day!

 

[Guest]

The users can 'log on locally' on the DC.
But, when they open up control panel, printers, add
printer, the "local printer" option is grayed out.