Prevented from adding users

[Guest]

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying either "You
do not have sufficient security privileges to install hardware on this
computer. Please contact your site Administrator, or logout and log in again
as an administrator and try again. " (WINXP clients) or "A policy is in
effect on your computer which prevents you from connecting to this print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers or adding
printers etc. What can I do?

 

[Alan Morris [MSFT]]

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Alan Morris [MSFT]]

There is a security policy of Server that prevents driver addition for
users.

There is a local policy on the XP SP2 machines preventing connections to
machines in non trusted domains. You can override this with a domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients running SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain default
as well as my own policy and can´t find anything to set this straight. What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition for
users.

There is a local policy on the XP SP2 machines preventing connections to
machines in non trusted domains. You can override this with a domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients running SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying either "You
do not have sufficient security privileges to install hardware on this
computer. Please contact your site Administrator, or logout and log in
again
as an administrator and try again. " (WINXP clients) or "A policy is in
effect on your computer which prevents you from connecting to this print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers or adding
printers etc. What can I do?

 

[Alan Morris [MSFT]]

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel / Printers /
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to for
point and print. The policy setting applies only to non Print Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing point and
print only within the client's forest.

When the policy setting is disabled, client machines can point and print to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain default
as well as my own policy and can´t find anything to set this straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition for
users.

There is a local policy on the XP SP2 machines preventing connections to
machines in non trusted domains. You can override this with a domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying either
"You
do not have sufficient security privileges to install hardware on this
computer. Please contact your site Administrator, or logout and log in
again
as an administrator and try again. " (WINXP clients) or "A policy is in
effect on your computer which prevents you from connecting to this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers or
adding
printers etc. What can I do?

 

[Guest]

I have checked the default settings on my server 2003 and XP client. On both
of them the settings are "not configured". I have tried settings "prevent
users from installing printer drivers" to disabled on the server and "point
and print restrictions" to disabled to allow connecting to any server. I
still get the sam message (GPO has bee refreshed by restarting XP clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel / Printers /
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to for
point and print. The policy setting applies only to non Print Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing point and
print only within the client's forest.

When the policy setting is disabled, client machines can point and print to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain default
as well as my own policy and can´t find anything to set this straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition for
users.

There is a local policy on the XP SP2 machines preventing connections to
machines in non trusted domains. You can override this with a domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying either
"You
do not have sufficient security privileges to install hardware on this
computer. Please contact your site Administrator, or logout and log in
again
as an administrator and try again. " (WINXP clients) or "A policy is in
effect on your computer which prevents you from connecting to this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers or
adding
printers etc. What can I do?

 

[Alan Morris [MSFT]]

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

I have checked the default settings on my server 2003 and XP client. On
both
of them the settings are "not configured". I have tried settings "prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any server. I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel / Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain
default
as well as my own policy and can´t find anything to set this straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition for
users.

There is a local policy on the XP SP2 machines preventing connections
to
machines in non trusted domains. You can override this with a domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware on
this
computer. Please contact your site Administrator, or logout and log
in
again
as an administrator and try again. " (WINXP clients) or "A policy is
in
effect on your computer which prevents you from connecting to this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers or
adding
printers etc. What can I do?

 

[Guest]

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

I have checked the default settings on my server 2003 and XP client. On
both
of them the settings are "not configured". I have tried settings "prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any server. I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel / Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain
default
as well as my own policy and can´t find anything to set this straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition for
users.

There is a local policy on the XP SP2 machines preventing connections
to
machines in non trusted domains. You can override this with a domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware on
this
computer. Please contact your site Administrator, or logout and log
in
again
as an administrator and try again. " (WINXP clients) or "A policy is
in
effect on your computer which prevents you from connecting to this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers or
adding
printers etc. What can I do?

 

[Alan Morris [MSFT]]

Can the user make the connection by opening the remote machine (START, Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you get the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting for the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have checked the default settings on my server 2003 and XP client. On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to
only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware on
this
computer. Please contact your site Administrator, or logout and
log
in
again
as an administrator and try again. " (WINXP clients) or "A policy
is
in
effect on your computer which prevents you from connecting to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers
or
adding
printers etc. What can I do?

 

[Guest]

Right clicking and connecting to printer works. The same error message
appears when it tries to connect though.

XP SP2.

It seems to be getting it´s point and print from the domain.

"Alan Morris [MSFT]" skrev:

Can the user make the connection by opening the remote machine (START, Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you get the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting for the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have checked the default settings on my server 2003 and XP client. On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to
only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware on
this
computer. Please contact your site Administrator, or logout and
log
in
again
as an administrator and try again. " (WINXP clients) or "A policy
is
in
effect on your computer which prevents you from connecting to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers
or
adding
printers etc. What can I do?

 

[Guest]

No clusters, missed that question!
I also receive the error message "You do not have sufficient access to your
computer to connect to the selected printer" on some machines.

"Alan Morris [MSFT]" skrev:

Can the user make the connection by opening the remote machine (START, Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you get the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting for the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have checked the default settings on my server 2003 and XP client. On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to
only
point and print to a server within its own forest, and/or to a list of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware on
this
computer. Please contact your site Administrator, or logout and
log
in
again
as an administrator and try again. " (WINXP clients) or "A policy
is
in
effect on your computer which prevents you from connecting to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing drivers
or
adding
printers etc. What can I do?

 

[Alan Morris [MSFT]]

Did disabling the policy in the domain GPO (or configuring it with your
print server name) correct the issue?

If the "sufficient access" message is on Server 2003 machine when the user
is logged on that's a policy setting.


Without stepping through the debugger on this I am unsure why the client
domain access check is failing.

You can get around all this by using drivers that ship in XP or install the
drivers on te clients before making the connection.
you can use the wmi print scripts to accomplish this remotely but the driver
files need to be copied to the client unless you enabled delegation in your
domain (I'm unsure how to do the delegation thing since I don't get admin
right to the MS domain).

md \\remotemachine\c$\drivers
copy \\path\to\driverfiles\* \\remotemachine\c$\drivers
prndrvr.vbs -a -m "model name of printer" -v 3 -e "Windows NT x86" -h
c:\drivers -i c:\drivers\driver.inf -s remotemachine

This why the client does not have to copy the driver from the "untrusted"
server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

No clusters, missed that question!
I also receive the error message "You do not have sufficient access to
your
computer to connect to the selected printer" on some machines.

"Alan Morris [MSFT]" skrev:

Can the user make the connection by opening the remote machine (START,
Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you get
the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting for
the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have checked the default settings on my server 2003 and XP client.
On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any
server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect
to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to
only
point and print to a server within its own forest, and/or to a list
of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the
domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver
addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers
no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware
on
this
computer. Please contact your site Administrator, or logout
and
log
in
again
as an administrator and try again. " (WINXP clients) or "A
policy
is
in
effect on your computer which prevents you from connecting to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing
drivers
or
adding
printers etc. What can I do?

 

[Guest]

Disabling the policy has not resolved the problem. Is it the sam policy
setting I should configure my print server name?

The "you do not have sufficient access" error message only appears on Win XP
since when I´m logged on to the server I´m logged on as administrator.

Did disabling the policy in the domain GPO (or configuring it with your
print server name) correct the issue?

If the "sufficient access" message is on Server 2003 machine when the user
is logged on that's a policy setting.


Without stepping through the debugger on this I am unsure why the client
domain access check is failing.

You can get around all this by using drivers that ship in XP or install the
drivers on te clients before making the connection.
you can use the wmi print scripts to accomplish this remotely but the driver
files need to be copied to the client unless you enabled delegation in your
domain (I'm unsure how to do the delegation thing since I don't get admin
right to the MS domain).

md \\remotemachine\c$\drivers
copy \\path\to\driverfiles\* \\remotemachine\c$\drivers
prndrvr.vbs -a -m "model name of printer" -v 3 -e "Windows NT x86" -h
c:\drivers -i c:\drivers\driver.inf -s remotemachine

This why the client does not have to copy the driver from the "untrusted"
server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

No clusters, missed that question!
I also receive the error message "You do not have sufficient access to
your
computer to connect to the selected printer" on some machines.

"Alan Morris [MSFT]" skrev:

Can the user make the connection by opening the remote machine (START,
Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you get
the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting for
the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have checked the default settings on my server 2003 and XP client.
On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server and
"point
and print restrictions" to disabled to allow connecting to any
server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can connect
to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted to
only
point and print to a server within its own forest, and/or to a list
of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the
domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver
addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers
no
rights.

I have a 2003 server as a printserver, with a printer shared.
When users try to add the printer the receive a message saying
either
"You
do not have sufficient security privileges to install hardware
on
this
computer. Please contact your site Administrator, or logout
and
log
in
again
as an administrator and try again. " (WINXP clients) or "A
policy
is
in
effect on your computer which prevents you from connecting to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing
drivers
or
adding
printers etc. What can I do?

 

[Alan Morris [MSFT]]

Yes the same policy, but disabling will allow the clients to make a
connection without the (there is a policy in affect...) message. Does this
happen for all printers you attempt to make a connection or only some
printers?

If the issue now is the "you do not have sufficient access" message then the
clients are getting past the Trusted Server policy and are now hitting a
problem when installing the driver?

What model is the printer?

Setup a machine where users have write access to \windows\system32\spool
and subdirectories and see if the user can connect.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Disabling the policy has not resolved the problem. Is it the sam policy
setting I should configure my print server name?

The "you do not have sufficient access" error message only appears on Win
XP
since when I´m logged on to the server I´m logged on as administrator.

Did disabling the policy in the domain GPO (or configuring it with your
print server name) correct the issue?

If the "sufficient access" message is on Server 2003 machine when the
user
is logged on that's a policy setting.


Without stepping through the debugger on this I am unsure why the client
domain access check is failing.

You can get around all this by using drivers that ship in XP or install
the
drivers on te clients before making the connection.
you can use the wmi print scripts to accomplish this remotely but the
driver
files need to be copied to the client unless you enabled delegation in
your
domain (I'm unsure how to do the delegation thing since I don't get admin
right to the MS domain).

md \\remotemachine\c$\drivers
copy \\path\to\driverfiles\* \\remotemachine\c$\drivers
prndrvr.vbs -a -m "model name of printer" -v 3 -e "Windows NT x86" -h
c:\drivers -i c:\drivers\driver.inf -s remotemachine

This why the client does not have to copy the driver from the "untrusted"
server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

No clusters, missed that question!
I also receive the error message "You do not have sufficient access to
your
computer to connect to the selected printer" on some machines.

"Alan Morris [MSFT]" skrev:

Can the user make the connection by opening the remote machine (START,
Run,
\\printservername)

Right click the printer, Connect

XP Service Pack 1 or Service Pack 2?

Is the print server a cluster. You will need to enable kerberos on
clusters.

But that should not matter if the policy is disabled. But since you
get
the
message the policy is enabled. (just thinking here).

Run rsop.msc on the client and see where it's picking up the setting
for
the
Point and Print policy.



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

Hello and thanks for your reply.
I was unclear, the error message only appears on our Windows XP pro
clients.

"Alan Morris [MSFT]" skrev:

So now all the machines get this error?

"A policy is in effect on your computer which prevents you from
connecting
to this print queue. Please contact your system administrator. "

Win2k or Server2003 DCs?

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no
rights.

I have checked the default settings on my server 2003 and XP
client.
On
both
of them the settings are "not configured". I have tried settings
"prevent
users from installing printer drivers" to disabled on the server
and
"point
and print restrictions" to disabled to allow connecting to any
server.
I
still get the sam message (GPO has bee refreshed by restarting XP
clients).


"Alan Morris [MSFT]" skrev:

Win2k is not affected by either policy.

On Server 2003 launch secpol.msc
Security Options / Devices: Prevent users from installing
printers
drivers
(default is enabled on Server, default on XP is enabled)

On XP
launch gpedit.msc
User Configuration / Administrative Templates / Control Panel /
Printers
/
Point and Print Restrictions


This policy setting restricts the servers that a client can
connect
to
for
point and print. The policy setting applies only to non Print
Administrators
clients, and only to machines that are members of a domain.

When the policy setting is enabled, the client can be restricted
to
only
point and print to a server within its own forest, and/or to a
list
of
explicitly trusted servers.

When the policy setting is not-configured, it defaults to
allowing
point
and
print only within the client's forest.

When the policy setting is disabled, client machines can point
and
print
to
any server.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers
no
rights.

Hello and thanks for your reply.
I have checked all policy setting regarding printers in the
domain
default
as well as my own policy and can´t find anything to set this
straight.
What
setting should I use to override the xp default policy?
I´m running server 2003 SP1, XP SP2 and W2K SP4.

/Alex

"Alan Morris [MSFT]" skrev:

There is a security policy of Server that prevents driver
addition
for
users.

There is a local policy on the XP SP2 machines preventing
connections
to
machines in non trusted domains. You can override this with
a
domain
policy.


You should not have any problem with Win2k clients.


What OS are the domain controllers running? Are the XP
clients
running
SP1
or SP2?







--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and
confers
no
rights.

I have a 2003 server as a printserver, with a printer
shared.
When users try to add the printer the receive a message
saying
either
"You
do not have sufficient security privileges to install
hardware
on
this
computer. Please contact your site Administrator, or logout
and
log
in
again
as an administrator and try again. " (WINXP clients) or "A
policy
is
in
effect on your computer which prevents you from connecting
to
this
print
queue. Please contact your system administrator. " (WIN2K).
There is no GPO setting preventing them from installing
drivers
or
adding
printers etc. What can I do?