Publish Printers and Windows security?

[Gerry Hickman]

Hi,

I have a print server joined to a native Active Directory domain as a
member server. I have never logged into this box as a domain user, nor a
domain admin.

If I add a printer and tell it to "share" and "publish to AD" it works,
but WHY???

How can it "publish" when I'm logged in as a local Administrator?

 

[Brian Desmond [MVP]]

Users have certan rights in AD to create printQueue objects under computers.
What happens when you press publish is an object is created initially below
the server's CN in AD representing the printer.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Gerry Hickman]

Thanks Brian,

But I still don't see how a NON DOMAIN user (the local Admin is this
case) can create print queues? Are you saying the anonymous login (or
guest) can create print queues?

 

[Brian Desmond [MVP]]

Hmm. now that I think abiut it, the computer object may have the rights, not
the user. I've never actually looked, but this makes more sense.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Gerry Hickman]

Hi Brian,

That's the thing, otherwise it does not seem to make sense. How can I
view the rights of a "computer" object?

 

[Brian Desmond [MVP]]

If you goto View>Advanced Features in AD Users & Computers, you can then
right click an object, goto properties, and then security. Look at the
properties of the domain, and of a computer object.

--
--
Brian Desmond
Windows Server MVP
(e-mail address removed)12.il.us

Http://www.briandesmond.com

 

[Gerry Hickman]

OK thanks Brian,

I'll check it out next week.

If you goto View>Advanced Features in AD Users & Computers, you can then
right click an object, goto properties, and then security. Look at the
properties of the domain, and of a computer object.