All users printers showing up on terminal server

[Guest James]

Hi,

 

Windows 2003sp2 terminal server. XPsp2 and Vista clients.

 

When the users log onto TS all the redirected printers are show on the

printers dialogue. At present there are 50 printers on view (Approx 5 for

each of the 10 users). I think this is caused by the fact that all users are

"power users" on the 2003 server. Unfortunately this "power user" status is

required to allow a bespoke database application to work. I'm aware that this

a far from ideal but is there a way for each user to only see their own

"redirected" printers not everyone elses. I could not see this in Group

Policy only the ability to disable printer redirection On or OFF.

Most users use printer redirection but some of them are confused with long

list. This problem seems to have appeared or increased after I enabled the

"fail back" printer drivers after driver problems on the server. Any

suggestions would be most welcome. thanks

[Guest TP]

Re: All users printers showing up on terminal server

 

Hi,

 

You need to remove your users from the Power Users

group. Members of this group have the ability to become

administrators if they choose to (or if a malware program

they run chooses to). In the *best* case it is likely that the

server will eventually have application errors and other

strange issues and will need to be redone.

 

Use Process Monitor to determine which ntfs and registry

permissions the database application needs to run. That way

you can grant only those permissions that are necessary.

The most common case is read/write access to the app's

registry key under HKLM, and modify access to the app's

program folder(s) (for example, a folder under program

files and program files\common files).

 

In the most *rare* cases you can use virtualization software

to allow a stubborn application to run without high privileges.

This is not the case for you since your application will run

okay with Power Users membership.

 

A member of the Power Users group may be able to gain

administrator rights and permissions in Windows Server 2003,

Windows 2000, or Windows XP

 

http://support.microsoft.com/kb/825069

 

-TP

 

James wrote:

> Hi,

>

> Windows 2003sp2 terminal server. XPsp2 and Vista clients.

>

> When the users log onto TS all the redirected printers are show on the

> printers dialogue. At present there are 50 printers on view (Approx 5

> for each of the 10 users). I think this is caused by the fact that

> all users are "power users" on the 2003 server. Unfortunately this

> "power user" status is required to allow a bespoke database

> application to work. I'm aware that this a far from ideal but is

> there a way for each user to only see their own "redirected" printers

> not everyone elses. I could not see this in Group Policy only the

> ability to disable printer redirection On or OFF.

> Most users use printer redirection but some of them are confused with

> long list. This problem seems to have appeared or increased after I

> enabled the "fail back" printer drivers after driver problems on the

> server. Any suggestions would be most welcome. thanks

[Guest James]

Re: All users printers showing up on terminal server

 

TP, thanks for taking the time to reply. Yes I think this is the best route,

I'm well aware of the dangers of running with elevated privileges but didn't

know it come cause app problems on Terminal Servers. There are lots of app

hangs happening on this server could be because of elevated privileges (Power

user). Thanks again for your helpful advise.

 

"TP" wrote:

> Hi,

>

> You need to remove your users from the Power Users

> group. Members of this group have the ability to become

> administrators if they choose to (or if a malware program

> they run chooses to). In the *best* case it is likely that the

> server will eventually have application errors and other

> strange issues and will need to be redone.

>

> Use Process Monitor to determine which ntfs and registry

> permissions the database application needs to run. That way

> you can grant only those permissions that are necessary.

> The most common case is read/write access to the app's

> registry key under HKLM, and modify access to the app's

> program folder(s) (for example, a folder under program

> files and program files\common files).

>

> In the most *rare* cases you can use virtualization software

> to allow a stubborn application to run without high privileges.

> This is not the case for you since your application will run

> okay with Power Users membership.

>

> A member of the Power Users group may be able to gain

> administrator rights and permissions in Windows Server 2003,

> Windows 2000, or Windows XP

>

> http://support.microsoft.com/kb/825069

>

> -TP

>

> James wrote:

> > Hi,

> >

> > Windows 2003sp2 terminal server. XPsp2 and Vista clients.

> >

> > When the users log onto TS all the redirected printers are show on the

> > printers dialogue. At present there are 50 printers on view (Approx 5

> > for each of the 10 users). I think this is caused by the fact that

> > all users are "power users" on the 2003 server. Unfortunately this

> > "power user" status is required to allow a bespoke database

> > application to work. I'm aware that this a far from ideal but is

> > there a way for each user to only see their own "redirected" printers

> > not everyone elses. I could not see this in Group Policy only the

> > ability to disable printer redirection On or OFF.

> > Most users use printer redirection but some of them are confused with

> > long list. This problem seems to have appeared or increased after I

> > enabled the "fail back" printer drivers after driver problems on the

> > server. Any suggestions would be most welcome. thanks

>