Multi-Session Printers?

[Guest MBN]

Hi Everyone,

I am having a problem with my Win 2K3 terminal servers. Some of my

customers (I havent asked them all yet) are reporting that they are seeing

printers that belong to the same login eg companyXYZ but are from different

sessions eg. (23,36). I thought that you were only allowed to see the

printers that are from your own session?

 

I have checked that the account is not part of anything other then the

'Domain Users', and I have also checked that they are not in any of the

local groups such as "Print Operators" / "Power Users" / "Administrators"

etc.

 

I have never noticed this happening before and I dont know that it is

normal. They think (customers) that it has only happened in the last few

weeks, but apart from installing Symantec Ghost Console (11.0.1.1533)

nothing has changed in the last few weeks (the affected machines have NOT

been imaged). All my terminal servers are exhibiting this problem, and I am

at a loss to understand why.

 

Could someone confirm/deny that this is normal and do they have any ideas

that I could try to resolve this please.

 

Thanks

Murray

[Guest TP]

Re: Multi-Session Printers?

 

Hi Murray,

 

Are you allowing multiple concurrent logins using the

same user name? If yes then this explains the behavior

you are seeing. In 2003 a user can see printers from

other sessions running under the same account.

 

In Windows Server 2008 this has changed so that

each session can only see its own autocreated printers.

 

It is recommended to only allow one session for each

user account. This will help prevent unexpected default

printer changes and other problems caused by sharing

the same profile. The Restrict each user to one session

option is set in Terminal Services Configuration (tscc.msc).

 

Please let me know if the above does not apply to your

case and I will assist you further.

 

Thanks.

 

-TP

 

MBN wrote:

> Hi Everyone,

> I am having a problem with my Win 2K3 terminal servers. Some of my

> customers (I havent asked them all yet) are reporting that they are

> seeing printers that belong to the same login eg companyXYZ but are

> from different sessions eg. (23,36). I thought that you were only

> allowed to see the printers that are from your own session?

>

> I have checked that the account is not part of anything other then the

> 'Domain Users', and I have also checked that they are not in any of

> the local groups such as "Print Operators" / "Power Users" /

> "Administrators" etc.

>

> I have never noticed this happening before and I dont know that it is

> normal. They think (customers) that it has only happened in the last

> few weeks, but apart from installing Symantec Ghost Console

> (11.0.1.1533) nothing has changed in the last few weeks (the affected

> machines have NOT been imaged). All my terminal servers are

> exhibiting this problem, and I am at a loss to understand why.

>

> Could someone confirm/deny that this is normal and do they have any

> ideas that I could try to resolve this please.

>

> Thanks

> Murray

[Guest MBN]

Re: Multi-Session Printers?

 

Hi TP,

 

Thanks for your reply, unfortunately using individual accounts is a problem

as we provide a service to other companys to 'host' random bits of software.

What happens is they come to us with a piece of software and they buy 30

users of hosting and we provide company XYZ with 30 concurrent logins and we

do all the backups etc for that piece of software.

 

Apart from confusing the users, its becoming a problem when printers arent

being removed when people log out. Ive checked all the permissions on the

registry and I run a printer delete script every night, its just that some

people log in and out 15 times a day and end up with so many printers listed

before the script cleans things up.

 

We only install WHQL signed drivers, but it's becoming too complicated to

manage and we are trying to move to a 3rd party solution such as ThinPrint.

 

I guess that I need to find some way of hiding printers that dont belong to

that session and to make/steal a script that runs when the user logs off

that loops through all their printers and deletes them. Do you have any

ideas that I could use please?

 

 

 

"TP" <tperson.knowspamn@mailandnews.com> wrote in message

news:%230L4onuJIHA.2176@TK2MSFTNGP06.phx.gbl...

> Hi Murray,

>

> Are you allowing multiple concurrent logins using the same user name? If

> yes then this explains the behavior you are seeing. In 2003 a user can

> see printers from other sessions running under the same account.

>

> In Windows Server 2008 this has changed so that each session can only see

> its own autocreated printers.

>

> It is recommended to only allow one session for each user account. This

> will help prevent unexpected default printer changes and other problems

> caused by sharing the same profile. The Restrict each user to one session

> option is set in Terminal Services Configuration (tscc.msc).

>

> Please let me know if the above does not apply to your case and I will

> assist you further.

>

> Thanks.

>

> -TP

>

> MBN wrote:

>> Hi Everyone,

>> I am having a problem with my Win 2K3 terminal servers. Some of my

>> customers (I havent asked them all yet) are reporting that they are

>> seeing printers that belong to the same login eg companyXYZ but are

>> from different sessions eg. (23,36). I thought that you were only

>> allowed to see the printers that are from your own session?

>>

>> I have checked that the account is not part of anything other then the

>> 'Domain Users', and I have also checked that they are not in any of

>> the local groups such as "Print Operators" / "Power Users" /

>> "Administrators" etc.

>>

>> I have never noticed this happening before and I dont know that it is

>> normal. They think (customers) that it has only happened in the last

>> few weeks, but apart from installing Symantec Ghost Console

>> (11.0.1.1533) nothing has changed in the last few weeks (the affected

>> machines have NOT been imaged). All my terminal servers are

>> exhibiting this problem, and I am at a loss to understand why.

>>

>> Could someone confirm/deny that this is normal and do they have any

>> ideas that I could try to resolve this please.

>>

>> Thanks

>> Murray

[Guest TP]

Re: Multi-Session Printers?

 

Hi Murray,

 

Your current design is flawed and needs to be changed. I

realize that may not be the answer you were expecting.

Below is information to help you decide what changes to

make.

 

Licensing considerations

 

There is no concurrent licensing for terminal services. If I

understand your situation correctly, it falls under the Service

Provider Licensing Agreement (SPLA). Under this there is

only Per User (for TS) and it is calculated on a monthly basis.

This means you need to have a TS Subscriber Access License

(SAL) for each person that will use the TS during the month,

*not* for each concurrent user.

 

It is not a requirement of the agreement to have a one to

one relationship between subscribers and user accounts, but

it makes sense for compliance tracking and technical reasons.

 

Again the main point of the above is that there is no concurrent

model; the licenses are for specific people in a specific month.

The list of people can't shift around from hour to hour or day

to day (which would be de facto concurrent). I say this to you

so that you are not badly burned if you are audited (agreeing to

audits is part of the license agreement).

 

Technical considerations

 

Printer information is stored in each user's profile, and each

unique profile is only loaded once in memory (per TS). The

current default printer setting as well as tons of other user

specific data is stored in the profile.

 

Please stop and ponder this for a moment. If more than

one user is logged on at the same time using the same account

they are using the exact same profile. Meaning if one user

sets their default printer to "HP LaserJet" then the other user

or user(s) now have their default printer set to "HP LaserJet".

 

Each time a user logs on the default printer on the local

machine is set as the default in their TS session. In practice

this means that every time a user logs on or off the default

printer will change for all using that account.

 

A large number of applications (most?) are not designed to

handle per-user application settings that can be accessed/changed

by multiple concurrent sessions. For example, when the

applications save window position settings, user preferences,

etc., they assume a single user is making/using the change.

 

The other thing is for a scenario like yours a third-party

universal printer driver is a must. In addition to Thinprint I

recommend you also consider Print-IT and Screwdrivers.

 

Writing scripts to hide printers is not going to help you. How

can you hide a printer in this case? If you change the security

on the printer so that it is not visible to the user account then

by definition it will also not be visible to *all* the sessions under

the same account.

 

In similar situations where specific named accounts were not

desired I have created multiple generic user accounts for each

company. For example XYZ01, XYZ02, XYZ03, etc. Each

person is assigned to one of the generic logons. Each logon

is restricted to one session.

 

Thanks.

 

-TP

 

MBN wrote:

> Hi TP,

>

> Thanks for your reply, unfortunately using individual accounts is a

> problem as we provide a service to other companys to 'host' random

> bits of software. What happens is they come to us with a piece of

> software and they buy 30 users of hosting and we provide company XYZ

> with 30 concurrent logins and we do all the backups etc for that

> piece of software.

>

> Apart from confusing the users, its becoming a problem when printers

> arent being removed when people log out. Ive checked all the

> permissions on the registry and I run a printer delete script every

> night, its just that some people log in and out 15 times a day and

> end up with so many printers listed before the script cleans things

> up.

>

> We only install WHQL signed drivers, but it's becoming too

> complicated to manage and we are trying to move to a 3rd party

> solution such as ThinPrint.

>

> I guess that I need to find some way of hiding printers that dont

> belong to that session and to make/steal a script that runs when the

> user logs off that loops through all their printers and deletes them.

> Do you have any ideas that I could use please?

[Guest MBN]

Re: Multi-Session Printers?

 

Hi TP,

Thanks for the advise, I disappeared for a few days :)

The licensing is a concern in that when we first set things up we had a

local Gold MS reseller come over and all they said is that we just needed

the CALS so I might call MS AUS direct to clarify things.

 

All the problems with the profiles that you mentioned we dont seem to be

having any problems with as they dont have access to change those sorts of

things so at least something seems to be in my favour :)

 

thank you for all you help!

 

"TP" <tperson.knowspamn@mailandnews.com> wrote in message

news:uBhUM85JIHA.5684@TK2MSFTNGP06.phx.gbl...

> Hi Murray,

>

> Your current design is flawed and needs to be changed. I realize that may

> not be the answer you were expecting. Below is information to help you

> decide what changes to make.

>

> Licensing considerations

>

> There is no concurrent licensing for terminal services. If I understand

> your situation correctly, it falls under the Service Provider Licensing

> Agreement (SPLA). Under this there is only Per User (for TS) and it is

> calculated on a monthly basis. This means you need to have a TS

> Subscriber Access License (SAL) for each person that will use the TS

> during the month, *not* for each concurrent user.

>

> It is not a requirement of the agreement to have a one to one relationship

> between subscribers and user accounts, but it makes sense for compliance

> tracking and technical reasons.

>

> Again the main point of the above is that there is no concurrent model;

> the licenses are for specific people in a specific month. The list of

> people can't shift around from hour to hour or day to day (which would be

> de facto concurrent). I say this to you so that you are not badly burned

> if you are audited (agreeing to audits is part of the license agreement).

>

> Technical considerations

>

> Printer information is stored in each user's profile, and each unique

> profile is only loaded once in memory (per TS). The current default

> printer setting as well as tons of other user specific data is stored in

> the profile.

>

> Please stop and ponder this for a moment. If more than one user is logged

> on at the same time using the same account they are using the exact same

> profile. Meaning if one user sets their default printer to "HP LaserJet"

> then the other user or user(s) now have their default printer set to "HP

> LaserJet".

>

> Each time a user logs on the default printer on the local machine is set

> as the default in their TS session. In practice this means that every

> time a user logs on or off the default printer will change for all using

> that account.

>

> A large number of applications (most?) are not designed to handle per-user

> application settings that can be accessed/changed by multiple concurrent

> sessions. For example, when the applications save window position

> settings, user preferences, etc., they assume a single user is

> making/using the change.

>

> The other thing is for a scenario like yours a third-party universal

> printer driver is a must. In addition to Thinprint I recommend you also

> consider Print-IT and Screwdrivers.

>

> Writing scripts to hide printers is not going to help you. How can you

> hide a printer in this case? If you change the security on the printer so

> that it is not visible to the user account then by definition it will also

> not be visible to *all* the sessions under the same account.

>

> In similar situations where specific named accounts were not desired I

> have created multiple generic user accounts for each company. For example

> XYZ01, XYZ02, XYZ03, etc. Each person is assigned to one of the generic

> logons. Each logon is restricted to one session.

>

> Thanks.

>

> -TP

>

> MBN wrote:

>> Hi TP,

>>

>> Thanks for your reply, unfortunately using individual accounts is a

>> problem as we provide a service to other companys to 'host' random

>> bits of software. What happens is they come to us with a piece of

>> software and they buy 30 users of hosting and we provide company XYZ

>> with 30 concurrent logins and we do all the backups etc for that

>> piece of software. Apart from confusing the users, its becoming a problem

>> when printers

>> arent being removed when people log out. Ive checked all the

>> permissions on the registry and I run a printer delete script every

>> night, its just that some people log in and out 15 times a day and

>> end up with so many printers listed before the script cleans things

>> up. We only install WHQL signed drivers, but it's becoming too

>> complicated to manage and we are trying to move to a 3rd party

>> solution such as ThinPrint. I guess that I need to find some way of

>> hiding printers that dont

>> belong to that session and to make/steal a script that runs when the

>> user logs off that loops through all their printers and deletes them.

>> Do you have any ideas that I could use please?