- A Windows Server 2003 machine acting as a file server and domain controller. Call this "Server 1".
- Another Windows Server 2003 machine acting as a terminal server, file server and DNS server. Call this one "Server 2". People often log in to this machine via RDP to use a certain piece of software.
- An old Windows XP SP3 machine with a USB printer attached and shared. This machine has its own local accounts, it does not validate logons against the domain controller. It is a member of the domain, though. Call this "PC 1".
(I have inherited this setup and am temporarily administering it. I am not particularly knowledgeable about administration of Windows servers, so forgive me if I've omitted valuable details.)
I want users to be able to print from the printer on PC 1 while working on Server 2, even if PC 1 is in use. I can add the shared printer to Server 2 as the administrator, but the user themselves cannot add the printer. When I try (logged in as them) to add it, I see "You do not have sufficient access to your computer to connect to the selected printer".
I followed the instructions in this KB article ie. disabled the "Prevent users from installing printer drivers" property in Local Security Settings, rebooted, and got the same message. I tried adding the user to Local Security Settings > Load and unload device drivers, rebooted, still can't add it. I added the user to the (local) Power Users group, rebooted, still can't add it.
Finally I added the user to the Administrators group, rebooted, and I could add the printer to their account — success! But then, when I removed them from the Administrators group and rebooted, the printer was... gone.
So what do I try next?