2

...alternately, what permissions do I need to give someone so they can view (but not alter) the Additional Drivers on a network printer shared out from a Windows print Server? (Server 2008 R2, Server 2012, Server 2012 R2)

The problem is that we need to inventory all the printers we have on our print servers, and in particular, verify that that they have 32 and 64 bit drivers installed. Of course, to make life difficult, we don't want to allow the people doing the inventory to have permissions to manage the printers or install drivers.

So, what these inventory guys see is the Additional Drivers button greyed out:

enter image description here

And they need to see the Additional Drivers dialogue, only, without the ability to edit it.

enter image description here

We can, of course, view all the drivers installed on the print server through the Print Management snap-in, but that doesn't seem to have a way to match up the installed drivers to the printer(s) they're associated with. (Someone must have decided that feature would be too useful.)

I'm also open to a command line approach, but I couldn't find one that would list the additional driver associated with a given printer. Get-WMIObject -Class Win32_Printer -Computer [printserver name] Seemed promising at first, until I read the available properties/attributes for the class, which seem to include the driver name as the only available driver-related attribute.

The PowerShell cmdlets for Print Management also don't seem to do what I need, and are only available for Server 2012 R2 and Windows 8.1 anyway (sigh).

At the same time, I've seen it done where users had the ability to view the additional drivers on a printer without changing them, so I'm pretty sure it's possible... though, viewing the security tab and permissions options for a printer doesn't seem to shed any light on the matter.

enter image description here

Leaving me with the question of how to display that information as a limited user, or what permissions I need to assign in order to allow a user to view (but not alter) the printer's installed drivers.

2

The "Additional Drivers" list is built by querying the subkeys of HKLM\System\CurrentControlSet\Control\Print\Environments and pulling together matching names. There aren't "Additional Drivers" installed on a per-printer basis.

Posit that you have two printers, "Accounting Printer" and "Janitorial Printer" using the driver "Whiz Bang Jet PCL 8" for the x64 architecture. After you use the "Additional Driver" button to install an Itanium driver for the "Janitorial Printer" you'll find that the "Accounting Printer" also shows an Itanium architecture driver installed.

I'd inventory the printers and drivers on machines by just remotely dumping the printer-related registry to a central location and parsing it.

  • Oh. No idea why I thought Windows might sensibly group installed drivers with the printers they're assigned to, but that explains a fair bit. Thanks! – HopelessN00b Feb 18 '14 at 22:01
  • The driver is associated with the printer, but all the architectures for that driver are consider the "same" driver. Where that causes pain is when you have an alternative architecture driver that doesn't match the name of the other drivers letter-for-letter. (I've had to edit INF files to get them to match in the past.) – Evan Anderson Feb 18 '14 at 22:05
  • Gonna give you the check, because I did this (a little) and it would have worked, if I could be bothered to write the logic into my script. For the record though, my solution was to tell management to either get smarter, or do without... and unsurprisingly, they elected to do without. :) – HopelessN00b Feb 20 '14 at 5:01
2

These are the permissions for our printer operators (of which I am a member). We can view all printers, drivers, and add printers, but cannot add drivers. The rules changed in the new Server OSes and you must be a local server admin to install drivers. Weird, seeing as how MS is touting 'Role-Based Administration', but whatever.

enter image description here

Also, I use the Printer mmc snap in for management.

  • Still seems that I can't access the additional printers button without first going through the change sharing options, which requires elevation... Looks like it's a registry dump as EvanAnderson suggested. Grrrrr. – HopelessN00b Feb 18 '14 at 22:36
  • What about when you use the printer mmc? I believe you're using the 'Server 2K3 way', <insert outdated method joke here> – MDMoore313 Feb 19 '14 at 3:25
  • 1
    Nah, it's still greyed out from the MMC -> Print Management snap-in. I think I've wasted enough time on this. They're just going to have to give the guys proper admin rights, or do without the inventory. – HopelessN00b Feb 19 '14 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.