Printer Redirection not working in Windows Server 2008 R2

[guest]

We have 10 Windows Terminal Server 2003 Enterprise Edition-R2 (X86). Printer redirection is perfectly working when all clients (Windows XP, Windows 7, Vista and Even Server 2003) are connected from MSTSC/WEB interface. User are able to take print without any problem.

Recently we installed 10 Windows Server 2008 R2-Terminal Servers and checked the functionality. All seems fine but the problem is with Printer Redirection. When XP (x86), Windows Server 2003 (x86) are connected, prnter redirection is not working. To resolve this issue we installed same driver in remote Server but still not happening. Even we migrated all drivers using Microsoft Printer Migration Tool, but still same issue.

If I try to redirect from Windows 7(x86 and x64), Windows XP (x64 with SP3) and Server 2008 it works perfectly. What may be issue? Can anyone help me to resolve this issue because we need to make them live soon


--------------------------------------------------------------------------------

[guest]

Quoted from Proposed As Answer byVladimir Stoyanov

we discovered that the Print spooler security descriptor was altered and thus preventing Terminal Services to read it's state. As a result TS decides that the spooler is not running and disables printer redirection. To work around this problem an ACL that was in the original security descriptor has to be added back. Unaltered SD for print spooler should look like this:

c:\>sc show spooler

D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)

the important ACL in this cases is the one for authenitcated user (AU), since TS runs as a network service it relies on this ACL to be present in order to successfully open the spooler service. Adding the ACL:

(A;;CCLCSWLOCRRC;;;AU)

back fixed the problem.


--------------------------------------------------------------------------------

[guest]

The command is sc sdshow spooler instead of sc show spooler. Here are the quoted from another post.


Yes that has resolved my problem with Printer redirection. Below is the sets I used to resolve the problem. Hopefully this might help other people

Thanks Vladimir for your help!

---------------------------------------------------------------------------------
Terminal server printer redirection not working.


Note: Before doing the steps below use RSOP to verify you do not have printer redirection disabled by GPO. Also check that it is not disabled in the RDP-TCP settings in Terminal server configuration manager.

Note: This will issue effect both methods of printer redirection (easyprint and standard redirection)

The issue: When you set the printer spooler service by group policy this can be cause the Print spooler service permissions to be incorrectly modified. By default when you set a service startup options in GPO the permissions default to

Administrators = Full

Interactive = Read
System = Full

When you run sc sdshow spooler in cmd (command prompt) you receive the following

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BAA;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLOCRRC;;;IU)

The Authenticated user - Read (A;;CCLCSWRPWPDTLOCRRC;;;AU) permissions is missing. This is required for printer redirection to work

To fix: Use GPO edit to configure the print spooler service

Add Authenticated users to the list with Read permissions

Wait for the GPO changes to replicate. Then run gpupdate /force on the server

Now run "sc sdshow spooler" you should receive the following

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

This is the correct security setting.

Restart the spooler service and log off the terminal server.

Log back on and the printers should be redirected

--------------------------------------------------------------------------------

[guest]

I may be looking at this sideways and could use some help.... PLEEEASE.

I have set up two MS Server 2008 STD server networks in the last two months with TS but let's stick to the one.

I see the redirected printers within the sessions and can select and initiate a print request, however I cannot get any output on my local printers.
The document will show up in the printer queue, spooling, printing,.. deleting. no output to the printer.
I connected the printer directly to the client (an XP OS w/sp3 and .NET3.5sp1), the RDC is set to allow printing and supported P&P devices on both ends, even the external num-keypad works just fine but no printer output. I updated .NET on the server to 3.5sp1 with no effect.

I saw where DOT4 USB printers won't work unles a fix is applied (a MS2003 fix) so I tried that on the XP client with no success... KB link http://support.microsoft.com/default.as ... -US;302361

I checked all the policy settings for terminal services as posted in the KB's one is for MS2008 R2 http://blogs.technet.com/askperf/archiv ... ction.aspx but it is essentially the same in MS2008 STD.

I tried the following printers; an HP4000TN, and an HP Color Laserjet 2550 which I hooked up via a USB cable. (this shows up as a DOT4_001 port in printer properties) Had a remote user try with an HP Laserjet 3390. I don't see any errors only warnings (print job in queue is deleted and then the printer is deleted and no longer available to users.. see below) the job runs through the queue as I stated above.

LOG
8- The jobs in the print queue for printer HP LaserJet 3390 Series PCL 6 (redirected 8) were deleted. No user action is required.
4- Printer HP LaserJet 3390 Series PCL 6 (redirected 8) will be deleted. No user action is required.
3- Printer HP LaserJet 3390 Series PCL 6 (redirected 8) was deleted, and users will no longer be able to print to this printer. No user action is required.
sc sdshow spooler reports: D:(A;;CCLCSWLORRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

I'm at a loss here... What simple item am i overlooking... any ideas?

[guest]

RDPNOGO, is your server also a domain controller? If yes, this is a known problem and workaround is available in this article:

http://support.microsoft.com/kb/968605

[guest]

I cannot thank you enough. I overlooked the fact that this is a DC and kept pounding the issue as if it was something wrong with easy print and print redirection.

Steps to correct the issue are in the link http://support.microsoft.com/kb/968605 but I'll give a brief synop;

Either log in as administrator or execute cmd as Administrator
type; cd\windows\system32\spool
type; Cacls.exe PRINTERS /e /g users:C

The response will be; processed dir: C:\Windows\System32\spool\PRINTERS

Reboot the machine and test print through TS to any printer you wish wether a direct connected or IP networked printer.


Now I can sleep again.

[guest]

I've been away for the past 6 weeks. There has been a lot of action on my original thread since I've left for holidays. I have tried everything mentioned here, and still cannot get this to work.

I have verified the permissions on the C:\Windows\System32\Spool\PRINTERS folder and they look fine:
PRINTERS CREATOR OWNER:(OI)(CI)(IO)(R,W,D,WDAC,WO,DC)
NT AUTHORITY\SYSTEM:(OI)(CI)(R,W,D,WDAC,WO,DC)
BUILTIN\Administrators:(OI)(CI)(R,W,D,WDAC,WO,DC)
BUILTIN\Users:(OI)(CI)(M)

I have looked into the ACL for the Print Spooler service. At first, this was not correct. We had a GPO that hat modified the ACL on this service. We've since modified it to inclued the Authenticated Users, but that made no difference. So then, we've tried removing the GPO setting all together, but still no go.

C:\>sc sdshow spooler
D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCR
RC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

I have been pulling my hair out on this all week, not to mention the weeks before I left on holidays!!! Any other Ideas?

[guest]

I'm just going to toss this out here, because I've just spent the last few hours trying to figure out why my brand new Terminal Server 2008 (not on a Domain Controller) refuses to redirect my printers and this is the best thread I've been able to find regarding this on my too-many-too-count searches.

It's my userid on the domain. I have yet to figure out why, but if I RDP or RemoteApp into my W2k8 TS from either my Vista client or from an XP client using my userid, I get no printers nor do I get any type of error message from either the client or the server.

However, if I use my test account from either XP or from Vista, it works. And it took me hours before I tried that little test, let me tell you.

My main account has admin priviledges on the clients and on some servers, but not on the TS 2008 server.

So right now, I'm at a loss as to why my main userid is preventing Easy Print from redirecting my printers, but I'm going to keep at it. To make things even more funny, if I Remote Desktop into an XP client from my Vista client, my printers are redirected.

Of course, the next test is to actually print. ;)

[guest]

I've struck this before where the User Properties in Active Directory Users and Computers had "Connect client printers at logon" unticked on the Environment tab. Applies to Local Users as well.

[guest]

Thank you so much! No idea how that got unchecked on my ID but that was it!

[guest]

Well, thank you all for your help. I've got it figured out. It turns out it was a combination of two thinngs. One: (and this was the real issue) was the problem with the permissions as explained by Vladimir. Two: this was just my stupidity, as Craig mentionned, my own user account had the "Connect Client Printers" unchecked.

Thank you so much Vladimir and Craig!!!

So now, I am attempting to print a document to one of the redirected printers, but it doesn't seem to be using the new "easy print" functionality (ie: the print dialog box is not my client's but the server's). Is there anything else I need to do to turn that feature on?

[guest]

This solved printing redirection for me.

The additional information is that TS printing worked successfully from installation in August 2008 until a WU download and forced restart sometime around 12 August 2009. It has taken a month to find this solution!

[It is a DC because the client only has one server W2008 X64. It was chosen for TS use before SBS2008 was announced / released.]

[guest]

I have a similar issue - Windows 2008 Server with XP clients. If you RDP to the 2008 Server as the local Administrator account, then the printers get redirected as you expect. Any other user, their is no redirection.

This server is not a domain controller and we have the Novell client installed. The "sc sdshow spooler" values look correct. The Group Policy settings (under Terminal Services) have been set.

So, printer redirect works for one user (Administrator which is a local account) and no one else - even though we are set as "administrators".

[guest]

For Domain accounts have you checked that a computer loopback group policy is not cancelling out the printer redirection options or printer redirection is not disabled in Active directory under the Environment tab for each user?

Possibly try running RSOP or gpresult to verify that the GPO setting is correct.

It appears to be something at the domain level if local accounts work.