Adding shared printer from 2012R2 Print Server: Access denied

Question

• Windows Server 2012R2 (x64)
  • Set "in" domain1
  • Enabled Print and Document Services role with Print Server and LPD Service services
  • Accessible with user account domain2\user
  • Shared printer (LPT1/Generic/Text) as Generic_for_test set to "Everyone: All"

• Security settings of \\server.domain1\print$ set to "Everyone: All"

• Sharing settings of C:\Windows\System32\spool\drivers set to "Everyone: All"

• Windows 7 Professional (x64)
  • Set "in" domain2
  • Logged in user account domain2\user
  • Connecting to the printer (via "Add Network printer" and pointing it to \\server.domain1\Generic_for_test results in this error:

Connection to printer failed

A policy on this computer prevents a connection to this printer queue.

I already tried:

• Group policies as advised on the internet

Computer configuration > Adminsitrative Templates > Printer >

• Prevent installation of printers that use kernelmode drivers > Deactivated
• Point-and-Print for packages - Allowed servers > Deactivated
• Point-and-Print restrictions > Deactivated

User configuration > Administrative Templates > Control Panel > Printer >

• Use only Point-and-Print for packages > Deactivated
• Point-and-Print restrictions > Deactivated

What else can I do / try to fix this?

Solution 1

After some more digging, it turns out that there is a whitelist of "approved print servers" that lists the server from wich each group is allowed to install printers from. The new server was not part of this list.

After adding it, it works fine.

Solution 2

1. Check the following GPO: Local Computer Policies\Administrative Templates\Printers\ Allow print spooler to accept client connections >> Enable

2. If the option 1 doesn't work, You may need to Configure the Load and unload device drivers policy setting. To do this, follow these steps:

Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.

In the navigation pane, right-click your domain name, and then click Properties.

Click the Group Policy tab, click the GPO that you want to modify, and then click Edit.

In Group Policy Object Editor, locate and then click the Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment folder.

Locate and then double-click Load and unload device drivers.

Click to select the Define these policy settings check box, and then click Add User or Group to add the Power Users domain group.

In the Add User or Group dialog box, click Browse to locate the Power Users domain group. Under Enter the object names to select, type Power Users (You can enter Everyone if you want Everyone to install printer drivers), and then click Check Names to resolve the group name. Click OK three times.

Solution 3

The issue is you have not set the permission to allow for access from domain2. The everyone group is a subset of the authenticated users group and only applies to account authenticated with that domain. You will need to add the domain2\everyone group or the domain2\user to have access to the printer.

Comments

[F.P]

Thanks for the input. Option 1 did not help. For option 2, I don't have a Group Policy tab in the Properties window you mention.