Setting Windows drivers for CUPS printer a.k.a Point'n'Print

Question

I have Samba 4.2.10 and CUPS 1.7.5 running on Debian 8. The server is domain member. In CUPS I have several printers, and I shared them with Samba. Printing test page from CUPS works fine, printing from Windows client via IPP and Samba works fine. I would like to set Point'n'Print - having Windows drivers shared in print$ share so Windows client can pick them up automagically when connecting to the printer.

I have stored the CUPS and Windows PS drivers to /usr/share/samba/drivers as stated in every tutorial I found and tried to export them by:

cupsaddsmb -U root -a -v

The command creates folders W32X86 and x64 within share print$, copies the driver files and then tries to associate the driver with printer using command:

rpcclient localhost -N -A /tmp/0141f574d8313 -c 'setdriver PV PV'

And that ends up with this error:

resolve_lmhosts: Attempting lmhosts lookup for name localhost<0x20> resolve_lmhosts: Attempting lmhosts lookup for name localhost<0x20> resolve_wins: WINS server resolution selected and no WINS servers listed. resolve_hosts: Attempting host lookup for name localhost<0x20> Connecting to ::1 at port 445 Doing spnego session setup (blob length=96) got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.3.6.1.4.1.311.2.2.10 got principal=not_defined_in_RFC4178@please_ignore GENSEC backend 'gssapi_spnego' registered GENSEC backend 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' registered GENSEC backend 'spnego' registered GENSEC backend 'schannel' registered GENSEC backend 'naclrpc_as_system' registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC backend 'ntlmssp' registered GENSEC backend 'ntlmssp_resume_ccache' registered GENSEC backend 'http_basic' registered GENSEC backend 'http_ntlm' registered GENSEC backend 'krb5' registered GENSEC backend 'fake_gssapi_krb5' registered Got challenge flags: Got NTLMSSP neg_flags=0x62898215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x62088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x62088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x62088215 SetPrinter call failed! result was WERR_ACCESS_DENIED

As mentioned here, the user under which this command is executed should have the SePrintOperatorPrivilege. Since I'm running this as root, I added the user to samba:

smbpasswd -a root

and add the desired privilege:

net rpc rights grant root SePrintOperatorPrivilege

And I checked the settings:

# net rpc rights list root SeMachineAccountPrivilege SeRemoteShutdownPrivilege SePrintOperatorPrivilege SeAddUsersPrivilege SeDiskOperatorPrivilege

Everything seems to be just fine. So lets associate the driver and printer once again, manually:

# rpcclient localhost -c 'setdriver PV PV' Registered MSG_REQ_POOL_USAGE Registered MSG_REQ_DMALLOC_MARK and LOG_CHANGED Enter root's password: Connecting to ::1 at port 445 Doing spnego session setup (blob length=96) got OID=1.2.840.48018.1.2.2 got OID=1.2.840.113554.1.2.2 got OID=1.3.6.1.4.1.311.2.2.10 got principal=not_defined_in_RFC4178@please_ignore GENSEC backend 'gssapi_spnego' registered GENSEC backend 'gssapi_krb5' registered GENSEC backend 'gssapi_krb5_sasl' registered GENSEC backend 'spnego' registered GENSEC backend 'schannel' registered GENSEC backend 'naclrpc_as_system' registered GENSEC backend 'sasl-EXTERNAL' registered GENSEC backend 'ntlmssp' registered GENSEC backend 'ntlmssp_resume_ccache' registered GENSEC backend 'http_basic' registered GENSEC backend 'http_ntlm' registered GENSEC backend 'krb5' registered GENSEC backend 'fake_gssapi_krb5' registered Got challenge flags: Got NTLMSSP neg_flags=0x62898215 NTLMSSP: Set final flags: Got NTLMSSP neg_flags=0x62088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x62088215 NTLMSSP Sign/Seal - Initialising with flags: Got NTLMSSP neg_flags=0x62088215 SetPrinter call failed! result was WERR_ACCESS_DENIED

Same problem and I'm running out of ideas. I can see the driver files in print$ share and I can see them via printmanagement.msc console on Windows client. In that management console I cannot do the association either. Upon saving the dialog I get "Printer settings could not be saved. Access denied.". Probably the same problem as above. But in this case I'm accessing this as domain user which doesn't have the SePrintOperatorPrivilege, so no blaming here:)

Solution

As usual, after couple of days scratching my head I post this question and then perform the last attempt to google some solution. And I found it.

My problem was with parameter use client drivers = yes in /etc/samba/smb.conf. This needs to be set to no or not set at all. I added this based on some tutorial I have found previously and left it there.

Anyway, here is excellent debugging walk-through for Point'n'Print: https://lists.samba.org/archive/samba/2013-November/176711.html

And this is the message that solved my problem: https://lists.samba.org/archive/samba/2013-November/176714.html

Side note: googling werr_access_denied site:samba.org helped...