Copyright: Print Security Help copyright (c) Microsoft Corporation 1995-1996


Understanding Print Security

Printers on a computer running Windows NT Server or Windows NT Workstation can be protected with special security attributes. When you install Windows NT Server Tools on a computer running Windows 95, you can view these security attributes over the network and change them.

You can also use Server Manager to administer printers on a computer running Windows NT. Use Server Manager to see who is using which shared printers, to disconnect users from shared printers, to set "share permissions" on all shared printers (as opposed to permissions on the printers themselves) by setting the properties of the "print$" resource, and to perform other tasks.

To return to Contents for Print Security Help, click Contents.

Important

To use any of the Windows NT Server Tools, you must have administrative privileges at the computer you choose to administer.

 Related Topics


Accessing Print Security Properties

To edit security properties of a printer

1	Log on as a member of the Administrators, Server Operators, or Power Users group for the computer or domain you want to administer

2	Click Start, point to Programs, and click Windows Explorer.

3	In the left pane, double-click Network Neighborhood. In the right pane, double-click the name of the computer you want to administer, and then click the objects you want to administer.

4	On the toolbar, click Properties.

5	In the Properties dialog box, click the Security tab. and then click Permissions, Auditing, or Ownership to see the options related to these issues that you can set.

Notes and Tips

The printer you want to administer must be on a computer running Windows NT Server or Windows NT Workstation.

The following methods for selecting an object to administer do NOT work:

Administering print queues through the Printers list in My Computer. These print-queue objects represent print queues local to your Windows 95 computer, even if the queue is redirected to a Windows NT Server or Windows NT Workstation print queue.

Using the Windows 3.x Print Manager. It no longer exists in Windows 95; the Printers icon in the Main group of Program Manager is just a shortcut to the Printers list in My Computer.

Using File Manager (WINFILE.EXE) in Program Manager. Installing Windows NT Server Tools does not add a Security menu to File Manager as it did for Windows 3.x.

 Related Topics


Setting Printer Permissions

To change printer permissions

1	Click Start, point to Programs, and click Windows Explorer.

2	Click the printer you want to administer.

You can select multiple printers.

3	Click Properties on the toolbar, and then click the Security tab of the Properties dialog box.

4	Click Permissions.

5	Enter the name of a group or user, and click a permission on Type of Access.

Notes

Permissions are cumulative except that the No Access permission overrides all other permissions. For example, if a user is a member of a group with Print permission and a member of a group with Manage Documents permission, the user will have Manage Documents permission.

By default, Print permission allows a user to control the printing of his or her own documents.

In a Windows NT Workstation or Windows NT Server print queue, the creator of the document at the printer can control the document through permissions granted to the Creator Owner. In general, you should not change the permissions granted to the Creator Owner or remove the Creator Owner from the permissions list.

To change permissions on a printer, you must be the owner of the printer, or have been granted Full Control permission.

 Related Topics


Printer Access Permissions

You can set the following permissions on printers:

 No Access (None)

 Print

 Manage Documents

 Full Control


Auditing a Printer

To audit a printer

1	Click Start, point to Programs, and click Windows Explorer.

2	Click the printers you want to audit.

3	Click Properties, and then click the Security tab.

4	Click Auditing.

5	Click the name of a group or user, and then click the events to audit for that group or user.

To remove print auditing

Select the name of the group or user in the Printer Auditing dialog box, and then click Remove.

Notes

Auditing a printer allows you to track its usage. Depending on your printer, you can specify which groups or users and which actions to audit. You can audit both successful and failed actions. Windows NT stores the information generated from auditing in a file. which you can view in Event Viewer.

To audit printers, you must be logged on as a member of the Administrators group. You must set the audit policy to audit file and object access. Set the audit policy using User Manager.

 Related Topics


Audited Printer Events

You can audit any of the following printer activities:

Print

Audits printing of documents.

Full Control

Audits changing job settings for documents; pausing, restarting, moving, and deleting documents; sharing a printer; and changing printer properties.

Delete

Audits removing a printer.

Change Permissions

Audits changing printer permissions.

Take Ownership

Audits changing printer ownership.

Note

Take Ownership auditing is not available for administering OS/2 and LAN Manager-based print queues.


Adding Users and Groups to Permissions and Auditing Lists

To add a user or group to a permissions or auditing list

1	In either the Printer Permissions or the Printer Auditing dialog box, click Add.

2	In the Add Users And Groups dialog box, you can:

Click Show Users to display the names of users on the selected computer or domain.

Click a group, and click Members to see the names included in the group.

Users are listed in a new dialog box.

Click Search to find the domain of a group or user on a network running Windows NT Server. If the account of the group or user is not located on the computer or domain shown in List Names From, you must specify the location.

3	Select the groups or users you want to add to the list, and click Add.

4	To add users or groups to a permissions list, click the permission in Type of Access.

Notes and Tips

The Add Users And Groups dialog box displays the computer or domain groups in List Names From. Local groups are shown for the computer or domain whose name is followed by an asterisk (*). You can select another domain by in List Names From.

Domains appear only if your computer is a member of a domain on a Windows NT Server network. The domains shown have a trust relationship.

On a network running Windows NT Server, global groups that are members of a local group appear in the list of members. To see the users in a global group, select the group and click Members. To include the group in the Add Users And Groups dialog box, click Add. To include only some of the members, select them and click Add.


Taking Ownership of a Printer

To take ownership of a printer

1	In Windows Explorer, click the printer.

2	In the toolbar, click Properties, and then click the Security tab.

3	Click Ownership.

4	Click Take Ownership.

Notes

When you create a printer queue (by sharing a printer), you become the owner of it. Only members of the Administrators group and any users to whom the owner grants permission can take ownership of the printer.

An administrator cannot transfer ownership to others. For example, only an administrator who takes ownership and changes permissions can gain access to a printer on which you have set No Access permission. By checking the ownership of the printer, you can see any changes and know who violates the permission you set on the printer.

The owner of a printer can always change the permissions set on the printer. If you have Full Control permission for a printer, you can take ownership of it.


Printer Permissions

Sets or changes permission for groups and users.

Click the following buttons for specific information about this dialog box:

 Printer

 Owner

 Name

 Type of Access

 Add Button

 Remove Button

 Related Topics


Add Users and Groups

Adds a group or user to the permission list for a printer.

Click the following buttons for specific information about this dialog box:

 List Names From

 Names

 Add Button

 Show Users Button

 Members Button

 Search Button

 Add Names

 Type of Access

 Related Topics


Local Group Membership

Displays the members of the local group selected in the Add Users And Groups dialog box.

To include the group in Add Names in the Add Users And Groups dialog box, click Add.

To include some of the listed members in Add Names in the Add Users And Groups dialog box, select them and then click Add.

To see members of a selected global group, click Members.

Note

On a network running Windows NT Server, global groups that are members of a local group appear in the list.

 Related Topics


Global Group Membership

Displays the members of the global group selected in the Add Users And Groups dialog box or in the Local Group Membership dialog box. To change the listing, you can do the following:

To include the group in Add Names in the Add Users And Groups dialog box, click Add.

To include some of the listed members in Add Names in the Add Users And Groups dialog box, select them and then click Add.

 Related Topics


Find Account

Locates the domain of an account on a Windows NT Server network.

When you add a user or group to the permissions or audit list, you must know the name of the domain that contains the user's or group's account.

Click one of the following buttons for information about the dialog box:

 Find User Or Group

 Search All

 Search Only In

 Search Button

 Add Button

 Related Topics


Owner

Displays the owner of the selected printer.

To take ownership of the printer, click Take Ownership.

 Related Topics


Printer Auditing

Audits the use of a printer by groups and users.

Click the following buttons for specific information about this dialog box:

 Printer

 Name

 Events to Audit

 Add Button

 Remove Button

 Related Topics


Add Users and Groups

Adds a group or user to the auditing list for a printer.

Click one of the following buttons for information about the dialog box:

 List Names From

 Names

 Add Button

 Show Users Button

 Members Button

 Search Button

 Add Names

 Related Topics


Select Computer

Selects a remote computer where you can create, delete, or administer a printer. Once you select a computer, Print Manager displays a server window, which shows the printers on the server.

Important

To connect to a computer, you must be logged on as a member of the Administrators, Server Operators, Print Operators, or Power Users group. To administer a printer, you must belong to one of these groups and have Full Control permission for the printer.

Click the following buttons for specific information about this dialog box.

 Computer

 Select Computer


Printer Name

Displays the name of the selected printer.


Driver

Displays the name of the printer driver. To make changes, you can do the following:

To change the driver, click the driver name.

To install a new or unlisted driver, click Other ( the final option on the list).


Description

Displays the description of the printer.

To change the description, edit the existing text.


Print to

Displays the destination for printing output. To make changes, you can do the following:

To change the print destination, click another destination.

To add a port or other destination, click Other.


Share this Printer on the Network

Shares the selected printer.

To share the printer, select the Share This Printer On The Network check box.

By default, Print Manager creates a share name compatible with MS-DOS-based computers. You can edit the share name.

Note

Use Location to include a description of the printer location.

Users see the location information when connecting to the printer.


Setup Button

Used to configure printer features, such as form-to-tray assignment and memory.


Details Button

Used to specify printer options (such as printer availability and priority) and document settings (such as orientation and paper size).


Settings Button

Used to specify settings for the port selected in Print To.


Printer Name

Sets the title of the printer window. If a printer is shared, network users running Windows NT see the name when they connect to it.

Type a name up to 32 characters long in Printer Name.


Driver

Specifies a driver for the printer.

To install a printer driver, click it in Driver.


Description

Used optionally to inform network users about the printer.

To add a description, type it in Description.


Print to

Specifies the destination for printer output. To set the destination, you can do the following:

To specify the print destination, click it on the list.

To specify a destination that is not listed, such as an additional port, click Other.


Share this Printer on the Network

Shares the selected printer.

By default, Print Manager creates a share name compatible with MS-DOS-based computers. You can edit the share name.

Use the Location box to include a description of the printer location. Users see the location information when connecting to the printer.


Setup Button

Used to configure printer features, such as form-to-tray assignment, memory, and fonts. The Printer Setup dialog box appears after you click OK in the Create Printer dialog box.

Setup is not available until a driver for the printer is installed.


Details Button

Used to specify printer options, such as printer availability and priority.


Settings Button

Used to specify settings for the port selected in Print To.


Available From/To

Used to set the hours during which the printer prints documents.

Enter a starting time in Available From and an ending time in To.


Separator File

Used to specify the file that is sent to the printer before printing each document. The Windows NT default file, SYSPRINT.SEP, prints a page before each document.

To specify a separator file, enter the path and filename in Separator.


Print to Additional Ports

Used to group several printers into a pool. The first available printer prints documents sent to the pool.

To create a printer pool, select the ports that correspond to ports connected to printers.

Tip

Click Delete to remove a port from the list.


Priority

Used to set the priority of the printer.

All documents on a higher-priority printer print before documents on a lower-priority printer, regardless of the individual document priorities.

To change a printer priority, enter a number from 1(lowest) to 99 (highest).


Print Processor

In general, you do not need to change the print processor. However, some specialized applications may require a different print processor.

To change the print processor, click a different print processor.


Default Datatype

In general, you do not need to change the data type. However, some specialized applications may require a different data type.

To restrict a printer queue exclusively to text files, you can click Text, which applies only to applications that print straight type (such as most older DOS applications) and will eject the last page of text print jobs.

To change this setting, click a data type in Default Datatype.


Print Directly to Ports

Used to print directly to the printer and bypass document spooling.

Print directly to ports is not available when a printer is shared.


Job Defaults Button

Used to display the Document Properties dialog box, where you can specify default settings for documents, such as print orientation and number of copies.


Printer

Displays the name of the selected printer.


Name

Displays the names of groups, users, and their current permissions.

To change a permission, click the group or user, and then click a permission in Type of Access.


Owner

Displays the name of the owner of the printer.


Type of Access

Displays a list of available permissions.

To change a permission, click the group or user in Name, and then click a permission.


Add Button

Used to add groups or users to the permission list.


Remove Button

Used to remove the selected groups or users from the permission.


List Names From

Displays the name of the domain or computer corresponding to the groups shown in Name.

To display groups and users in another domain or on another computer, click another domain or computer.


Names

Displays the groups or users belonging to the domain or computer shown in List Names From.

To add groups and users to the permissions list, click them in Names, and click Add.


Add Button

Used to add the selected groups or users to the permissions list.


Show Users Button

Used to display the users belonging to the domain or computer shown in Name.


Members Button

Displays the members of a selected group.


Search Button

Finds the domain to which a group or user belongs.


Add Names

Displays the names of groups and users you want to add to the permissions list.

To add groups or users to the Add Names box, click them in Names, and then click Add.


Type of Access

Displays a list of available permissions.

To set a permission for the groups and users listed in Add Names, click a permission, and click OK.


Printer

Displays the name of the selected printer.


Name

Displays the names of currently audited groups and users.


Events to Audit

Used to audit events that succeed and those that fail for the selected printer.

Click a group or user, and then select check boxes for the printer events you want to audit.


Add Button

Adds groups or users to the auditing list.


Remove Button

Removes selected groups or users from the auditing list.


List Names From

Displays the name of the domain or computer corresponding to the groups shown in Name.

To display groups and users in another domain or computer, click that domain or computer.


Names

Displays the groups or users belonging to the domain or computer shown in List Names From.

To add groups and users to the auditing list, click them in Names, and then click Add.


Add Button

Adds selected groups or users to the audit list.


Show Users Button

Displays the names of users belonging to the domain or computer shown in Names.


Members Button

Displays the member list for the selected group.


Search Button

Finds the domain to which a group or user belongs.


Add Names

Displays the names of groups and users you select to add to the audit list.

To add groups or users to Add Names, click them in Names, and then click Add.


Find User or Group

Used to enter the user or group name that you want to find.


Search All

Used to search for the account in all the listed domains.


Search Only In

Used to restrict a search for an account to selected domains.


Search Button

Used to start the search after you specify the group or user and the domains.


Add Button

Adds a user or group found in Search Result to Add Names in the Add Users And Groups dialog box.


Network Path

Displays the name of the computer and shared printer to which you want to connect.

Enter a printer in Network Path.

Tip

If you type to enter a name, type two backslashes (\\) in front of the computer name and type a single backslash (\) in front of the printer name. For example:

\\setter\shipping.


Shared Printers

Displays the names of networks, shared printers, and domains or workgroups in a tree structure. You can adjust the display in the following ways:

To see the domains and workgroups on a network, double-click a network name.

To see the shared printers on a domain or workgroup, double-click the domain or workgroup name.

To see Printer Information for a printer, click the printer on the expanded list.


Expand By Default

To switch off automatic expansion of Shared Printers, click to clear the Expand By Default check box.

By default, printers in your computer domain or workgroup are displayed automatically in Shared Printers.


Printer Information

Displays information about the selected printer, including its description, status, and the number of documents waiting to be printed.


Path

Displays the name of the LAN Manager 2.x print share for which you want to create a printer.

Enter the path of the print share in Path.


Shared Printers

Displays the names of networks, print servers, shared printers, and domains or workgroups in a tree structure. You can change the display in the following ways:

To expand the list, double-click an item.

For example, double-click a network name to display domains or workgroups.

To display a print share in Path, click the print share on the expanded list.


Expand by Default

Automatically displays printers and LAN Manager 2.x print servers in your computer domain or workgroup.

To switch off automatic expansion of Shared Printers, click to clear the Expand By Default check box.


Printer

Automatically displays the name of the printer to which you are connecting. This name sets the title of the printer window and of the icon in Print Manager.

To change the printer name, edit the name in Printer.


Driver

Specifies a driver for the printer to which you are connecting.

To install a printer driver, click it in Driver.


Print To

Displays the name of the printer to which you are connecting.


Notify

Automatically notifies the owner of a document when it is printed.

To change who is notified, type the user name to be notified.


Priority

By default, all documents sent to a printer have the same priority. High priority documents print before documents of lower priority.

To change a printer priority, enter a number from 1 (lowest) to 99 (highest).


Start and Until Time

Used to set a time period for printing a document. The time period must be within the hours set for printer availability.

To set a printing period, enter a Start Time and an Until Time.


Computer

Displays the name of the computer with the printers you want to administer.

To select a computer, enter the computer name in Select Computer, and click OK.


Select Computer

Displays the names of computers and the domains and workgroups for them.

Tip

To see a list of computers on a domain or workgroup, double-click the domain or workgroup name.


Forms on this Computer

Displays the forms available on the computer. Most printers support the default set of forms, which cannot be deleted.


Form Description

Displays the name, paper size, and print-area size for the selected form.

To add a form, enter a name for the form in Name, and enter the appropriate measurements in Paper size and Print Area Margins; then click Add.


Units

Click Metric to display size and margin information in centimeters.

Click English to display size and margin information in inches.


Add Button

To add a form

1	Enter a name for the form in Name

2	Enter the appropriate measurements for the form in Paper size and Print Area Margins.

3	Click Add.


Delete Button

Deletes forms you created. You cannot delete the default forms.

To delete a form, click the form in Forms On This Computer, and then click Delete.


Full Control

Allows:

Printing documents.

Changing print settings for documents.

Pausing, resuming, restarting, and deleting documents.

Changing the order in which documents print.

Pausing, resuming, purging the printer.

Changing printer properties.

Deleting the printer.

Changing printer permissions.


Manage Documents

Allows:

Changing print settings for documents.

Pausing, resuming, restarting, and deleting documents.

Note

This access type is not available when administering an OS/2 and LAN Manager-based print queue.


Print

Allows document printing.


No Access

Prevents any access to the printer.


Add LPR Compatible Printer

Used to add a TCP/IP printer that is connected through a UNIX computer or that is connected directly to the network through either a built-in network-adapter card or a serial/parallel ethernet print server.

Click the following buttons for specific information about this dialog box.

 Name Or Address Of Host Providing LPD

 Name Of Printer On That Machine

Note

To function properly, any JetDirect cards must support LPD.


Name Or Address Of Host Providing LPD

Specifies the unique IP identifier of the host connected to the printer.

To specify the host identifier, enter a DNS name or IP address.

Note

A direct-connect printer has its own IP identifier. For a printer connected to a UNIX computer, use the IP identifier for the computer.


Name Of Printer On That Machine

Specifies the printer name as it is identified on the host, which is either the direct-connect printer itself or the UNIX computer.

To specify the printer, enter its name.

For example, you might have a UNIX computer running the print-server component (lpd) with which the TCP/IP printer you create will interact. If lpd recognizes the printer attached to the UNIX computer by the name Crisp, the name you should type in this box is Crisp.


Printer Permissions

Used to set permissions for groups and users on an OS/2 and LAN Manager-based print queue.

Click the following buttons for specific information about this dialog box:

 Printer

 Name

 Type of Access

 Add Button

 Remove Button

 Related Topics


Printer

Displays the name of the selected printer.


Name

Displays the names of groups and users and their current permissions.

To change a permission, click the group or user, and then click the permission in Type of Access.


Type of Access

Displays a list of available permissions.

To change a permission, click the group or user in Name, and then click a permission.


Add Button

Used to add groups or users to the permission list.


Remove Button

Removes a selected group or user from the permission list.


Add

Adds a group or user to the permission list for a printer.

Click the following buttons for specific information about this dialog box:

 Names

 Add Button

 Show Users Button

 Members Button

 Search Button

 Add Names

 Type of Access

 Related Topics


List Names From

Displays the name of the domain or computer corresponding to the groups shown in Name.

To display groups and users in another domain or computer, click that domain or computer.


Names

Displays the groups or users belonging to the domain or computer selected in Printer.

To add groups and users to the permissions list, click them in Names, and then click Add.


Add Button

Adds selected groups or users to the permissions list.


Show Users Button

Displays the names of users belonging to the domain or computer selected in Name.


Members Button

Displays the members of the group selected in Names.


Search Button

Used to find the domain to which a selected group or user belongs.


Add Names

Displays the names of groups and users you select to be added to the permissions list.

To add groups or users to Add Names, click them in Names, and then click Add.


Type of Access

Displays a list of available permissions.

To set a permission for the groups and users in Add Names, click a permission, and then click OK.


Printer Auditing

Audits the use of a printer by groups and users on a OS2/LANMAN-based print queue.

Click the following buttons for specific information about this dialog box:

 Printer

 Events to Audit

 Related Topics


Printer

Displays the name of the selected printer.


Events to Audit

Used to audit the events that succeed and those that fail for the selected printer.

Click a group or user, and then select check boxes for the printer events you want to audit.


Click Help Topics for a list of Help topics.