Remote Desktop Printing

[booman]

I have an interesting situation that I've tried to work-around and can't seem to figure it out.
We have users logging into our Terminal server from different locations. Mostly Finance employees. One of our Finance users needs to print to another printer in another city via Terminal services.
It works just fine, but I have to give them access to the remotely connected printer via security tab. I have to do this every time they want to print because the connection always shows up with a different session name.

Is there a way to keep the session the same every time the users connect?
Is there a way to give permanent permissions for one user over the printer setting of another user?

I've done everything but give them administrative access, because we don't want to do that...
I cannot give them local administrative access because this terminal server is also a domain controller.
Let me know if you have any ideas.

[noob]

What OS are you using?

Do you use generic usernames or does each person have their own?

The easy way would be to add every printer to the domain controller and use either local or group policy to map them for everyone as they log in.

A harder way would be to have a login script for each person by username or group membership.

[booman]

The terminal server is Windows Server 2003.
We are using unique user-names for all user account.

The reason we can't add the printers is because some locations are not part of our network. They remote in and the printer is inherited during the session, but has a different session name each time they log in.

We have login scripts that run for mapping network drives, so it wouldn't be so hard to modify it and add printers, but I still have the problem that this printer is not part of our network.

[noob]

So this would be a person from location A, logging into location B printing to location C
And location C isn't in your network?

If A --> B --> C then you need to manually map that printer as admin, then give that user(s) access to the printer. Again this can be done through group policy


If it is A --> B --> A then look at
Printer Redirection

If it is their default printer, you can then have it as the users default when they log in.
Then can be done through group policy


If this is a permissions thing not allowing remote printing, etc, you may need to relax that policy for the domain controller, by having it in it's own OU, and disabling inheritance. Then just allow those policies you want.

[booman]

I think the first solution might be the answer, but I'll need some help with it. How do I map a printer to a session that keeps changing?
Where do I start in group policy to do the mapping?
Is there a way to force the session from location C to always be the same session?

Thanks for your help, by the way!

[noob]

Can the terminal server contact the remote printer without that user being logged in?

If so manually install it as a local TCP printer on the terminal server - then it is constant and problem solved.

If not you may need to look at the terminal session with the printer to never be logged off.

Group policy locations:
User/Computer --> Windows Settings --> Scripts
User/Computer --> Administrative Templates --> Printers
User/Computer --> Administrative Templates --> Windows Components --> Terminal Services

If that printer is the default printer for the user when they log in, you can have that as the users default printer. Can you then give permissions not to a specific printer but to the default printer regardless of it's name? I'm assuming that it is a particular application causing this grief.

[booman]

Oh interesting, I didn't know you could keep a session always logged in.
What if we reboot the server? Will it retain the session?

I'll try that first and then set it as the default printer for location A.

Very cool! I'll report my findings

[booman]

ok, there are no Group Policies setup for printers or scripts.
So I will need to create a new group policy right?
I don't want to do it domain-wide, but just for this local terminal server.
Where do I start?

[noob]

If you reboot the server it will lose it.
You will need to make sure they don't log out but close the window.

Group Policy Scripts are done on the domain controller
Administrative tools --> Group Policy Management
Right click an OU where you want a new policy and select Create and Link a GPO here...
Choose a name and you will have a blank GPO
Right click it and select edit

This will enable to group policy for that OU only, if the terminal server is in its own OU with no OU's beneath, it wont effect anything else.

I have attached screenshots from a 2003 DC group policy with locations of some of the stuff around printing, etc.

Something else to do which will make it a whole lot easier for you in the long term.

1. install a pdf printer - I use cutepdf writer at work for this: CutePDF - Convert to PDF for free, Free PDF Utilities, Save PDF Forms, Edit PDF easily.
2. make that the default printer for the user and give that the required permissions - I assume it is for a particular application
3. allow client drives, meaning their own drives are available to save stuff to
4. they can then print from their local drive to any printer they have access to.


EDIT:
Unfortunately you can't stop the session ID from changing, that has been something I have looked into myself

[booman]

I see what you are saying. As long as locaion C doesn't log off the terminal server, their session is always running.
So location A can print to it anytime.

I have added scripts to an OU in Group Policy before, I was wondering what the script is for this particular problem.

I have looked into the Session and Terminal options for this user, but nothing that forces the session to stay open.
So you are right, as long as they log off or the server restarts, the session will always be different.

Oh, and I already have CutePDF installed on that server. So they know printing to PDF is available.
This is for finance people and they use a special Micr Cartridge in their printers, but I don't see why printing from PDF would make any difference.

Thanks for your help

[noob]

The script for this particular problem, that is the one controlling the mechanical fist of doom to wipe out the troublesome users. Wasn't sure how much you had done, better safe than confused.

Not sure of the policy at your place, we have a default of 5min for a disconnected session before the user is forcibly logged out.

A secure remote app with a secure differently remote printer has given IT staff world wide severe issues especially as no one seems to understand that it just doesn't work the magic way they want it to.

[booman]

Thats kinda what I figured too...
Our terminal server has the typical time-out settings. I checked those and nothing about permanent session configuration.
So, I contacted location C and asked them to not log off.
The session should stay connected as long as the server is up and they don't log off.
Then I'll have location A try to print and see what happens.
Thanks for your help.... this seems to be a unique problem.

[techjunkie45]

What interested me was the remote printing control. How do you achieve this? I am a student and would love to know more about using hardware in networks. Do you do this using manual networks or wireless ones?

[booman]

At my work all the printers are "wired"
But more and more printers are including a "wireless" connection so you can print from anywhere in the house while on your laptop.

The remote printing is cool because you can log into your computer at home with Remote Desktop and then print to your current location (office, coffee shop, library, friends house)