Shared Printer requires Domain Admin permissions

PDFCreator PDFCreator English
1

Hi There,

I have been using PDF Creator for ages (years) with out any problems.  Today I found that one of my users can't print to the shared printer.  The printer is set to save a file in a fixed location. This configuration has not changed.

Currently if the user prints the job sits in the print queue with the status of "Printing" it will sit there indefinitely. If I put the user in the Domain Admins group the job is successful.

There is no difference in the log file between a successful print and a unsuccessful one.

The server is running SBS 2011. 

I upgraded PDF Creator from 1.7.1 to 1.7.2 but this didn't make any difference.

The printer is running on the server as a Service using SRVany.exe and has been for ages.

I have checked the permissions on the shared printer and they all look good.

I have checked the permissions on the folder where the print job is saved and that looks good.

The event logs don't show any messages.

Has anyone seen this before?  I'm at a loss now.

Thanks in Advance

David

 

2

Hi,


I am afraid I don’t know any direct answer to this. You can enable logging for the pdfcmon.dll for advanced troubleshooting.
To enable logging, add the following DWORD value to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\pdfcmon in your registry: Name : Logging, Value :1. This will cause PDFCreator to create an advanced logfile at %Windir%\Temp\_pdfcmonLog.txt.
Maybe there is a visible clue in there.

regards,

Robin
3

Hi Robin,

Thanks for the reply.  I'll give this a try and post again with log details or maybe even a solution :)

David

4

Hi Robin,

The log pointed me straight to the problem.

There is an access denied message pointing to this folder c:\\windows\\temp\\pdfcreator\\spool\\

When I look at the permissions on that folder I have the usual System and Administrators entries but the third one is an unlinked ID.

S-1-5-5-0-6289.....

So I'm guessing this user or group was corrupted somehow.

I granted write permissions to "Domain Users" and tested again.

It worked first go. 

I set the advanced debug level back to 0.

Thanks so much for your help.

I have marked your suggestion as Accepted.

David

 

 

5

Glad it worked,

thank you for the feedback.

regards,

Robin

6

Hi Robin,

Strangely this problem returned. When I look back in the security permissions for the c:\windows\temp\pdfcreator\spool\ folder my domain users group is gone and the unlinked id is back S-1-5-5-0-6289…

The server is SBS 2011 so I’m assuming something is “protecting” me from changing permissions on this folder.

Is there a way I can change the default location of the spool folder to something away from the system drive?

Thanks in advance

David.

7

Hi,


the only way to change the spool folder is by changing the users environment variables which will change the entire temp path though.

best regards, 
8

Hi Robin,

It seems strange to use a local users TEMP environment variable which normally refers to a folder on the users workstation to select a location to store a file on the server.  It seems almost destined to fail.
My XP user has TEMP set to C:\windows\temp
The service that runs my srvany pdfCreator print queue is run under the Administrator’s account
It has a variable set to TEMP=C:\Users\Administrator.DOMAIN\AppData\Local\Temp\2

If XP was installed to E:\Windows this would simply fail.
I would expect that a regular user would not have access to C:\Windows\Temp on the server.

This seems like a prime candidate for a future enhancement.
I’ll fudge something up now to make it work.
Thanks for your assistance.
David
9

Hi,


sorry I meant the system environment tmp and temp variables, for a moment I didn’t have in mind it is all on a server. This hasn’t been tested but should work. Otherwise it would be great if you could monitor the spool folder permissions to see how and why they change, we haven’t been able to reproduce this problem here. All I know so far is it can also happen in desktop environments.

best regards
10

Hi Robin,

In my message above I said “Local Users TEMP” when I should have said “Local System TEMP”
However the rest of my statement holds true.
When the user prints to a network PDFCreator printer it uses the TEMP environment variable from the workstation as the spool folder on the server. Not the TEMP environment variable from the Server as you would expect.
If the user has write permission on the server the folder is used or created.
I can force this to work by modifying the Local System Temp Variable on the workstation to say C:\Temp and creating the same folder on the Server but it doesn’t make a lot of sense to do it this way.

Thanks

David