PrintingConcepts | Windows Server 2003 in a Nutshell

PrintingConcepts

Printing terminology in Microsoft Windows can be confusing for users familiar with other operating-system platforms:

Printer: Not a printer in the usual sense, but instead a software interface on the client machine that manages the printing process. This is sometimes called a logical printer but is usually just referred to as a printer. A printer must first be created on a client machine for that machine to be able to print documents. Printers are also used to configure print devices by specifying things like print schedule, job priority, who to notify when the job is done, which paper tray to use, which print quality to use, and so on.
Print device: A piece of hardware that generates printed documents; in common parlance, this is called a printer.
Print server: The computer that is actually responsible for managing the print device. The print server receives print jobs from the client machines, formats them accordingly , and passes them to the print device to generate printed output. You need a print server in order for client computers to use a printer over the network.
Printer driver: Software installed on the print server that processes jobs received from client computers and turns them into a series of printer commands, which can be understood by the particular type of print device being used.
Print queue: Software utility used to view print jobs waiting to be printed by a particular print device.

Local Versus Network Printers

WS2003 supports the same two kinds of print devices that were supported by earlier versions of Microsoft Windows:

Local print device: A printer directly connected to the print server using a serial, parallel, USB, or other physical port on a print server.
Network-interface print device: A printer directly connected to the network using its own network card. The print server manages the print device but is not directly connected to it.

Windows Printing Terminology

Windows printing terminology can be confusing. A local print device is a print device that is connected directly to a print server, usually by a parallel cable. A local printer, however, is a software interface that is installed on a print server and can manage either a local or network interface print device.

In the same vein, a network print device is a print device that is connected directly to the network. A network printer, however, is a software interface that is installed on a client computer to enable it to send print jobs to the print server.

In other words, you need to create two printers able to print over the network:

First create a local printer on the print server to manage the print device (which may be either the local or network interface type). Make sure the local printer is shared so it can be seen by client machines on the network.
Now create a network printer on each client computer to which the user actually prints from the running application. The process of creating a network printer on the client makes a connection between the printer installed on the client computer and the printer installed on the print server.

When you add a printer and share it over a WS2003 domain-based network, the information about the printer is automatically published in Active Directory. Make sure you take the time to enter information into the Location and Comments fields when you run the Add Printer Wizard, since this information is also published in Active Directory and can be utilized when searching for specific printers on the network.

Network Printing Process

The basic process of printing over the network is:

The user clicks the Print button on an application or performs some other action to print a document.
The printer driver on the client computer creates a print job by rendering the document into a series of printer commands, and then it spools (temporarily stores) the job for printing. By default, on WS2003, the document is only partially rendered at this point, resulting in an enhanced metafile format (EMF) file. EMF is a kind of universal printer-command format. Typically, non-Windows clients fully render the document into a RAW file consisting of actual machine-specific printer commands. EMF can be disabled in WS2003 to use RAW instead, but EMF is preferred because a spooled EMF job typically occupies less disk space than a similar RAW one.
The client computer forms a connection with the appropriate print server using remote procedure calls (RPCs) and then forwards the job to the print server.
The print server receives the job and spools it for further processing and until a print device becomes available.
The print provider (software on the print server) finishes processing the job by converting it from EMF into RAW format (if necessary).
When a print device becomes available, the job is despooled to the appropriate print monitor (more software on the print server), which then forwards the rendered document to the print device, which finally turns it into a printed document.

Printer Permissions

To manage user access to printers attached to the local computer or connected to the network, you assign printer permissions. These permissions can also be used to specify who is allowed to manage printers and their documents. There are three levels of printer permissions:

Print: Assigns ordinary users permissions for connecting to printers, printing documents, and managing their own documents
Manage Documents: Delegates the job of managing all documents to users with limited administrative privileges
Manage Printers: Provides complete administrative control over all aspects of printers and the printing process

Table 4-43 gives more detail concerning the specific privileges conveyed by each of the previous three types of printer permissions. These permissions can be assigned to both users and groups, but assigning them to groups is preferred since it reduces the amount of administration needed. Note that printer permissions are effective only when the printer is shared for use over the network.

Table 4-43. Printer permissions

Printing task	Printer permission
	Print?	Manage Documents?	Manage Printers?
Connect to a printer	Yes	Yes	Yes
Print a document	Yes		Yes
Pause, resume, restartor cancel your own document	Yes	Yes	Yes
Manage job settings for all documents		Yes	Yes
Pause, resume, restart, or cancel any user's documents	--	Yes	Yes
Cancel all documents		Yes	Yes
Pause or resume a printer			Yes
Take a printer offline			Yes
Share a printer			Yes
Delete a printer			Yes
Modify the properties of a printer			Yes
Change the printer permissions			Yes

Default Printer Permissions

The printer permissions assigned by default to a newly created printer are shown in Table 4-44. In order to modify these permissions, you must either be the owner of the printer or have the Manage Printers permission.

Table 4-44. Default printer permissions

Group	Default printer permission
Administrators	Manage Printers
Print Operators	Manage Printers
Server Operators	Manage Printers
Creator Owner	Manage Documents
Everyone	Print

Advanced Printer Permissions

The three basic printer permissions described previously are actually comprised of combinations of six advanced printer permissions, as shown in Table 4-45. This is a bit confusing since three of these advanced permissions have the same names as the basic printer permissions. Advanced permissions can be applied either to:

This printer only
Documents only
This printer and documents

Advanced printer permissions can also be selectively modified to provide a group of users with special (custom) printer permissions, if desired. However, it is highly unlikely that you will need (or want) to do this.

Table 4-45. Advanced printer permissions

Advanced printer permissions	Basic printer permissions
	Print?	Manage Documents?	Manage Printers?
Print	Yes		Yes
Manage Printers			Yes
Manage Documents		Yes
Read Permissions	Yes	Yes	Yes
Change Permissions		Yes	Yes
Take Ownership		Yes	Yes

Planning Printer Permissions

Like access to any other shared resource, access to print devices is controlled by assigning permissions to groups and users. The best way of doing this is to:

Create a domain local group for a print device. Give the group a recognizable name such as HP5L Users (using the type or model of the device) or Barney Users (if you give your printers friendly names).
Assign the local group Print permission.
Put global groups into the local group to give users access to the printer.

Also, be sure to assign suitable permissions to Administrators or Print Operators so they can manage the device and its print queues.