Lesson 2: Using Print Permissions

As a DST, you must know how to control access to printers by using permissions. Print permissions allow you to control which users can access a printer and which actions the users can perform. Each printer has a discretionary access control list (DACL) that is associated with it that is similar to the DACL that is attached to files and folders that you learned about in Chapter 5, “Supporting Windows XP File and Folder Access.” A user or group must be listed in the DACL to use the printer.

After this lesson, you will be able to

• Identify basic and advanced print permissions.

• Identify default print permission assignments.

• Calculate effective print permissions.

Estimated lesson time: 15 minutes

Understanding Print Permissions

Although you can assign print permissions to printers in Windows XP Professional, Windows XP Home Edition does not support print permissions. In Windows XP Professional, there is only one set of permissions that apply to printers, and these permissions are in effect when a printer is accessed both locally and remotely. This is unlike file system permissions, where there are potentially two types of permissions at work: share permissions and NTFS permissions.

You can access print permissions on the Security tab of a printer’s Properties dialog box, as shown in Figure 9-17.

Figure 9-17: Assign print permissions using the Security tab of a printer’s Properties dialog box.

Exam Tip

Only Windows XP Professional supports assigning permissions to printers. You cannot assign print permissions in Windows XP Home Edition.

Basic Print Permissions

For each user account or group, you can assign the following three basic print permissions:

• Print Allows users or groups to connect to a printer, print documents, and manage their own documents in the print queue. Managing a document includes the ability to pause, resume, restart, and cancel the document.

• Manage Documents Allows users or groups to connect to the printer, manage all documents in the print queue, and control print settings for all documents. This permission does not include the ability to print documents.

• Manage Printers Allows users or groups to perform all the tasks included in the Print and Manage Documents permissions. In addition, the user can pause and resume the printer, take the printer offline, share the printer, change printer properties, delete a printer, and change print permissions.

You add, edit, and remove print permissions in much the same manner as you would for NTFS permissions on files and folders. To add basic print permission assignments, follow these steps:

1. On the Security tab of a printer’s Properties dialog box, click Add.

2. In the Select Users Or Groups dialog box, enter the user accounts or groups that you want to assign permissions to, and then click OK. Use the Advanced button to search for user accounts and groups if you do not know the exact names.

3. On the Security tab, Windows assigns the Print permission to newly added accounts by default. Modify the permissions as necessary and click Apply.

Advanced Print Permissions

You can provide most printer security requirements by using basic permissions, but sometimes you might need to use advanced permissions. Advanced print permissions include Read Permissions, Change Permissions, and Take Ownership.

To add advanced permission assignments, follow these steps:

1. On the Security tab of the printer’s Properties dialog box, click Advanced.

2. In the Advanced Security Settings dialog box shown in Figure 9-18, click Add.

   
   Figure 9-18: Configure advanced printer permissions in the Advanced Security Settings dialog box.

3. In the Select Users Or Groups dialog box, select the user accounts or groups that you want to assign permissions to, and then click OK. Use the Advanced button to search for user accounts and groups if you do not know the exact names.

4. In the Permission Entry dialog box shown in Figure 9-19, modify the permissions as necessary and click OK.

   
   Figure 9-19: Modify the permissions in the Permission Entry dialog box.

5. In the Advanced Security Settings dialog box, click OK to return to the Security tab, and then click OK again.

Default Print Permissions Assignments

After you install a new printer, Windows automatically creates the following default permission assignments:

• The Everyone group has Print permission to the printer.

• The CREATOR OWNER user (which represents the user that installed the printer) has the Manage Documents permission, which permits users to manage their own documents only.

• The local groups’ Administrators and Power Users have the Print, Manage Documents, and Manage Printers permissions—giving them full control to use and manage the printer and all print documents that are in the print queue.

If you want to limit access to the printer, you must remove the default permission assignment to the Everyone group and then assign permissions to the appropriate users and groups.

Calculating Effective Print Permissions

You calculate effective print permissions in the same manner as effective NTFS permissions on files and folders. To determine effective print permissions for a user account or group, follow these steps:

1. Combine the Allow permissions from all sources. The user receives the highest possible level of permission from this combination.

2. Apply any Deny permissions. Remember that Deny permissions always override Allow permissions.

Print Permission Inheritance

Inheritance of print permissions controls whether the permissions that you assign to a printer apply to the printer only, to the documents that are printed on the printer, or to both the printer and documents.

You control print permission inheritance by using the Apply Onto drop-down list in the Permission Entry dialog box, as shown in Figure 9-20. You can select from the following settings:

• This Printer Only

• Documents Only

• This Printer And Documents

  
  Figure 9-20: Control print permission inheritance in the Permission Entry dialog box.

Practice: Configure Print Permissions

In this practice, you will configure permissions on a printer. This practice assumes that you already have a printer installed on your computer. If you do not already have a printer installed, follow the practice at the end of Lesson 1 in Chapter 6 to install a logical printer in Windows XP, even if you do not have an actual printer to connect. This practice also requires that you use Windows XP Professional because Windows XP Home edition does not support print permissions.

1. From the Start menu, select Printers And Faxes.

2. In the Printers And Faxes window, right-click the icon for a printer and select Properties.

3. In the Properties dialog box for the printer, on the Security tab, select the Everyone group and click Remove.

4. Click Add, and then in the Select Users Or Groups dialog box, type Users and click OK.

5. On the Security tab, select the Users group and then, in the Permissions For Users section, select the Manage Printers check box in the Allow column.

6. Click OK.

Lesson Review

The following questions are intended to reinforce key information presented in this lesson. If you are unable to answer a question, review the lesson materials and try the question again. You can find answers to the questions in the “Questions and Answers” section at the end of this chapter.

1. List and describe the basic print permissions in Windows XP Professional.

2. What steps must you take to limit access to a printer on a computer running Windows XP Professional?

Lesson Summary

• Windows XP Professional does not distinguish between share and NTFS permissions for printers the way it does for files and folders. There is only one set of permissions for printers. You cannot assign print permissions in Windows XP Home Edition.

• The basic print permissions that are available in Windows XP Professional are Print, Manage Documents, and Manage Printers.

• Windows assigns some user accounts and groups permissions by default. The Everyone group has the Print permission. The CREATOR OWNER user has the Manage Documents permission. Members of the local groups Administrators and Power Users have the Print, Manage Documents, and Manage Printers permissions.