Configuring Printers for Users | Terminal Services for Microsoft Windows Server 2003: Advanced Technical Design Guide (Advanced Technical Design Guide series)

Now that you've completed the work needed to ensure that various printers will be available to the users on your Terminal Servers, you need to provide a method for users to access their printers. This is easy if you're using client mapped printers because the printers are automatically created for the users.

However, client printers aren't always an option in the real world, so server printers must be used. When using server printers, you need to think about how your users will access these printers. Will you assign certain printers to certain users? If so, how will you do this? Maybe you want to allow all users to be able to use all printers? If this is the case, how will users know which printers they should use? We'll look at two strategies to answer these questions:

Assigning printers to users.
Methods of letting users choose their own printers.

Assigning Printers to Users

Once you decide that you would like to control which printers your users are able to print to, you need to determine how to provide that access. Setting permissions on printers is important, but permissions alone won't configure a printer for a user. For example, if you want the user "brian" to print to the \\printerserver\fastlaser printer, you can edit the properties of that print queue and grant "brian" print permissions. However, how will Brian know how to access that printer? Is he smart enough to be able to browse the network to the \\printserver computer, and then select the fastlaser printer? Most likely, if you decide that Brian should use the \\printserver\fastlaser printer, you need a way to assign that printer to him so that when he selects "print" from a Terminal Server application, the \\printserver\fastlaser printer shows up in his printer list.

There are three methods that you can use to assign server-based printers to users:

Map printers in users' logon scripts.
Map printers as part of a user's profile and policy settings.
Install the printer locally on the server and configure its permissions.

Method 1. Configuring Printers via Logon Scripts

One of the most tried-and-true methods of making printers available to users is to map them via a logon script. (Logon scripts were covered in detail back in Chapter 6.) When it comes to printing, there are a few different ways that you can use logon scripts to map users' printers.

One of the cool things about using logon scripts to map printers is that you can incorporate conditional branching into the scripts based on a user's group membership. That way, you can give a user access to a printer simply by adding them to the appropriate Windows group. You can even set the permissions of a printer based on the same user group.

Command-Line Printer Mapping

You can use the same "rundll32" from the printer drivers section of this chapter to map user connections to network printers. (This method replaces the older, less-flexible "con2prt.exe" utility.) To do this, add the following line to a logon script:

 rundll32 printui.dll,PrintUIEntry /in \\printserver\printer

Again, make sure that you have a comma with no space between the words "printui.dll" and "PrintUIEntry." You can add this command multiple times in a script if you need to map multiple printers.

Mapping Printers with Kixtart

If you've chosen to use Kixtart as the language for your logon scripts, you can use its own native capabilities to connect to network printers. For example, the following Kixtart code checks to see whether the user is in the "PrinterGroup-Name" Windows group. If he is, it adds the \\printserver\fastlaser printer connection and sets it to be the default printer for the user.

 if ingroup("PrinterGroupName")   addprinterconnection ("\\printserver\fastlaser")   setdefaultprinter ("\\printserver\fastlaser") endif

Many Terminal Server administrators use code like this, adding this code segment for each printer in the environment. This can allow them to create an all-encompassing logon script that maps the proper printers based on users' group memberships.

Advantages of Assigning Printers with Logon Scripts

You can assign printers on a per-user or per-group basis.
You can assign different printers for different servers.
Logon scripts can be used in many different ways.

Disadvantages of Assigning Printers with Logon Scripts

Requires knowledge of the logon script language.

Method 2. Configuring Printers via User Profiles

Another option for ensuring that users can easily access their printers is to use roaming profiles. By doing so, your users will only have to connect to a printer once. After that, the printer connection will become part of their profile and will automatically be restored whenever they logon. See Chapter 6 for full information about using roaming profiles.

Advantages of Assigning Printers via Roaming Profiles

This method works without using logon scripts.
The same printers will be available to the user no matter where they log on.

Disadvantages of Assigning Printers via Roaming Profiles

Roaming profiles must be configured for your environment.
The user (or you) will have to manually configure the printer the first time for the user.
The same printers will be available to the user no matter where they log on.

Method 3. Installing Printers onto the Terminal Server

The last method of assigning printers is not exactly a "best practice," but it can work well in smaller LAN environments that don't have too many printers. To use this method, you install the printer "locally" onto a Terminal Server. This does not mean that the printer must be physically attached to the Terminal Server. It just means that you add the printer to the Terminal Server as a local printer instead of a network printer. To do this:

Logon to the Terminal Server as an administrator.
Start the "Add Printer" wizard.
Select "Local printer attached to this computer."
Make sure that the "Automatically detect and install my Plug and Play printer" box is unchecked.
When asked, create a new port instead of using an existing port.
Select Standard TCP/IP port.
Type in the IP address of the printer or print server.
Configure the options for type of port detected on the IP address you specified.

Following this procedure creates a shared print queue on the Terminal Server. Even though this queue is for a remote printer, the server treats it as a locally installed printer. By default, all users that run sessions on a Terminal Server are able to print to local printers on a server, meaning that all users will "automatically" have access to this printer.

You can modify the permissions of one of these newly-installed local printers so that only certain users or groups can print to it. What's cool about this is that users won't see a printer that they don't have rights to print to, so you don't have to worry about any additional configuration.

The major downside to this method is that since the print queue is local to the Terminal Server, the server's printing subsystem will spool the file locally and send it across the network in its raw data format instead of as an EMF file. (In some cases, such as when some types of JetDirect cards are used, this is always the case anyway.)

Advantages of Installing Printers on Each Server

You can assign printers to users simply by editing the permissions of the printer.
All users that use the Terminal Server will automatically see the printer.

Disadvantages of Installing Printers on Each Server

Each printer must be configured on each server. (Although printers can be replicated with tools such as Microsoft's free Print Migrator.)
This method bypasses the "real" print servers in your environment.
Print jobs are spooled on the Terminal Server instead of on the print server.
All users share the same print queue.

Letting Users Choose Their Own Printers

Instead of assigning printers to your users, you may have an environment in which users need to be able to choose their own printers. This makes your job much easier. If security is important, you can still set the printing permissions on the printers that you don't want everyone to be able to print to.

If you simply give a user permissions to print to a network printer, that printer will not be automatically set up for the user. However, the user will be able to browse the network and connect to the printer if he needs to print to it.

Advantages of Letting Users Choose Their Own Printers

You can still set security for printers that need limited access.
There is less for you to configure.

Disadvantages of Letting Users Choose Their Own Printers

Users need to know how to connect to printers.
Users need to know which printer they are looking for.

If your users are able to configure their own printers via Windows Explorer or the "Printers" folder in the Start Menu when using a desktop session this may be fine. However, in the real world, many people choose not to allow users to connect to the Windows desktop or Windows Explorer and instead only use single application connections, and thus users are not able connect to network printers since they have no interface to do so.

With that problem in mind, many administrators will give the users a connection to the server that launches the Printers folder. Of course this is an extra step for the end user but it allows them access to a resource without giving them a full server desktop.

Configuring Printers Folder as an Initial Application

Connecting to the Printers folder is very easy to do. The Printers folder does not have its own executable; it's actually built into the Windows shell (explorer.exe). These types of Explorer shell components are called "shell extensions." Each shell extension has its own GUID, which is like a serial number that differentiates it from all other shell extensions. Information about different shell extensions are contained in the following registry location: HKEY_CLASSES_ROOT\CLSID\<unique guid>.

In this case, the Printer folder's unique GUID is {2227A280-3AEA-1069-A2DE-08002B30309D}.

Any Windows program can access a shell extension by calling explorer.exe and requesting the GUID of the extension it wants. You can even create an initial application that points to the Printers shell extension. Here's a neat trick to show how that shell extension will work:

Create a new folder on your Windows desktop.
Name the folder "Printers.{2227A280-3AEA-1069-A2DE-08002B3030 9D}" with no spaces anywhere in the name.

As soon as you press Enter, the icon for the folder will change into the Printers folder icon. When you open that folder it will look just like the Printers folder from the start menu. To make the Printers folder available as a stand-alone application, you need to create a command line that launches a folder like this. Here are the steps to take:

Create a folder called "Printers.{2227A280-3AEA-1069-A2DE-08002B30309D}." Make sure that there are no spaces anywhere in the name.
Put that folder somewhere it can be launched. For example, use the c:\print\ directory, so that the full path of your folder is c:\ print\Printers.{2227A280-3AEA-1069-A2DE-08002B30309D}\.
Now, all you need to do is launch that folder with certain command-line switches. However, you need to first make a copy of explorer.exe. Your copy can be called anything except explorer.exe. This will force your command to open a new instance of explorer.exe, since yours will have a different name than the background copy that is already running.
Put the new copy of explorer.exe (Let's call it printexplorer.exe) into the m:\print\ folder.
Access your new folder via the following command: C:\print\printexplorer.exe /n,/root, C:\print\Printers.{2227A280-3AEA-1069-A2DE-08002B30309D}.

That command line begins by launching printexplorer.exe with several command-line options. The /n option tells explorer to open a single-paned window. The /root option tells explorer to open this window as the root, preventing users from being able to click the "Up" folder to browse back up through the directory structure. The command ends with the full path to your custom folder, telling explorer which folder should be used as the root.