Printing with Windows Server 2003

This chapter continues our examination of the Windows Server 2003 printing system and covers printer management, permissions, advanced configuration, and troubleshooting.

Working with the Print Spooler

In the previous chapter, we defined and discussed most of the different parts of the printing process. In addition, we worked with installing and configuring print drivers and print devices.

The intermediate link between the print driver and the print device is the print spool, which is also known as the spool file. It's a file on the print server that contains the data to be printed. This file contains the print data and the print devicespecific commands needed to format the printed output. Most print jobs do not go directly to the print device, especially on a print device that is heavily used. Because a print device usually prints slower than the print job can be processed, the file is stored in the spool file so that the user can continue on with his or her work while the print server manages the print job. This has additional benefits. Printers, being mechanical devices, tend to jam and run out of paper. Because the print job is stored in a file, it can be resumed when the print device is repaired. In addition, the print job can be restarted, if some of the pages were damaged or lost.

The content of the spool file is referred to as the print queue. Users have the ability to view the print queue, using the Print Manager applet. Users can hold or cancel their own print jobs, or the print jobs of other users if they are granted the appropriate permissions. After the print device finishes printing the job, the print job is deleted.

Note: Save Print jobs

Windows Server 2003 has an option to save all print jobs on the hard drive of the print server. Use this option only if required by your company, because it can fill a hard drive very quickly.

The print spooler is part of the operating system and runs as the Print Spooler service. The print spooler manages the print queues for all local or network printers that are managed by the server. By default, the spool file is located at %systemroot%\System32\Spool\Printers.

As you might have noticed, this is on the system drive. In environments where a large number of printers are hosted on the server, this may impact performance because there will be a large number of files written to and read from the spool file, in addition to the constant accessing of the operating system files.

In this situation, it's best to move the spool file to another volume, preferably one that's attached to a different controller. To move the spool file, use the procedure in Step by Step 7.1.

Step by Step

7.1 Relocating the spool file

1.	From the Start menu, click Start, Printers and Faxes.
2.	In the left pane of the Printers and Faxes window, under Printer Tasks, click Server Properties. This opens the Print Server Properties dialog box, as shown in Figure 7.1. Figure 7.1. Click Server Properties, where you can choose settings for the print server.
3.	On the Print Server Properties dialog box, select the Advanced tab, as shown in Figure 7.2. Figure 7.2. Enter the new location for the spool folder.
4.	In the Spool Folder field, enter the new destination for the spool files. Click OK when finished.
5.	From the Start Menu, click Start, All Programs, Administrative Tools, Services.
6.	In the Services MMC, as shown in Figure 7.3, highlight the Print Spooler entry, and then click Restart. Figure 7.3. Restart the Print Spooler service to complete the spooler relocation process.
7.	After the service is restarted, close the MMC.

Note: Command Line

The Print Spooler service can also be stopped and started from the command line using the net stop spooler and net start spooler commands.

On servers that have been assigned to be print servers, you will want to relocate the spool file for the following reasons:

• Performance As mentioned earlier, isolating the spool file from the disk where the operating system files are located will increase performance because both functions are disk intensive. In addition, because the spool file is constantly being created and deleted, the disk will become fragmented pretty quickly. This can negatively affect the operation of both the operating system and the print process.

• Disk space issues Print jobs can get quite large, especially those with lots of graphics. This can cause a problem if the spool file fills up the free space on the operating system drive, because the page file needs write space. If the page file is unable to write to the disk, the operating system may become unstable.

• Disk quotas By setting a disk quota at the user group or folder (R2 and later) level, you can limit the amount of space to be used so that no single user or group can fill up all the space on the server. When this happens, other users are prevented from printing until some of the print jobs have finished, releasing some space on the server.

• Security If the print jobs are to be saved, it is easier and more secure to configure security on a drive where you don't have to worry about inherited permissions.

A separate set of spool files are generated for each print job. After the job has completed successfully, the spool files will be deleted from the spool folder. Each print job consists of two files:

• Spool file This is the file that contains the information to be printed, such as text, graphics, and formatting information.

• Shadow file The shadow file has the extension .shd and is used to store administration information about the print job, such as position in the print queue, job owner, document name, and so on.

Large print jobs can generate a significant impact on the network and print server loads. The print spooler files on a Windows Server 2003 print server can be relocated to a dedicated hard disk if these loads are going to be high. For more information about how to do this, see KB article 314105, "How to Move the Windows Default Paging File and Print Spooler to a Different Hard Disk," at http://support.microsoft.com/?kbid=314105. If network performance is an issue, consider directly connecting the print device to the server, because this will reduce the impact on the server from printing to approximately half; the print job from the server will be passed over the parallel or USB bus rather than the network.

Assigning Print Permissions

Like any Windows resource, the printing environment in Windows Server 2003 is highly secure and configurable. Access to printer objects is controlled in the same manner as access to objects such as files and foldersthey are defined on a user and group basis. For printer objects, three basic roles are granted the permissions shown in Table 7.1. These permissions allow users who are assigned these predefined roles to print, manage documents, or manage printers.

Table 7.1. Printer-Specific Permissions

Permission	Print	Manage Documents	Manage Printer
Print documents	X	X	X
Pause, restart, and cancel own documents	X	X	X
Connect to a printer	X	X	X
Control job settings for all documents		X	X
Pause, restart, and cancel all documents		X	X
Share a printer			X
Change printer properties			X
Delete printers			X
Change printer permissions			X

The permissions are broken down by the default groups that are granted the predefined roles, as shown in Table 7.2.

Table 7.2. Group-Specific Roles

Group	Print	Manage Documents	Manage Printer
Administrators	X	X	X
Creator Owner		X
Everyone	X
Power Users	X	X	X
Print Operators	X	X	X
Server Operators	X	X	X

The previous two tables outline the default permissions and roles. However, these can be changed to provide more granularity. While you will find that in most situations, the standard permissions will suffice, there will be specific circumstances where limiting access to printers is necessary.

For example, access to printers that print payroll checks, or to specialized photo or high-resolution color printers, should be limited to a select group of users both for security reasons and because of the cost per page compared to other printers.

As you can see in Table 7.1, when a shared printer is installed, by default all users are able to print to it. In Step by Step 7.2, we will change the permissions of a shared printer to remove the default access and grant access to a specific group.

Step by Step

7.2 Changing shared printer permissions

1.	From the Start menu, click Start, Printers and Faxes.
2.	On the Printer Properties dialog box, select the Security tab, as shown in Figure 7.4. Figure 7.4. Permissions for shared printers can be managed on the Security tab.
3.	Highlight the Everyone entry, and click the Remove Button.
4.	Click the Add button. From the Select Users, Computers, or Groups dialog box shown in Figure 7.5, enter the Engineers group. (This group was created in a previous chapter.) Figure 7.5. Enter the user and/or group to grant print permissions to.
5.	Click OK to return to the printer Properties dialog box. By default, the Engineers group is granted the Print permission. Click OK again to save.

Print Job Management

You can manage print jobs through the Print Queue window. Each logical printer has its own print queue that can be accessed by double-clicking its icon in the Printers folder.

Figure 7.6. The Print Queue window, showing paused print jobs.

You can manage documents by selecting one or more documents in the queue and then issuing one of the following commands from the Document menu:

• Pause This command prevents the selected document(s) from being printed; the document(s) is retained in the queue.

• Resume This command releases the selected document(s) so it prints normally.

• Restart This command stops the current print processing of the selected document(s) and starts the process over.

• Cancel This command removes the selected document(s) from the print queue.

• Properties This command displays the properties for the selected document(s).

Keep in mind that the documents you can manage depend on your access level. If you have only Print access to the printer, you can manage only your own documents. If you have Manage Documents or Manage Printers access to the printer, you can manage any print job in the queue.

If you have Manage Documents or Manage Printers access to a printer, you also can use the commands from the Printer menu of the Print Queue window. These commands include the following:

• Pause Printing This halts the printing process for all print jobs in the queue. Any data in the physical printer's buffer continues to print, but no new data is sent from the print server.

• Set as Default Printer This sets the current logical printer as the default printer for all print applications on this client.

• Document Defaults This opens the Default Document Properties dialog box. The Page Setup tab of this dialog box is used to define the association of paper type to trays, the number of copies to print, and whether to print in portrait or landscape mode. The Advanced tab displays the same controls discussed previously for the Device Settings tab of the printer Properties dialog box.

• Sharing This accesses the Sharing tab of the printer Properties dialog box, as previously discussed.

• Purge Print Documents This removes all documents in the print queue.

• Properties This opens the printer Properties dialog box (previously discussed and accessed directly from the Printers folder).

As we saw earlier in this section, you can also use printer permissions to delegate management of the printers and the print jobs to other users, without having to add them to other groups that would grant them more permissions than you want them to have. This will free you as the system administrator for other tasks.

Printer Pooling

Printer pooling is a form of load balancing in that two or more print devices are represented by a single printer. The users send their print jobs to what looks like a single printer. The print server then queues the print jobs in the order they were submitted. When a print device finishes a print job, it receives the next job in the queue.

For example, suppose that the accountant is printing a year-end summary report. Typically, these types of reports can be very detailed and take a long time to print. Unfortunately, several other users also have print jobs that need to be completed, and they have already submitted these jobs to the same printer as the year-end summary report. Normally, if the other users needed to get their print jobs completed in a reasonable amount of time, they would have to cancel the jobs they sent to the first printer, then resubmit them to another printer. However, with printer pooling, while one printer is tied up with the year-end summary report, the other print jobs are automatically routed to other available printers in the pool.

Printer pooling is a very efficient way to print because it balances the load. You never have multiple jobs waiting for a specific printer while another printer is idle.

For printer pooling to work successfully, the following conditions must be met:

• The printers must use the same print driver. They don't all have to be the same exact model, as long as they give the same results using a common printer driver.

• They must all be configured on the same print server because they have to share the same driver and print queue. They can be either locally or network attached.

• They should be located in close proximity to each other. The user has no way of knowing which printer the print job ended up on, so it's best to have them all in the same room.

To configure a printer pool, use the procedure outlined in Step by Step 7.3.

Step by Step

7.3 Configuring a printer pool

1.	From the Start menu, click Start, Printers and Faxes.
2.	In the left pane of the Printers and Faxes window, under Printer Tasks, click Add a Printer. This starts the Add Printer Wizard. Follow the procedure in the previous chapter to install the appropriate printer device, if it's not already present.
3.	In the Printers and Faxes window, right-click the printer you want to set up in a pool and select Properties from the pop-up menu.
4.	In the Printer Properties dialog box, select the Ports tab, as shown in Figure 7.7 Figure 7.7. The Ports tab allows you to select the ports that the printers for your pool are connected to.
5.	Select the Enable Printer Pooling check box and then select the desired ports. Click OK when you're finished.

After the procedure has been completed, if you look at the Ports tab, you will see that several ports have the identical printer name assigned to them, as shown in Figure 7.8.

Figure 7.8. The Ports tab showing the completed configuration.

As you can see in Figure 7.8, the ports can be of different types; the only limitation is that the same driver must be used for all printers.

The advantage of printer pooling is that users don't have to figure out which printer is available, so they can get their print job out quickly. This is all handled automatically by the server.

Scheduling Printer Availability

In the previous section, we examined how to use one logical printer to represent several physical print devices. However, we can do just the oppositewe can set up several logical printers to represent one physical print device.

You can set up several logical printers, each with slightly different configurations (but using the same print driver). For example, take a look at the Advanced tab of the printer Properties dialog box shown in Figure 7.9.

Figure 7.9. The printer Properties dialog box's Advanced tab.

The first area is the Always Available and Available From option buttons. The default is for the printer to always be available. However, suppose the Accounting department has a weekly job that prints a 500-page report. Unless you have a very fast printer, you wouldn't want to print that during normal business hours because no one else would be able to print. Although you could pause this large job and enable it after the other jobs have finished, that isn't easy, and can become tiresome when there are lots of print jobs to manage. There's a much easier way to accomplish this.

For example, you could create an additional logical printer and name it After Hours. The Advanced tab of the Printer Properties dialog box for the After Hours printer might say that it is available only from 6:00 p.m. to 6:00 a.m. Then, whenever users need to print a huge print job, they would print to the After Hours logical print device. The job would sit in the print queue for that logical device until 6:00 p.m., and then start printing when everyone has gone home.

To schedule printer availability, use the procedure outlined in Step by Step 7.4.

Step by Step

7.4 Scheduling printer availability

1.	From the Start menu, click Start, Printers and Faxes.
2.	On the Printer Properties dialog box, select the Security tab, as shown in Figure 7.9.
3.	Click the Available From option button and configure the time fields to reflect a 6:00PM to 6:00AM time window.
4.	Click the OK button when you're finished.

Although this sounds great in theory, as the system administrator you must use a combination of user education and printer permissions to make it work. You will need to educate users about which printers are available 24 hours, which ones are not, and why. After instructing them to use the after hours printers for all large print jobs, make it a habit to cancel any large jobs that are sent to other printers. In addition, starting with Windows Server 2003 version R2, you have the ability to set disk quotas at the folder level. This allows you to limit the size of jobs that a user or group can send to a logical printer by setting a quota for these users on the folder that the spool file is located in.

Another idea is to make the scheduled printers easily identifiable by giving them recognizable names such as After Hours, Big Jobs, and so on. In addition, make liberal use of comments in the comments field for the printers. You can also use printer permissions to deny access to printers for users who should always print their jobs after hours. Conversely, those users who never print large jobs should be denied access to the after hours printers so that they inadvertently don't send a print job to them.

Note: Disk Space

Make sure that the server that holds the print queue for the After Hours printer has a lot of free space, because several large print jobs could possibly remain on the disk until after hours.

Setting Printer Priority

Another way of controlling the precedence of print jobs is via Printer Priority. Priority is used to set the default importance of the print jobs in the queue. Priority can be set from 1 to 99. The job assigned the higher numerical number is printed first. For example, suppose you have a department with 30 employees and 2 managers. The managers believe that their print jobs should be printed before the employee print jobs. In this case, you would create two logical printers, one for the managers and one for the employees. The managers' printer would have a priority of 99, whereas the employees' printer could be left at 1.

With this configuration, any job sent to the managers' logical printer would be placed in the queue and print before any job sent to the employees' logical printer. The employees' print jobs would be processed only after the managers' jobs are completed.

To configure a second logical printer with a different priority, follow the procedure in Step by Step 7.5.

Step by Step

7.5 Setting printer priority

1.	From the Start menu, click Start, Printers and Faxes.
2.	In the Printers and Faxes window, click Add a Printer and use the Add Printer Wizard to install a second instance of one of the printers that you already have installed. Name it Managers. Figure 7.10. Name the new logical printer Managers.
3.	Right-click the printer you just created and select Properties from the pop-up menu.
4.	In the Printer Properties dialog box, select the Advanced tab. Change the Priority setting to 99, as shown in Figure 7.11. Figure 7.11. Set the Priority to 99.
5.	Click the OK button to save.

In the previous section, we outlined the default permissions and roles. However, these can be changed to provide more granularity. For example, let's configure a logical printer for the managers group referred to in the previous example.

Challenge

On the surface, setting different print priorities for different logical devices sounds like a great idea. However, what's to stop some devious employee from trying to print using the managers' logical printer?

What steps would you take to configure a logical printer that grants a higher priority to print jobs submitted by managers, but also prevents common users from printing to it?

Try to complete this exercise on your own, listing your conclusions on a sheet of paper. After you have completed the exercise, compare your results to those given here.

1.	From the Start menu, click Start, Printers and Faxes.
2.	In the Printers and Faxes window, right-click the printer you want to configure and select Properties from the pop-up menu.
3.	In the Printer Properties dialog box, select the Advanced tab. Change the Priority setting to 99.
4.	Select the Security tab. Click the Add button to open the Select Users or Groups dialog box. Enter the Managers and Employees groups. Click OK.
5.	From the Security tab of the Managers print object's Properties dialog box, highlight the Employees group and select Deny for all entries. If desired, you can add the Manage Printers and Documents roles to the Managers group.
6.	Click OK when you're finished.

This works unless the managers are also members of the Employees group. Review the rules on Deny Access from Chapter 4, "Managing and Maintaining Access to Resources."