[gptalk] Re: GP Preferences / Vista / Printers / UAC
- From: "James F. Prudente" <JPrudente@xxxxxxxxxxxxx>
- To: <gptalk@xxxxxxxxxxxxx>
- Date: Fri, 5 Sep 2008 10:36:30 -0400
Hi Darren,
If the PC does not have the printer driver already installed, the GPP
printer install hangs. On the other hand, if the driver already exists
on the workstation, GPP printer mapping works properly. I don't know if
it's UAC or not, but GPP printer processing certainly seems to hang
while attempting to install the driver. I'm just assuming it has
something to do with UAC since by default, UAC balks when a (any) user
tries to install a print driver.
The preferences are not set to run in the user's security context, but
one of the sites I was looking at indicates printer mappings always run
in the user's context anyway.
At your suggestion, I enabled verbose logging. I began with making sure
the printer driver was not on the workstation, and then logged on. The
login hung at applying the GPP printer settings. The last few lines of
the trace file are as follows:
2008-09-04 15:10:22.633 [pid=0x4dc,tid=0xf8c] Starting class <Printers>.
2008-09-04 15:10:22.633 [pid=0x4dc,tid=0xf8c] Handle Children.
2008-09-04 15:10:22.633 [pid=0x4dc,tid=0xf8c]
{9A5E9697-9095-436d-A0EE-4D128FDFBCE5}
2008-09-04 15:10:22.633 [pid=0x4dc,tid=0xf8c] Starting class
<SharedPrinter> - HP Officejet Pro K850 Series (HS Room 127).
2008-09-04 15:10:22.649 [pid=0x4dc,tid=0xf8c] Set user security context.
2008-09-04 15:10:22.649 [pid=0x4dc,tid=0xf8c] Set system security
context.
After that, I installed the printer driver, simply by connecting to the
printer object on the print server manually. (Again, there's no issue in
doing this while logged on.) I deleted the printer object, leaving the
driver in place, rebooted, and attempted to log on again. This time, the
printer installed as expected. The resultant trace log is larger, so I'm
just including a few lines after where the log stopped above:
2008-09-05 10:25:21.649 [pid=0x4d8,tid=0x898] Starting class
<SharedPrinter> - HP Officejet Pro K850 Series (HS Room 127).
2008-09-05 10:25:21.649 [pid=0x4d8,tid=0x898] Set user security context.
2008-09-05 10:25:21.649 [pid=0x4d8,tid=0x898] Set system security
context.
2008-09-05 10:25:27.985 [pid=0x4d8,tid=0x898] Set user security context.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Set system security
context.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Properties handled.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Handle Children.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] EVENT : The user 'HP
Officejet Pro K850 Series (HS Room 127)' preference item in the
'[TESTING] Map Printer - HP 850 {D10B7AE1-5BD3-48B0-A3F1-FDB9B46FF4A6}'
Group Policy object applied successfully.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Completed class
<SharedPrinter> - HP Officejet Pro K850 Series (HS Room 127).
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Completed class
<Printers>.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Completed package
execution.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] Completed execution of
apply package.
2008-09-05 10:25:31.294 [pid=0x4d8,tid=0x898] GPH data file :
C:\ProgramData\Microsoft\Group
Policy\History\{D10B7AE1-5BD3-48B0-A3F1-FDB9B46FF4A6}\S-1-5-21-106028429
8-117609710-725345543-16634\Preferences\Printers\Printers.xml
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Updated GPH.
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Completed apply GPO.
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Completed GPO
post-processing.
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Completed get next GPO.
[SUCCEEDED(S_FALSE)]
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Completed calculate
precedence.
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Completed get RSoP class.
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] Completed initialize
namespace.
2008-09-05 10:25:31.325 [pid=0x4d8,tid=0x898] WQL : SELECT * FROM
RSOP_PolmkrSetting WHERE polmkrBaseCseGuid =
"{BC75B1ED-5833-4858-9BB8-CBF0B166DF9D}"
There are then a number of <PROPERTY> <VALUE> entries.
Does that help at all? Doesn't mean much to me, unfortunately.
Martin - Yes, the GPP CSE is installed, and as noted has no problem
creating printer objects if the driver already exists on the client.
Thanks all,
James
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Thursday, September 04, 2008 1:59 PM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] Re: GP Preferences / Vista / Printers / UAC
James-
If UAC is not enabled, I'm not clear why you believe the GPP printer
install is hanging because of the UAC prompt? But, a couple of
questions-do these preferences have the option checked to run in the
user's context?
Have you tried enabled verbose GPP Printer logging? This might help
narrow the problem.
Darren
From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx]
On Behalf Of James F. Prudente
Sent: Thursday, September 04, 2008 9:57 AM
To: gptalk@xxxxxxxxxxxxx
Subject: [gptalk] GP Preferences / Vista / Printers / UAC
Hi All,
For our Vista clients, we have UAC turned off, and users have all
necessary rights to install printer drivers from our print server. Users
can add printers without any problems either via directly accessing the
UNC share, browsing the server, or using the windows printer management
web page. Login scripts (vbscript) also will install the printer without
any trouble.
However, if we use GP Preferences to install certain printers at login,
the machine will hang up (seemingly indefinitely) while "applying group
policy printer settings." I'm guessing UAC is looking for the OK to
install the driver and obviously can't get a response from the user. If
the driver is already on the machine, the printer connection will get
created as it should, without any delay.
If the printer driver were not Vista compatible, users should not be
able to install it under any circumstances. Likewise, if UAC settings
are wrong, it should balk when attempting to install the driver
regardless of the method. Not sure why this would happen.
Any thoughts or ideas are appreciated.
Thanks,
James
Other related posts:
