Joseph
Fri Jul 11 06:27:02 PDT 2008
I suppose first it is important to understand how this happens. When a user
clicks "List in the directory", the computer account (not the user's
account) creates a "printQueue" child object under the computer object in
AD. This is allowed because "SELF" is has the "Create all child objects"
right which is inherited from the default security of the schema.
To remove the ability for ALL computer to do this, you would have to set an
explicit deny at the domain level that applies to computer objects. The
right you would need to deny is "Create Printer Objects".
To grant certain users this right is much more difficult. Since the print
spoolers runs as LOCAL SYSTEM, you can only grant permission to add printer
objects to computer accounts (unless you decide to run the printer spooler
service as an AD account for all machines you want to allow publishing
from). The only (easy) option I can think of is to put all of the computers
you wish to allow printer publishing from in a single OU then un-inherit the
DENY permission you granted at the root of the domain.
I'm quite sure there are more exotic ways to accomplish this, but I'd be
concerned that it's not worth the effort.
--
Joseph T. Corey MCSE, Security+
Systems Administrator
http://joecorey.wordpress.com/
"Mark Z." <MarkZ@discussions.microsoft.com> wrote in message
news:DA40B414-39A7-479D-B10C-F256B449BCC1@microsoft.com...
> How can I only assign a certain custom security group that I have created
> "Printer Publishers" the "list in the directory" right/permission? Right
> now
> it seems any user can clikc "List In The Directory" for any shared printer
> and it show up in my list of printers in active directory... don't want
> that,
> only want the group to be able to publish printers.