Print Server on Windows server 2008

Hello, I'll start with my ultimate goal: to manage (preview/approve) any print requests from all non networked computers. (So if there is an easier way of doing this please let me know). My office is set up with half of the computers connected to the server and half not. As of now, those off the network connect to the printer directly via its IP address. In order to control access of those off the network I have to restrict the printer to only accept the ip address of the server. I am trying to set up a (what I believe is called) a print server on my server so those off the network can connect to the printer through the server via the internet. I believe I have done this correctly: I Added/enabled print server and internet printing roles under server managment. I Added print managment as an exception through firewall. I added the printer im trying to control to the print server in print management. I get stuck when trying to connect to the printer from non networked computers that run xp vista and windows 7 (i.e. how do I do this from add a printer under control panel). Small notes: In Print Managment, the print server set up is called servername(local). Does the local mean its only accessible on the network or does it mean its located on locally on my server? Also IIS Admin service is running. Any help would be much appreciated. Thanks. Zach Server: Windows server 2008 sp2 Printer HP Colorjet4600

Hi Zach. I don't believe there is any native support to do what you are trying to do. You would probably have to use a third party product to preview and approve print requests. I'm not sure how setting up internet printing is going to accomplish this for you. But, internet printing is pretty basic. Once it is set up and the necessary ports are forwarded, you just add the printer on the workstation and enter the URL (or IP address) to the printer.

What ports do I need to forward. The only reason I'm suggesting internet printing is I found a programe called PrinterShare that is perfect but there is a monthly fee. I'll try and make my situation a little clearer, there has got to be an easy solution to this: When i say that half of the computers are not on the network, I mean they do not have access to the server (which hosts the printer). They use the same router/modem as the rest of the office. Currently these computers are connecting to the printer directly via the printers IP address. The only solution i can think of is restricting the printer to only accept requests comming from the servers IP address and sharing that printer from the server. Everyone with access to the server can still access the printer because the server is sharing it on the network. I am wondering how to still send print requests to the server from those computers who normally dont have access to the server. Thanks so much for the help, Zach

Yeah. You are not being real clear about your network topology. The way you are explaining things everything IS on the same network. I think what you mean is that a portion of the computers are not a part of the windows domain. Is this correct? Internet printing is not what you need. And you do not need to forward any ports because the computers are on the same network. Because accessing a printer on a server without it being on a domain is still fairly simple. I'm going to need more details about your network topology because we aren't using the same terminology. Can you describe, physically, how computers, printers, and servers are hooked to your network. How many printers, computers, servers you have, etc? Please specify the server's IP address, and the IP address and subnet mask on one of the "not connected" workstations. I can help you with this problem, but I'll need to get better details first.

Sorry for being so confusing. I did not set up this network and the physical set up is so mangled up its impossible to trace the wires. The setup is being explained to me by a non IT person so bear with me. There are roughly 30 computers, 1 server, and 5 printer (I only care about controling one of them) in the office all connected to the router. 10 computers have accounts on the server. 20 computers do not have accounts on the server. The server IP address is 10.xxx.xxx.2 A "not connected" computer's ip address is 10.xxx.xxx.28 with subnet max 255.255.255.0 The default gateway is 10.xxx.xxx.1 Printer ip address is 10.xxx.xxx.11 All xxx.xxx's are equal Thanks, Zach

That helps a lot. Is there any particular reason that those 20 computers are not joined to the domain? The issue with not having the computers joined to the domain is simply a matter of authentication. You can do what you want to do, but the users will still have to authenticate, either with their own names and passwords created in active directory, or with a generic name and password created in active directory. That's the only drawback to them not being on the domain, and having "transparent" authentication. Your idea of configuring the printer to block communications except from the server, will work. This would be the way to do it. And that is a good idea, if the printer allows you to do that. Cheaper ones, do not. As far as making the computers that are not on the domain access the printer, all you need to do is "add a printer" the same as you would with any shared printer, except the address to search for the printer would be the IP address of the server. Once you attempt to connect to the shared printer, you will be forced to type in a username and password. Because the computer is not part of the domain, the username will need to include the domain name. i.e. [removed] or whatever it is. This name and password would need to be typed in periodically as the computer is rebooted or after a period of time in order to print to the printer. It is really that simple to access the share on the server. The question would be how to make the authentication seemless without joining the domain. I believe you might be able to save the password as an option when you enter the name and password for the first time. So, that would probably be the easiest way. However, for some reason that option is not always available. That might be a simple fix, but I've never really researched that. The other way might be to use a login script to connect the printer and specify the password automatically. This is pretty simply done with a vbscript. I use one to automatically connect file shares and printer shares when a user logs in so I never have to configure them myself. I'm not real sure how to add the option to specify a username and password, but I'm sure it is possible. Tell me what you think so far, and we'll go from there.

This souds good. I'm running into some trouble though adding the printer. I click on add printer->Network printer -> Connect to a printer on the Internet or on your intranet. I enter my server IP address into the URL: but i get a message saying "Could not connect to the printer. You either entered a printer name that was incorrect …" If i click next to browse for the print, I can see the server name but get the same error message. I think there might be a setting on the server i need to tweak but im not sure. I'm not really sure why the 20 computers aren't apart of the domain ( I did not set it up) but i believe they sont want any of those 20 computers from accessing any information from the server. Thanks for the quick responses, Zach

Well, frankly, it would be best to have those computers a part of the domain. To address the problem of certain data not being accessed, then certain usernames and permissions should be setup so that they can access only what they are allowed to access. On the other side of things there are all kinds of benefits to having them on the domain. You can automate processes, you can control, in fine detail, aspects of the computers with group policy, authentication is seemless, you can centralize data, etc. There may be some licensing issues, and to stay within license limitations you may have to purchase more client access licenses. Can you please tell me what operating systems you are trying to add this printer on? I was taking a look at Windows XP here on my end. You would add printer, then choose network printer or printer attached to another computer. You would then choose connect to this printer: if you know the servername and printer share name. With this option you can just enter the server name and printer share name. i.e. \\servername\sharename and click next. If you don't know those, then you should be able to browse for the printer by locating the server and it should enumerate the shares on that server. If you are unable to do that, can you please specify if there is an error and what that error says? You will not use the URL option at all, in this case. Because you are not using internet printing. You are correct that there may be a security feature on the server preventing you from connecting to the printer, which we can resolve, but first please try the two different methods I listed above.

I am trying to add the printer on a windows 2000 (also tried xp), but Ill eventually need to add it on 2000,xp,vista,windows7. I typed in the server name and printer name ie: \\servername\printersharename but I get a new error message: "Could not connect to the printer. Access is denied." I tried the same proccess on a computer with a server accound and it worked.

Yeah. There may be a more secure setting on Server 2008 than what I have seen before. But, we should make sure of the obvious first. Make sure that the share permissions are correct on the server. For almost all purposes granting "everyone" the print permission should work. Just make sure that "everyone" is listed with permission in there. I also read that you might need to use the fully qualified domain name when you are trying to connect to the server. i.e. \\servername.ad-domain.local\sharename The .local is part of the domain. if you don't have .local then obviously you wouldn't use that. It could be .com or whatever is setup there.

Print sharing is on and I gave "Everyone" permission to print under the specific printers properties->securities tab. Im not sure if there is another place to grant permission. I used the full domain name but still get the same access denied message. Zach

Success! I was able to access it from windows xp computer. I still cant access it from the windows 2000 computer which is a little strange. Ok now how do I create a user/login that can only print? – and access nothing else on the server? Would it be possible to add all the other computers in the office as users who could only print and access nothing else? Thanks SO much for the help Zach

You have to adjust your permissions according to what you want people to be able to do. Pretty much, nobody should be able to access data on the server unless they have a valid username and password that has access to the data. If it has been configured wrong then you need to check that stuff.

Here is a small tutorial on NTFS and share permissions: http://www.windowsecurity.com/articles/Sha…ermissions.html

Typically, we give EVERYONE full control on the share permission, and use the NTFS permissions to fine tune who has access to what. For printers, there are ONLY share permissions, and you can modify those to grant users specific tasks on a printer.

I'm not sure why Windows 2000 cannot access the printer. Did you have to enter a name and password to connect to the printer on the Windows XP machine? There is a group policy item that prohibits the use of blank passwords over the network and this will prevent access to the share without providing a username and password. Its also possible that 2000 is old enough that server 2008's more strict security settings are preventing it from connecting.

Again, you are ultimately working around an issue that really should be resolved by joining the computers to the domain.

I really lost track of the initial post here. You originally said you wanted to preview and approve print requests. But, nothing we have done has addressed that issue. I guess ultimately, my question is, why aren't you just allowing these computer to print directly to the printer?

Prieviewing the requests would be really nice but not as important. I don't want those computers to print directly to the printer because it's a color printer and I want to prevent people from using it unless it's necessary.