Basically what I'm thinking is setting it up as we have been discussing. Either creating a single account meant just for printing that users can use when accessing the printer via the server, or adding all the computers to the server but restricting them all to just printing (whichever one you suggest). Then I can leave the printer on pause, with only those with privleges on the server can being able to unpause. I should still be able to see requests made to the printer in the print queue, right? Does that make sense?
I was looking into adding users and restricting them to only being able to print but haven't been able to figure it out.
Zach
I understand. I have had to deal with these issues in the past also.
The best way, in my opinion, for managing something like this has been done with more sophisticated printer/copiers. If the machine is advanced enough it will allow for you to create users on the machine, or even have it connect to active directory for authentication. The users can be given permissions based on what you want them to be able to do. Some users can print color, some cannot. Provide management with the ability to print color and then have anybody who needs to print color forward their document by e-mail or other means to a management team for review and printing in color. Some of those machines actually have a document manager of sorts where documents can be reviewed and authorized.
Other than that, you are going to have to use some kind of third party product if you want to do that with your server.
As far as connecting those 2000 boxes, I can't find any information on what security features to change to allow it. To the best of my knowledge 2000 will work the same as XP, but there must be something Server 2008 is blocking. Server 2008 does not work well with older operating systems due to its higher security levels, and ultimately I think you need to join the machines to the domain if you really want them to authenticate properly. Even then you might have trouble with a 2000 machine.
Sorry. I missed your latest TWO posts before posting my last response.
The requirement to login with Windows XP is the secret behind the Windows 2000 issue most likely. Did 2000 ask you to login before giving access denied?
Your idea sounds OK. And, yes, you should be able to look at what documents are in the print queue but you will not be able to view them. As long as people can't just unpause the printer.
Without knowing anything about what data is being shared, what sharenames you have, what permissions have been setup, it is impossible for me to provide detailed instructions for you. That is why I provided links to how to use share and NTFS permissions. it will be up to you to verify what users have access to what. You can start by opening up server management and viewing what is being shared on the server, and then look at the permissions for each folder shared and adjust the permissions as necessary. You may also have to create some new user groups, or OUs and move some users around to organize things a bit. Obviously, and I hope you know this, you don't provide specific users access to shares. You provide a group access to the share, and you add the users to the group. That way you just put people in or take people out of a group and they will gain or lose access to all related data. And your procedure should be to ALLOW certain groups access to certain data. It is usually not recommended to utilize DENY ACLs as they override any other ACL and can cause confusion. If the user isn't already allowed based on other permissions, then they are already denied.
This is sounding like a school. So, a teachers group would allow teachers access to a specific number of shares. A students group would allow students access to a specific number of shares. Etc. Then you just add/remove users from those groups based on WHAT they are.
Sorry for the huge delay between posts. There are only a few windows 2000's on the network so they will just have to deal. I created a generic user on the server without any permissions and it worked great. I'm able to save the credentials on all the computers so no one else needs to know the password anyway. This solution is not ideal but it gets the job done. Thanks so much for all your help.
Zoltain
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
So, a teachers group would allow teachers access to a specific number of shares. A students group would allow students access to a specific number of shares. Etc. Then you just add/remove users from those groups based on WHAT they are.