Active Directory By the Numbers: Windows Server 2003

Windows Server 2003 shares printers in a similar fashion to folders, in that it uses a permissions based model to allow or deny certain users and/or groups to print, as well as manage the documents going through the printers themselves . The permissions structure is much simpler when compared to folder permissions. The three main printer permissions are as follows .

• Print: The most basic of the three, the print permission simply allows users to print. By default, the built in groups Everyone , Administrators , and Print Operators are assigned the print permission.

• Manage Documents: More of an administrative permission, manage documents allows a user or group to change the order in which documents print, pause and resume documents, cancel, and restart print jobs. However, a user or group with the manage documents permission cannot actually send jobs to the printer (that is, he/she cannot print). Windows Server 2003 assigns the manage documents permission to the Creator Owner , Administrators , and Print Operators built in groups by default.

• Manage Printers: This permission gives a user or group the power to have full control over the printer itself. They may stop and start the printer, change its permissions, add new printers, and change printer settings. By default, the Administrators and Print Operators groups are assigned the manage printers permission.

Windows Server 2003 has the ability to store various versions of printer drivers so that when users log on and connect to the printer, they do not need to have the printer drivers available on their local hard drives . Instead, they download the needed drivers directly from the server. This makes keeping track of printer drivers a fairly easy process. You only need to update one set of drivers, and everyone else on the network receives those drivers.

Tutorial: Sharing A Printer in the Active Directory

Publishing a printer to AD is far less complicated than publishing a folder. We eliminate the two step approach and instead publish the printer to the network and to the AD in one step. For this tutorial, we share a simple HP DeskJet 932C inkjet color printer connected directly to the Windows Server 2003 machine. However, you may use whatever printer you have connected to your server and/or network.

1. Install the printer according to the printer manufacturer's instructions. Since we are using an HP DeskJet 932C, which is a USB device, installation is simple; we just plug it in and Windows installs the correct drivers necessary to use the printer.

2. Once the printer is installed, go to the Start menu and choose Printers and Faxes . Your printer should appear here. Windows Server 2003 automatically shares the printer over the network and publishes it in the Active Directory. You can tell that it is being shared by the picture of the hand under the printer's icon. If for some reason your printer is not shared, right-click its icon and choose Sharing.

3. Select the option marked Share this printer . Accept the default name in the Share name field.

4. Place a check in the List in directory checkbox. This adds the printer to the Active Directory.

5. We now need to make sure that all drivers for the printer are located on the server so that Windows clients connecting to the printer will be able to grab the drivers directly from the server. Click the Additional Drivers button at the bottom of the window.

6. By default, drivers for Windows XP, Windows 2000, and Windows Server 2003 are included. If you wish to install any additional drivers for other Windows operating systems, place checks in the appropriate boxes and click OK . You may be asked to insert your Windows Server 2003 installer CD.

7. Do you remember how we set up keywords to search the Active Directory for shared folders? We can do the same for printers. Click the General tab. Here, you may enter information based on the location of the printer, as well as comments about the printer. The location of the printer is very important, especially if your building is large and there are many printers at your site. Here's an example of what your comments and location setup might look like:

8. On the Security tab, add the groups that you wish to grant access to the printer and set their permissions as described earlier.

   But what happens when you have a printer that is being shared from a pre-Windows 2000 operating system (such as Windows 98), or a non-Microsoft operating system (such as Mac OS X Server) and you wish to list that printer in the Active Directory?

9. Open Active Directory Users and Computers . Create or pick an OU where you wish to place the printer.

10. Right-click the OU, point to New , and choose printer .

11. Type the network path to the printer. For example, if we have an HP printer located on a Mac OS X Server, our path might be:

    \\macosxserver\hpprint

    Hit OK .

Your printer is now published in the Active Directory. We do not need to publish it to the network, because our Mac OS X Server is doing that for us already.