What permissions could a printer driver require?
Windows 7 Professional, 32bit
We have a specialized printer for specific production tasks. This printer's driver has a strange problem where some of the options in the Printer Preferences are disabled (e.g. Button is disabled, grayed out) when a user with limited permissions ("Users" group) is logged in, when a user that is a member of the Administrators group is logged in the options are enabled. I have contacted the printer manufacturer but I'm not getting much cooperation from them.
I installed Process Explorer to look for any handles that may give me a clue to what files the driver may need elevated permissions for, however I couldn't see any clues.
My question is: How else can I determine what permissions a driver requires?
I've seen this issue manifest itself in a few different ways. It almost always goes back to either old printer drivers or specialized drivers that do not fully support UAC.
A couple of general things to check:
- Are you using a Print Server? If so, make sure the driver-specific options are enabled in the Printer Preferences for the print queue on the print server itself. I've seen certain drivers from Xerox that will have Printer Preferences options such as dupexling disabled on the client if they're not enabled on the server.
- Some print drivers use SNMP to query the printer to determine what add-ons (such as duplexers) have been installed and thus enable those features in Printer Preferences. Your printer or driver should have this documented.
- If you uninstall the printer and re-install does it temporarily resolve the issue? If so, something, likely another print driver, is not playing nice with shared DLLs or the Registry.
- Are you installing the printers as per-machine connections either via GPO or a
printui.dllutility in a login script? Older drivers will sometimes not function well in this situation due to UAC. Try installing the printer on per-user basis to test this theory.
I installed Process Explorer to look for any handles that may give me a clue to what files the driver may need elevated permissions for, however I couldn't see any clues.
You're on the right track, you're just using the wrong tool. Process Explorer will show you what each process has open, which is great for troubleshooting things like DLLs versioning problems but you need deeper magic Take a look at ProcMon. The great thing about ProcMon is it will record just about everything that is going on on your Windows-based computer, the horrible thing about ProcMon is that it will record just about everything that is going on on your computer. We're talking tens of millions of events.
Start by filtering for events only generated by the print spooler (spoolsv.exe) when you're logged in as a user in the Administrators group. Go to the options part of Printer Preferences. Wait for the number of events being recorded to slow, exclude all the previous events, and then start toggling the options that are disabled for your unprivileged users. Then immediately stop logging. This should hopefully limit the events you need to look through to manageable amount. Your Printer Preferences setting are likely just Registry Keys so maybe start there. If you can find the specific Registry Key, filter your events just for it and then test the settings again to confirm you've found it. Then just grant the BUILTIN\Users group permission on the Registry Key or Keys.
Unfortunately, this is easier said than done. Unless you have a pretty deep understanding of Windows it's often a case of trial and error.
The answer (for my case) was surprisingly simple and logical: Grant the Manage Printers permission to the user or group.