I'm trying to enable my helpdesk personnel to create printers on some of our
member servers, and for business reasons they can NOT be local admins on
those servers. I've put them in domain\builtin\Print Operators. I've put them
in the Print Operators group on the local servers. I've assigned them in
local policy the right "Load and unload device drivers" on those member
servers. But they still can't create new local printers. What more do I need
to do to enable a non admin to create local printers and/or new ports (for
network printers)?

After a little more experimentation, I find that adding the personnel to
"Power Users" seems to give them this ability. But I'd still like to avoid
that, and delegate only the exact rights / grant the applicable perms on fs /
registry, etc. necessary to create printers on these servers.

Thanks in advance!



"wright47" wrote:

> I'm trying to enable my helpdesk personnel to create printers on some of our
> member servers, and for business reasons they can NOT be local admins on
> those servers. I've put them in domain\builtin\Print Operators. I've put them
> in the Print Operators group on the local servers. I've assigned them in
> local policy the right "Load and unload device drivers" on those member
> servers. But they still can't create new local printers. What more do I need
> to do to enable a non admin to create local printers and/or new ports (for
> network printers)?

Wright47 -- Did you ever find a solution to this other then adding the
users/group to the built-in Power Users group? We have ran into the same
situation and I am like you and don't want to add the users to the built-in
PU group.

"wright47" wrote:

> After a little more experimentation, I find that adding the personnel to
> "Power Users" seems to give them this ability. But I'd still like to avoid
> that, and delegate only the exact rights / grant the applicable perms on fs /
> registry, etc. necessary to create printers on these servers.
>
> Thanks in advance!
>
>
>
> "wright47" wrote:
>
> > I'm trying to enable my helpdesk personnel to create printers on some of our
> > member servers, and for business reasons they can NOT be local admins on
> > those servers. I've put them in domain\builtin\Print Operators. I've put them
> > in the Print Operators group on the local servers. I've assigned them in
> > local policy the right "Load and unload device drivers" on those member
> > servers. But they still can't create new local printers. What more do I need
> > to do to enable a non admin to create local printers and/or new ports (for
> > network printers)?

I never did. We ended up appointing only one person as the "printer creator"
person, creating him a group, and adding that group to the Power Users on the
servers in question.

Not optimal at all, but no one seems to know how to delegate this, and the
time I allowed myself to allocate for experimentation was up. :-)

Good luck on this one.

"jungblpe" wrote:

> Wright47 -- Did you ever find a solution to this other then adding the
> users/group to the built-in Power Users group? We have ran into the same
> situation and I am like you and don't want to add the users to the built-in
> PU group.
>
> "wright47" wrote:
>
> > After a little more experimentation, I find that adding the personnel to
> > "Power Users" seems to give them this ability. But I'd still like to avoid
> > that, and delegate only the exact rights / grant the applicable perms on fs /
> > registry, etc. necessary to create printers on these servers.
> >
> > Thanks in advance!
> >
> >
> >
> > "wright47" wrote:
> >
> > > I'm trying to enable my helpdesk personnel to create printers on some of our
> > > member servers, and for business reasons they can NOT be local admins on
> > > those servers. I've put them in domain\builtin\Print Operators. I've put them
> > > in the Print Operators group on the local servers. I've assigned them in
> > > local policy the right "Load and unload device drivers" on those member
> > > servers. But they still can't create new local printers. What more do I need
> > > to do to enable a non admin to create local printers and/or new ports (for
> > > network printers)?

Thanks for writing back. It seems foolish to spend the amount of time I have
already invested in figuring this one out, but it bugs me. I will update you
if I find anything.

"wright47" wrote:

> I never did. We ended up appointing only one person as the "printer creator"
> person, creating him a group, and adding that group to the Power Users on the
> servers in question.
>
> Not optimal at all, but no one seems to know how to delegate this, and the
> time I allowed myself to allocate for experimentation was up. :-)
>
> Good luck on this one.
>
> "jungblpe" wrote:
>
> > Wright47 -- Did you ever find a solution to this other then adding the
> > users/group to the built-in Power Users group? We have ran into the same
> > situation and I am like you and don't want to add the users to the built-in
> > PU group.
> >
> > "wright47" wrote:
> >
> > > After a little more experimentation, I find that adding the personnel to
> > > "Power Users" seems to give them this ability. But I'd still like to avoid
> > > that, and delegate only the exact rights / grant the applicable perms on fs /
> > > registry, etc. necessary to create printers on these servers.
> > >
> > > Thanks in advance!
> > >
> > >
> > >
> > > "wright47" wrote:
> > >
> > > > I'm trying to enable my helpdesk personnel to create printers on some of our
> > > > member servers, and for business reasons they can NOT be local admins on
> > > > those servers. I've put them in domain\builtin\Print Operators. I've put them
> > > > in the Print Operators group on the local servers. I've assigned them in
> > > > local policy the right "Load and unload device drivers" on those member
> > > > servers. But they still can't create new local printers. What more do I need
> > > > to do to enable a non admin to create local printers and/or new ports (for
> > > > network printers)?