pRINTER QUESTION

[susuandme]

Hi,

I came across a printer problem, where a user was denied Manage Documents, but her effective rights were still Print and Manage Printers.

For example Mary is member of following groups, everyone, Print managers, Power Users and Acccounting,

Everyone: Allow Print
Print Manager: Allow Manage printers, allow Manage Documents
Accounting: allow print, DENY MANAGE DOCUMENTS
Power Users: Allow Print, Manage documents, manage printers

Print permissions are different than Ntfs and share permissions so this problem confused me, how can an individual be denied "Manage Documents" which is less than the "omnipotent privilege of Managing printers", and still have, a "higher overall Privilege". MY ANSWER was "print" only, my reasoning was having even been denied "manage documents" how can she then be allowed to "Manage Printers" ? thanks, ric

EFFECTIVE PERMISSIONS: ALLOW PRINT, MANAGE PRINTERS ?

[Silver Bullet]

Your explicit deny in the accounting group takes precedence over any explicit allow.

Manage Printers doesn't include Manage Documents.
Assigning printer permissions: Print Services

[susuandme]

Thankyou,

I was surprised at this answer, the sybex book, also mentioned
that even a person for example, has only "Manage Documents" Permissions.

1. they cannot even connect and send print jobs to a printer


For this they need "another separate permissions" of "PRINT".

The Printer permissions seem quite different than the NTFS permission, here you
need to be assigned each separate permission, none of them are "All inclusive". I assume. IS IT true then that even having the highest print permission;
MANAGE PRINTERS, here you CANNOT EVEN send a PRINT JOB TO A PRINTER, unless you also have the "PRINT PERMISSION". ALSO. thanks
thanks.

[Dagged]

Originally Posted by Silver Bullet

Your explicit deny in the accounting group takes precedence over any explicit allow.

You won't see this option on exam. Once is Deny it is Deny - that for exam not "real life"