Printer Security on Server 2003 (long-ish)

An odd question and I'll admit it up front.

We have a multi-domain (not AD) in which we have set up a series
of inter-locking trust relationships. It has all worked quite well for the
last 8-10 years. Now 2003 arrives and we need to "update." In
general everything has fallen into place but we have an odd-ball
case that doesn't fall into the "normal" scheme of things and we
(more me really) need some suggestions.

We have a person who refuses to "join" the domain. He feels it may
lead to a potential intrusion into his machine and with all of the virus
problems who can blame him. (In an academic environment this the
equivalent to an combination of invasion of privacy, violation of the
first amendment freedom of speech, and the "academic freedom"
guaranteed every professor.

My job is to get him connected to the 2003 server's printing queue.
When creating "share shares" and the "share security" it recognized
"domains/AD", "groups" and "users" and "machines." Of course, each
one has to be a subset of the largest - the domain or AD which he
adamantly refuses to join.

Is anyone aware of a way to add a single machine to the Windows
2003 Server printing system so that a user (named "John") on a
specific machine (named cow.cat.fsu.edu) is allowed to print to one
specific print queue? (Or any user from that machine for that matter?)
Might there be a way to specify to the print manager that the machine
at 123.456.111.222 could print but no other address could?

Hoping to hear good news.

David Schrader

Well you could give him a typewriter.

You can not use Domain resources without being in the Domain. That is kinda
the point of the whole thing.

Was he in the old Domain? ..If so what's the problem now?

If he wasn't in the Domian,..then how did he print before?

I suppose I would just plant a local printer next to his machine, or setup
the network printer in his machine by using the TCP/IP port which prints
directly to the printer's IP# (assuming it has a NIC in it), when using the
TCP/IP port the printer behaves just like a local printer and is treated
like one. But, hey just for fun, I'd still put that typewriter on his desk
for about an hour (just before your leave for lunch), make him "sweat it
out" till you get back from lunch <g>.


--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com


"David Schrader" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> An odd question and I'll admit it up front.
>
> We have a multi-domain (not AD) in which we have set up a series
> of inter-locking trust relationships. It has all worked quite well for the
> last 8-10 years. Now 2003 arrives and we need to "update." In
> general everything has fallen into place but we have an odd-ball
> case that doesn't fall into the "normal" scheme of things and we
> (more me really) need some suggestions.
>
> We have a person who refuses to "join" the domain. He feels it may
> lead to a potential intrusion into his machine and with all of the virus
> problems who can blame him. (In an academic environment this the
> equivalent to an combination of invasion of privacy, violation of the
> first amendment freedom of speech, and the "academic freedom"
> guaranteed every professor.
>
> My job is to get him connected to the 2003 server's printing queue.
> When creating "share shares" and the "share security" it recognized
> "domains/AD", "groups" and "users" and "machines." Of course, each
> one has to be a subset of the largest - the domain or AD which he
> adamantly refuses to join.
>
> Is anyone aware of a way to add a single machine to the Windows
> 2003 Server printing system so that a user (named "John") on a
> specific machine (named cow.cat.fsu.edu) is allowed to print to one
> specific print queue? (Or any user from that machine for that matter?)
> Might there be a way to specify to the print manager that the machine
> at 123.456.111.222 could print but no other address could?
>
> Hoping to hear good news.
>
> David Schrader
>
>