Shared Printers - connect automatically

Hi,

I have 2K3 standard server R2.

I find that my shared printers are automatically being connected to the
workstations. This happens even if the workstation is not joined to the
particular domain. I find multiple connections to the same printer appear.
One connection is through the server, another connection (to the same
printer) is from another workstation to the server.

I do not have Windows Print Server installed. It doesn't seem to matter if
the "List in the directory" is enable or not.

I'm not trying to restrict printer access, but I don't want the printer to
be automatically connected.

How can I change this? Thanks!
--
Bob

Bob wrote:
> Hi,
>
> I have 2K3 standard server R2.
>
> I find that my shared printers are automatically being connected to
> the workstations. This happens even if the workstation is not joined
> to the particular domain. I find multiple connections to the same
> printer appear. One connection is through the server, another
> connection (to the same printer) is from another workstation to the
> server.
>
> I do not have Windows Print Server installed. It doesn't seem to
> matter if the "List in the directory" is enable or not.
>
> I'm not trying to restrict printer access, but I don't want the
> printer to be automatically connected.
>
> How can I change this? Thanks!

Normally on computers joined to a domain this is automatically disabled.

http://support.microsoft.com/?kbid=320138#

On computers not joined to the domain you would have to disable it manually.
If for some reason the computers joined to the domain are auto finding the
printers you can use group policy to fix it.

http://support.microsoft.com/kb/234270/

--
Kerry
MS-MVP Windows - Shell/User
http://www.vistahelp.ca

> I'm not trying to restrict printer access, but I don't want the printer to
> be automatically connected.

Why?

This is part of the user profile (to connect previously used shared
printers). If you *do* want to restrict access, try using the printer
Security tab and set permissions appropriately. But you say you do not want
to restrict access. So I am a bit confused.

-Frank

The users are not using these printers. They never seeked them out. So, it is
fine with me that the user profile connects previously used shared printers.
I'm trying to stop the unsolicited connection to previously unknow (to the
user) printers.
--
Bob

"Bob" <86c6c2e6-(E-Mail Removed)> wrote in message
news:8547B172-84DB-4719-B9BC-(E-Mail Removed)...
> The users are not using these printers. They never seeked them out. So, it
> is
> fine with me that the user profile connects previously used shared
> printers.
> I'm trying to stop the unsolicited connection to previously unknow (to the
> user) printers.
> --
> Bob

If it is happening that way, I would think it is almost certainly a logon
script doing it or a policy configuration.

-Frank

"Frankster" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed) ...
>
> "Bob" <86c6c2e6-(E-Mail Removed)> wrote in message
> news:8547B172-84DB-4719-B9BC-(E-Mail Removed)...
>> The users are not using these printers. They never seeked them out. So,
>> it is
>> fine with me that the user profile connects previously used shared
>> printers.
>> I'm trying to stop the unsolicited connection to previously unknow (to
>> the
>> user) printers.
>> --
>> Bob
>
> If it is happening that way, I would think it is almost certainly a logon
> script doing it or a policy configuration.
>
> -Frank
>
Okay, I take that back after reading the MS Tech article that Kerry
pointed out.

-Frank

Hi Kerry,

Article 320138 "How To Disable Automatic Search for Network Printers and
Folders in Windows XP", does describe my probem. And as you point out, it
states "Note This functionality is disabled ... if you are joined to a
domain, ... if an administrator has disabled the functionality by using Group
Policy".

Article 234270 "Using Group Policies to Control Printers in Active
Directory" pertains to listing a printer in AD. I don't see a GPO to disable
"Automatically search for network folders and printers" in "Folder Options".

So as you write, my domain machines should not be automatically finding
network folders and printers, yet for some reason they are!?!

Maybe if I could find the proper GPO to disable this feature, my problems
would be solved. Any idea where this GPO is?

I have also noticed that machines that are not on the domain, but are on the
network, do connect the printers automatically. Apparently this is normal
behavoir and the GPO would not resolve this. For these non-domain joined
machines, it would be up to the workstation owner to change the setting
(which ain't going to happen).

I guess the only thing I can do for the non-domain joined machines is to
replace the "Everyone" is allowed to print security setting on the printer
with Authenticated Users or maybe Domain Users.

It seems strange to me that a visitor to your network can simply plug in
their laptop and take over a shared network printer by default.

--
Bob

Bob wrote:
> Hi Kerry,
>
> Article 320138 "How To Disable Automatic Search for Network Printers
> and Folders in Windows XP", does describe my probem. And as you
> point out, it states "Note This functionality is disabled ... if you
> are joined to a domain, ... if an administrator has disabled the
> functionality by using Group Policy".
>
> Article 234270 "Using Group Policies to Control Printers in Active
> Directory" pertains to listing a printer in AD. I don't see a GPO to
> disable "Automatically search for network folders and printers" in
> "Folder Options".
>
> So as you write, my domain machines should not be automatically
> finding network folders and printers, yet for some reason they are!?!
>
> Maybe if I could find the proper GPO to disable this feature, my
> problems would be solved. Any idea where this GPO is?
>
> I have also noticed that machines that are not on the domain, but are
> on the network, do connect the printers automatically. Apparently
> this is normal behavoir and the GPO would not resolve this. For
> these non-domain joined machines, it would be up to the workstation
> owner to change the setting (which ain't going to happen).
>
> I guess the only thing I can do for the non-domain joined machines is
> to replace the "Everyone" is allowed to print security setting on the
> printer with Authenticated Users or maybe Domain Users.
>
> It seems strange to me that a visitor to your network can simply plug
> in their laptop and take over a shared network printer by default.

You're right. None of those policies seem to do the trick. You can do it via
the registry but I don't see a group policy to do it.

http://support.microsoft.com/?kbid=276322

I also found this which may help

http://forums.techarena.in/showthread.php?t=391541

One question - you allow unknown vsitiors to connect to your network? You
should be securing any shared devices via permissions. At the very least
they should be restricted to authenticated domain users. Personally if I
had to let visitors connect to my network they would be on a seperate subnet
with very restricted access.

--
Kerry
MS-MVP Windows - Shell/User
http://www.vistahelp.ca

I'm not sure what you mean "do I allow unknown users to connect to my
network"? How could I prevent them?

I'm no networking guru, but it seems to me that a visitor could simply
unplug a domain workstation from the lan, and plug their laptop into that
port (thus bypassing any subnet restrictions).

As far as securing the server, I believe that is locked down pretty good in
that no shared folders are open to "everyone". Access is to domain users of
certain groups.

The printer is the thing I was unaware about until now. I discovered the
printer problem when I remote desktoped to my brothers home machine so as to
resolve some print driver problem with his computer. Once I got it in, I
found my business computers were automatically connected to his print folder!

By default, print shares are open to everyone to print, but I didn't care
too much about that as I didn't think just any old person on the lan would be
automatically connected to the printer.

So as I said before, I think the only solution is to change the print share
to only allow authenticated users to print. (just like I do with folder
shares).

That won't resolve the automatic connections, but it should prevent them
from printing a few reams of paper.

Thanks!

--
Bob

Oh, btw. I posted a question on the AD forum asking if anyone knows about the
mystery GPO and why my domain users are connecting to the printers. I'll
post the results back here. i.e. is article 320138 "How To Disable Automatic
Search for Network Printers and Folders in Windows XP" in error?
--
Bob