pRINTER QUESTION

susuandme

Hi,

I came across a printer problem, where a user was denied Manage Documents, but her effective rights were still Print and Manage Printers.

For example Mary is member of following groups, everyone, Print managers, Power Users and Acccounting,

Everyone: Allow Print
Print Manager: Allow Manage printers, allow Manage Documents
Accounting: allow print, DENY MANAGE DOCUMENTS
Power Users: Allow Print, Manage documents, manage printers

Print permissions are different than Ntfs and share permissions so this problem confused me, how can an individual be denied "Manage Documents" which is less than the "omnipotent privilege of Managing printers", and still have, a "higher overall Privilege". MY ANSWER was "print" only, my reasoning was having even been denied "manage documents" how can she then be allowed to "Manage Printers" ? thanks, ric

EFFECTIVE PERMISSIONS: ALLOW PRINT, MANAGE PRINTERS ?

Silver Bullet

Your explicit deny in the accounting group takes precedence over any explicit allow.

Manage Printers doesn't include Manage Documents.
Assigning printer permissions: Print Services