I came across a printer problem, where a user was denied Manage Documents, but her effective rights were still Print and Manage Printers.

For example Mary is member of following groups, everyone, Print managers, Power Users and Acccounting,

Everyone: Allow Print
Print Manager: Allow Manage printers, allow Manage Documents
Accounting: allow print, DENY MANAGE DOCUMENTS
Power Users: Allow Print, Manage documents, manage printers

Print permissions are different than Ntfs and share permissions so this problem confused me, how can an individual be denied "Manage Documents" which is less than the "omnipotent privilege of Managing printers", and still have, a "higher overall Privilege". MY ANSWER was "print" only, my reasoning was having even been denied "manage documents" how can she then be allowed to "Manage Printers" ? thanks, ric



  • Silver BulletSilver Bullet Member Posts: 676
    Your explicit deny in the accounting group takes precedence over any explicit allow.

    Manage Printers doesn't include Manage Documents.
    Assigning printer permissions: Print Services
  • susuandmesusuandme Member Posts: 136

    I was surprised at this answer, the sybex book, also mentioned
    that even a person for example, has only "Manage Documents" Permissions.

    1. they cannot even connect and send print jobs to a printer

    For this they need "another separate permissions" of "PRINT".

    The Printer permissions seem quite different than the NTFS permission, here you
    need to be assigned each separate permission, none of them are "All inclusive". I assume. IS IT true then that even having the highest print permission;
    MANAGE PRINTERS, here you CANNOT EVEN send a PRINT JOB TO A PRINTER, unless you also have the "PRINT PERMISSION". ALSO. thanks
  • DaggedDagged Member Posts: 54 ■■□□□□□□□□
    Your explicit deny in the accounting group takes precedence over any explicit allow.

    You won't see this option on exam. Once is Deny it is Deny :) - that for exam not "real life" :D
Sign In or Register to comment.