Multi-Session Printers?

  • Thread starter Thread starter MBN
  • Start date Start date
M

MBN

Guest
Hi Everyone,
I am having a problem with my Win 2K3 terminal servers. Some of my
customers (I havent asked them all yet) are reporting that they are seeing
printers that belong to the same login eg companyXYZ but are from different
sessions eg. (23,36). I thought that you were only allowed to see the
printers that are from your own session?

I have checked that the account is not part of anything other then the
'Domain Users', and I have also checked that they are not in any of the
local groups such as "Print Operators" / "Power Users" / "Administrators"
etc.

I have never noticed this happening before and I dont know that it is
normal. They think (customers) that it has only happened in the last few
weeks, but apart from installing Symantec Ghost Console (11.0.1.1533)
nothing has changed in the last few weeks (the affected machines have NOT
been imaged). All my terminal servers are exhibiting this problem, and I am
at a loss to understand why.

Could someone confirm/deny that this is normal and do they have any ideas
that I could try to resolve this please.

Thanks
Murray
 
Re: Multi-Session Printers?

Hi Murray,

Are you allowing multiple concurrent logins using the
same user name? If yes then this explains the behavior
you are seeing. In 2003 a user can see printers from
other sessions running under the same account.

In Windows Server 2008 this has changed so that
each session can only see its own autocreated printers.

It is recommended to only allow one session for each
user account. This will help prevent unexpected default
printer changes and other problems caused by sharing
the same profile. The Restrict each user to one session
option is set in Terminal Services Configuration (tscc.msc).

Please let me know if the above does not apply to your
case and I will assist you further.

Thanks.

-TP

MBN wrote:
> Hi Everyone,
> I am having a problem with my Win 2K3 terminal servers. Some of my
> customers (I havent asked them all yet) are reporting that they are
> seeing printers that belong to the same login eg companyXYZ but are
> from different sessions eg. (23,36). I thought that you were only
> allowed to see the printers that are from your own session?
>
> I have checked that the account is not part of anything other then the
> 'Domain Users', and I have also checked that they are not in any of
> the local groups such as "Print Operators" / "Power Users" /
> "Administrators" etc.
>
> I have never noticed this happening before and I dont know that it is
> normal. They think (customers) that it has only happened in the last
> few weeks, but apart from installing Symantec Ghost Console
> (11.0.1.1533) nothing has changed in the last few weeks (the affected
> machines have NOT been imaged). All my terminal servers are
> exhibiting this problem, and I am at a loss to understand why.
>
> Could someone confirm/deny that this is normal and do they have any
> ideas that I could try to resolve this please.
>
> Thanks
> Murray
 
Re: Multi-Session Printers?

Hi TP,

Thanks for your reply, unfortunately using individual accounts is a problem
as we provide a service to other companys to 'host' random bits of software.
What happens is they come to us with a piece of software and they buy 30
users of hosting and we provide company XYZ with 30 concurrent logins and we
do all the backups etc for that piece of software.

Apart from confusing the users, its becoming a problem when printers arent
being removed when people log out. Ive checked all the permissions on the
registry and I run a printer delete script every night, its just that some
people log in and out 15 times a day and end up with so many printers listed
before the script cleans things up.

We only install WHQL signed drivers, but it's becoming too complicated to
manage and we are trying to move to a 3rd party solution such as ThinPrint.

I guess that I need to find some way of hiding printers that dont belong to
that session and to make/steal a script that runs when the user logs off
that loops through all their printers and deletes them. Do you have any
ideas that I could use please?



"TP" <tperson.knowspamn@mailandnews.com> wrote in message
news:%230L4onuJIHA.2176@TK2MSFTNGP06.phx.gbl...
> Hi Murray,
>
> Are you allowing multiple concurrent logins using the same user name? If
> yes then this explains the behavior you are seeing. In 2003 a user can
> see printers from other sessions running under the same account.
>
> In Windows Server 2008 this has changed so that each session can only see
> its own autocreated printers.
>
> It is recommended to only allow one session for each user account. This
> will help prevent unexpected default printer changes and other problems
> caused by sharing the same profile. The Restrict each user to one session
> option is set in Terminal Services Configuration (tscc.msc).
>
> Please let me know if the above does not apply to your case and I will
> assist you further.
>
> Thanks.
>
> -TP
>
> MBN wrote:
>> Hi Everyone,
>> I am having a problem with my Win 2K3 terminal servers. Some of my
>> customers (I havent asked them all yet) are reporting that they are
>> seeing printers that belong to the same login eg companyXYZ but are
>> from different sessions eg. (23,36). I thought that you were only
>> allowed to see the printers that are from your own session?
>>
>> I have checked that the account is not part of anything other then the
>> 'Domain Users', and I have also checked that they are not in any of
>> the local groups such as "Print Operators" / "Power Users" /
>> "Administrators" etc.
>>
>> I have never noticed this happening before and I dont know that it is
>> normal. They think (customers) that it has only happened in the last
>> few weeks, but apart from installing Symantec Ghost Console
>> (11.0.1.1533) nothing has changed in the last few weeks (the affected
>> machines have NOT been imaged). All my terminal servers are
>> exhibiting this problem, and I am at a loss to understand why.
>>
>> Could someone confirm/deny that this is normal and do they have any
>> ideas that I could try to resolve this please.
>>
>> Thanks
>> Murray
 
Re: Multi-Session Printers?

Hi Murray,

Your current design is flawed and needs to be changed. I
realize that may not be the answer you were expecting.
Below is information to help you decide what changes to
make.

Licensing considerations

There is no concurrent licensing for terminal services. If I
understand your situation correctly, it falls under the Service
Provider Licensing Agreement (SPLA). Under this there is
only Per User (for TS) and it is calculated on a monthly basis.
This means you need to have a TS Subscriber Access License
(SAL) for each person that will use the TS during the month,
*not* for each concurrent user.

It is not a requirement of the agreement to have a one to
one relationship between subscribers and user accounts, but
it makes sense for compliance tracking and technical reasons.

Again the main point of the above is that there is no concurrent
model; the licenses are for specific people in a specific month.
The list of people can't shift around from hour to hour or day
to day (which would be de facto concurrent). I say this to you
so that you are not badly burned if you are audited (agreeing to
audits is part of the license agreement).

Technical considerations

Printer information is stored in each user's profile, and each
unique profile is only loaded once in memory (per TS). The
current default printer setting as well as tons of other user
specific data is stored in the profile.

Please stop and ponder this for a moment. If more than
one user is logged on at the same time using the same account
they are using the exact same profile. Meaning if one user
sets their default printer to "HP LaserJet" then the other user
or user(s) now have their default printer set to "HP LaserJet".

Each time a user logs on the default printer on the local
machine is set as the default in their TS session. In practice
this means that every time a user logs on or off the default
printer will change for all using that account.

A large number of applications (most?) are not designed to
handle per-user application settings that can be accessed/changed
by multiple concurrent sessions. For example, when the
applications save window position settings, user preferences,
etc., they assume a single user is making/using the change.

The other thing is for a scenario like yours a third-party
universal printer driver is a must. In addition to Thinprint I
recommend you also consider Print-IT and Screwdrivers.

Writing scripts to hide printers is not going to help you. How
can you hide a printer in this case? If you change the security
on the printer so that it is not visible to the user account then
by definition it will also not be visible to *all* the sessions under
the same account.

In similar situations where specific named accounts were not
desired I have created multiple generic user accounts for each
company. For example XYZ01, XYZ02, XYZ03, etc. Each
person is assigned to one of the generic logons. Each logon
is restricted to one session.

Thanks.

-TP

MBN wrote:
> Hi TP,
>
> Thanks for your reply, unfortunately using individual accounts is a
> problem as we provide a service to other companys to 'host' random
> bits of software. What happens is they come to us with a piece of
> software and they buy 30 users of hosting and we provide company XYZ
> with 30 concurrent logins and we do all the backups etc for that
> piece of software.
>
> Apart from confusing the users, its becoming a problem when printers
> arent being removed when people log out. Ive checked all the
> permissions on the registry and I run a printer delete script every
> night, its just that some people log in and out 15 times a day and
> end up with so many printers listed before the script cleans things
> up.
>
> We only install WHQL signed drivers, but it's becoming too
> complicated to manage and we are trying to move to a 3rd party
> solution such as ThinPrint.
>
> I guess that I need to find some way of hiding printers that dont
> belong to that session and to make/steal a script that runs when the
> user logs off that loops through all their printers and deletes them.
> Do you have any ideas that I could use please?
 
Re: Multi-Session Printers?

Hi TP,
Thanks for the advise, I disappeared for a few days :)
The licensing is a concern in that when we first set things up we had a
local Gold MS reseller come over and all they said is that we just needed
the CALS so I might call MS AUS direct to clarify things.

All the problems with the profiles that you mentioned we dont seem to be
having any problems with as they dont have access to change those sorts of
things so at least something seems to be in my favour :)

thank you for all you help!

"TP" <tperson.knowspamn@mailandnews.com> wrote in message
news:uBhUM85JIHA.5684@TK2MSFTNGP06.phx.gbl...
> Hi Murray,
>
> Your current design is flawed and needs to be changed. I realize that may
> not be the answer you were expecting. Below is information to help you
> decide what changes to make.
>
> Licensing considerations
>
> There is no concurrent licensing for terminal services. If I understand
> your situation correctly, it falls under the Service Provider Licensing
> Agreement (SPLA). Under this there is only Per User (for TS) and it is
> calculated on a monthly basis. This means you need to have a TS
> Subscriber Access License (SAL) for each person that will use the TS
> during the month, *not* for each concurrent user.
>
> It is not a requirement of the agreement to have a one to one relationship
> between subscribers and user accounts, but it makes sense for compliance
> tracking and technical reasons.
>
> Again the main point of the above is that there is no concurrent model;
> the licenses are for specific people in a specific month. The list of
> people can't shift around from hour to hour or day to day (which would be
> de facto concurrent). I say this to you so that you are not badly burned
> if you are audited (agreeing to audits is part of the license agreement).
>
> Technical considerations
>
> Printer information is stored in each user's profile, and each unique
> profile is only loaded once in memory (per TS). The current default
> printer setting as well as tons of other user specific data is stored in
> the profile.
>
> Please stop and ponder this for a moment. If more than one user is logged
> on at the same time using the same account they are using the exact same
> profile. Meaning if one user sets their default printer to "HP LaserJet"
> then the other user or user(s) now have their default printer set to "HP
> LaserJet".
>
> Each time a user logs on the default printer on the local machine is set
> as the default in their TS session. In practice this means that every
> time a user logs on or off the default printer will change for all using
> that account.
>
> A large number of applications (most?) are not designed to handle per-user
> application settings that can be accessed/changed by multiple concurrent
> sessions. For example, when the applications save window position
> settings, user preferences, etc., they assume a single user is
> making/using the change.
>
> The other thing is for a scenario like yours a third-party universal
> printer driver is a must. In addition to Thinprint I recommend you also
> consider Print-IT and Screwdrivers.
>
> Writing scripts to hide printers is not going to help you. How can you
> hide a printer in this case? If you change the security on the printer so
> that it is not visible to the user account then by definition it will also
> not be visible to *all* the sessions under the same account.
>
> In similar situations where specific named accounts were not desired I
> have created multiple generic user accounts for each company. For example
> XYZ01, XYZ02, XYZ03, etc. Each person is assigned to one of the generic
> logons. Each logon is restricted to one session.
>
> Thanks.
>
> -TP
>
> MBN wrote:
>> Hi TP,
>>
>> Thanks for your reply, unfortunately using individual accounts is a
>> problem as we provide a service to other companys to 'host' random
>> bits of software. What happens is they come to us with a piece of
>> software and they buy 30 users of hosting and we provide company XYZ
>> with 30 concurrent logins and we do all the backups etc for that
>> piece of software. Apart from confusing the users, its becoming a problem
>> when printers
>> arent being removed when people log out. Ive checked all the
>> permissions on the registry and I run a printer delete script every
>> night, its just that some people log in and out 15 times a day and
>> end up with so many printers listed before the script cleans things
>> up. We only install WHQL signed drivers, but it's becoming too
>> complicated to manage and we are trying to move to a 3rd party
>> solution such as ThinPrint. I guess that I need to find some way of
>> hiding printers that dont
>> belong to that session and to make/steal a script that runs when the
>> user logs off that loops through all their printers and deletes them.
>> Do you have any ideas that I could use please?
 
Back
Top