Printer can be installed only as admin user on windows 10 ?

[BSajovic]

We have a problem installing printers on Windows 10 (error 10060) if we try to install printer as normal user.

I narrowed problem to communication problem on iprint client's side. Tried to install (or even only communicate with server) using iprntcmd commnad line.

As user who is member of domain admins, normal comand prompt :
iprntcmd -v print.domain.com

Could not get Version information for server print.domain.com
Winsock 10060 - connection has timed out

As the same user, elevated (run as admin) command prompt:
iprntcmd -v print.domain.com

Version information for server print.domain.com.
system: Linux
release: 3.0.101-108.68-default
version: #1 SMP Mon Aug 13 18:53:23 UTC 2018 (ef94234)
revision:
machine: x86_64
node: server-name
domain name:
iPrint server version: 3.0.2
iPrint authentication: LDAP_DN (contextless or LDAP typed name with context)
Example user: user or CN=user,OU=provo,O=novell

telnet to 631 CONNECTS!!! in both cases, so it is not port blocked ...

iPrint client is 6.15

Any idea anyone ?

[BSajovic]

Mysterious;2486655 wrote:

server version can only be queried by the user added as printmanager acl
in imanager

Wrong.

iprntcmd -v <IP-of-server>

returns server version from my user on my notebook that has nothing to do with customer's environment (except being VPN connected to their network.

Same command from their W10 station returns winsock error 10060

also iprntcmd -a <iprinter> ends the same way.
(with AllowUserPrinters=3 or AllowUserPrinters=2 ) with machine restart in between.

[Anonymous_User]

On 30-08-18 12:44, BSajovic wrote:
>
> Mysterious;2486655 Wrote:
>>
>> server version can only be queried by the user added as printmanager
>> acl
>> in imanager
>
> Wrong.
>
> iprntcmd -v <IP-of-server>
>
> returns server version from my user on my notebook that has nothing to
> do with customer's environment (except being VPN connected to their
> network.

ops my fault , i read iprntman 🙂


> Same command from their W10 station returns winsock error 10060
>
> also iprntcmd -a <iprinter> ends the same way.
> (with AllowUserPrinters=3 or AllowUserPrinters=2 ) with machine restart
> in between.
>
>

Again, ipp trace will show why the error is coming

[BSajovic]

Mysterious;2486662 wrote:

Again, ipp trace will show why the error is coming

well, this is interesting.

when I run iprntcmd -v print.domain.com from normal cmd prompt and I get winsock 10060 error I get NO ippTrace.txt in C:\NDPS\Users\username\iprntcmd.exe directory
When I then run it in elevated prompt It appears.

😞

[Anonymous_User]

On 30-08-18 13:14, BSajovic wrote:
>
> Mysterious;2486662 Wrote:
>>
>> Again, ipp trace will show why the error is coming
>
> well, this is interesting.
>
> when I run iprntcmd -v print.domain.com from normal cmd prompt and I get
> winsock 10060 error I get NO ippTrace.txt in
> C:\NDPS\Users\username\iprntcmd.exe directory
> When I then run it in elevated prompt It appears.
>
> 😞
>
>

try to install a printer from the /ipp page when logged in the windows
machine as this user and see if it is then created. If not, it may be a
GPO or something similar limiting the rights of this user in the
windows machine.

[BSajovic]

Mysterious;2486664 wrote:
On 30-08-18 13:14, BSajovic wrote:
> well, this is interesting.
>
> when I run iprntcmd -v print.domain.com from normal cmd prompt and I get
> winsock 10060 error I get NO ippTrace.txt in
> C:\NDPS\Users\username\iprntcmd.exe directory
> When I then run it in elevated prompt It appears.
>
> 😞
>
>

Ok. Solved.
It was a case of misleading error message.
winsock 10060 usually means that there is no communication with server, like there was timeout or something like that.

I decided to take sysinternals processmonitor and took look at activity running iprntcmd -v print.domain.com as normal cmd promt and as "run as admin" prompt.

"Normal" user gets Access denied while reading HKLM\software\Novell-iPrint key from registry. process continues, but then decides that it got no response from server and throws out 10060 error. Looks like there is not "error trap" before this error. Nobody thought it is possible to have problems before communication with server ?

After adding rights for "authenticated users" to registry key everything started to work smoothly.