A policy if in effect on your computer which prevents you from connecting to this print queue.

[Jan Hugo Prins]

Hello,

We are currently migrating our complete printer environment to a
printcluster with windows 2003 R2. We installed serveral of our printers
on this cluster but when some users try to connect to these queue's the
get the error message:

A policy if in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator.

This is happening with some of the queue's, absolutly not all of them and
with some of the users. A lot of the users don't have any problems.

We don't have the point and Print Restriction policy in our policy
settings and when I run the tool to find the result of the policies for a
user on a computer I can't find anything that has anything to do with
restrictions to install or connect to printers.

The printers are all configured with the latest PCL6 drivers from HP.
They all use IP 9100 printing.
All printers are set for everyone print and creator / owner manage
documents.

The printers are all installed on the server with a VB script but this
shouldn't be a problem.

Doe anyone have any idea what could cause this problem?

Greetings,
Jan Hugo Prins

[Alan Morris [MSFT]]

Enable kerberos on the cluster net name parameter.

Or disable Point and Print restrictions. If it is not configured it is
enabled.

Or deploy a script to install the driver on the client machines.

The printers that work have inbox drivers or the driver is already installed
on the client. You can verify this, if you have a working client to a non
inbox shared printer. Delete the connection, then delete the driver (As
admin). When the user attempts to make the connection again, they will get
the prompt.
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/default.aspx?scid=fh;[ln];kbhowto

This posting is provided "AS IS" with no warranties, and confers no rights.

Post by Jan Hugo Prins
Hello,
We are currently migrating our complete printer environment to a
printcluster with windows 2003 R2. We installed serveral of our printers
on this cluster but when some users try to connect to these queue's the
A policy if in effect on your computer which prevents you from connecting
to this print queue. Please contact your system administrator.
This is happening with some of the queue's, absolutly not all of them and
with some of the users. A lot of the users don't have any problems.
We don't have the point and Print Restriction policy in our policy
settings and when I run the tool to find the result of the policies for a
user on a computer I can't find anything that has anything to do with
restrictions to install or connect to printers.
The printers are all configured with the latest PCL6 drivers from HP.
They all use IP 9100 printing.
All printers are set for everyone print and creator / owner manage
documents.
The printers are all installed on the server with a VB script but this
shouldn't be a problem.
Doe anyone have any idea what could cause this problem?
Greetings,
Jan Hugo Prins

[Jan Hugo Prins]

Post by Alan Morris [MSFT]
Enable kerberos on the cluster net name parameter.

If your second point is indeed true, which I don't doubt offcourse, then
this could indeed fix the problem.

Post by Alan Morris [MSFT]
Or disable Point and Print restrictions. If it is not configured it is
enabled.

So what you are actually saying is that with the introduction of this new
policy setting it is also authomaticly enabled, if not explicitly disabled
by the policy of the site.

Post by Alan Morris [MSFT]
Or deploy a script to install the driver on the client machines.

Not an option.

Post by Alan Morris [MSFT]
The printers that work have inbox drivers or the driver is already installed
on the client.

This was what I also found out.

Post by Alan Morris [MSFT]
You can verify this, if you have a working client to a non
inbox shared printer. Delete the connection, then delete the driver (As
admin). When the user attempts to make the connection again, they will get
the prompt.

During testing this earlier today got some very strange contradicting
results but this could be because the policy setting is not set, though
the key's are there on some systems.

I have set the kerberos authentication on the name properties of the
cluster resources. Will test tomorrow with some users what the results are
of this.

Have to take some closer look into this because today I heard that
corporate IT is going to disable NTLM authentication on the DC's, and for
we have more clusters that don't have kerberos authentication enabled
on the name objects of the virtual resources this could mean we have
some more changes ahead of us.

Jan Hugo Prins

[Jan Hugo Prins]

Post by Alan Morris [MSFT]
Enable kerberos on the cluster net name parameter.

Thanks a lot, this was indeed the sollution. Works like a charm now.
Everyone can connect to the printers.

Greetings,
Jan Hugo Prins