1.16. Setting up automatic printer driver downloads for Windows clients on Samba print servers

Procedure

1. For example, to grant the SePrintOperatorPrivilege privilege to the printadmin group:

   # net rpc rights grant "printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator"
   Enter DOMAIN\administrator's password:
   Successfully granted rights.

   참고

   In a domain environment, grant SePrintOperatorPrivilege to a domain group. This enables you to centrally manage the privilege by updating a user’s group membership.

2. To list all users and groups having SePrintOperatorPrivilege granted:

   # net rpc rights list privileges SePrintOperatorPrivilege -U "DOMAIN\administrator"
   Enter administrator's password:
   SePrintOperatorPrivilege:
     BUILTIN\Administrators
     DOMAIN\printadmin

Procedure

1. Add the [print$] section to the /etc/samba/smb.conf file:

   [print$]
           path = /var/lib/samba/drivers/
           read only = no
           write list = printadmin
           force group = printadmin
           create mask = 0664
           directory mask = 2775

   Using these settings:

   • Only members of the printadmin group can upload printer drivers to the share.
   • The group of new created files and directories will be set to printadmin.
   • The permissions of new files will be set to 664.

   • The permissions of new directories will be set to 2775.

     For more information, see Enabling users to upload and preconfigure drivers.

2. To upload only 64-bit drivers for all printers, include this setting in the [global] section in the /etc/samba/smb.conf file:

   spoolss: architecture = Windows x64

   Without this setting, Windows only displays drivers for which you have uploaded at least the 32-bit version.

3. Verify the /etc/samba/smb.conf file:

   # testparm

4. Reload the Samba configuration

   # smbcontrol all reload-config

5. Create the printadmin group if it does not exist:

   # groupadd printadmin

6. Grant the SePrintOperatorPrivilege privilege to the printadmin group.

   # net rpc rights grant "printadmin" SePrintOperatorPrivilege -U "DOMAIN\administrator"
   Enter DOMAIN\administrator's password:
   Successfully granted rights.

7. If you run SELinux in enforcing mode, set the samba_share_t context on the directory:

   # semanage fcontext -a -t samba_share_t "/var/lib/samba/drivers(/.*)?"
   
   # restorecon -Rv /var/lib/samba/drivers/

8. Set the permissions on the /var/lib/samba/drivers/ directory:

   • If you use POSIX ACLs, set:

     # chgrp -R "printadmin" /var/lib/samba/drivers/
     # chmod -R 2775 /var/lib/samba/drivers/

   • If you use Windows ACLs, set:

     Expand

     Principal	Access	Apply to
     CREATOR OWNER	Full control	Subfolders and files only
     Authenticated Users	Read & execute, List folder contents, Read	This folder, subfolders, and files
     printadmin	Full control	This folder, subfolders, and files

     Show more

     For details about setting ACLs on Windows, see the Windows documentation.

Procedure

1. Log into a Windows computer using an account that is allowed to edit group policies, such as the AD domain Administrator user.
2. Open the Group Policy Management Console.

3. Right-click to your AD domain and select Create a GPO in this domain, and Link it here.

   
4. Enter a name for the GPO, such as Legacy Printer Driver Policy and click OK. The new GPO will be displayed under the domain entry.
5. Right-click to the newly-created GPO and select Edit to open the Group Policy Management Editor.

6. Navigate to Computer Configuration Policies Administrative Templates Printers.

   

7. On the right side of the window, double-click Point and Print Restriction to edit the policy:

   1. Enable the policy and set the following options:

      1. Select Users can only point and print to these servers and enter the fully-qualified domain name (FQDN) of the Samba print server to the field next to this option.

      2. In both check boxes under Security Prompts, select Do not show warning or elevation prompt.

         
   2. Click OK.

8. Double-click Package Point and Print - Approved servers to edit the policy:

   1. Enable the policy and click the Show button.

   2. Enter the FQDN of the Samba print server.

      
   3. Close both the Show Contents and the policy’s properties window by clicking OK.
9. Close the Group Policy Management Editor.

10. Close the Group Policy Management Console.

    After the Windows domain members applied the group policy, printer drivers are automatically downloaded from the Samba server when a user connects to a printer.

    For using group policies, see the Windows documentation.