Another printer question... - Tilted Forum Project Discussion Community

spived2 · 05-07-2005, 03:13 AM

Where I work we have win2k3 running and all the users on the site log in through active directory. One section of our site runs on a different network because of doctor patient confidentiality, so they are connected to the net through us but run on their own workgroup off a router and pnat.
Anyways, one of the computers behind their router IS connected to us through the domain, but they need to have that computer be able to print off a printer that is running off a computer that's on the work group. (I know it's a little confusing, sorry)
The problem is that the users have to manually connect to the printer everytime they log on. When they log off and back on again, it loses that connection and says access denied.

Now for my question: Is there a startup script or something that will allow the computer on the domain to automatically connect to the printer that is off the domain? I'm pretty unfimiliar with startup scripts in group policy, and I couldn't find anything on google that seemed to help. Also, it seems that in order to connect to the printer you have to put in the admin username/password, is there also a script to automatically do that as well?

Any help will be greatly appreciated, that way that unit won't have to buy a brand new printer just for one computer and ease of use. Thanks

-Mack

boober · 05-07-2005, 08:34 AM

hi Mack. You may want to try adding the username/password of the user in question to the machine that hosts the workgroup printer. That will probabl solve the issue of having to use the admin account. But you may still need to use a login script create a mapping to let the two machines 'authenticate'. I *think* a printer mapping will fail even if the username and pass are correct when dealing with a domain member trying to access a workgroup machine. Honestly can't remember since I deal with 100% domain members and servers.

What I've done to force authentication between domain members and workgroup machines in the past, is make sure the workgroup machine has the same U/P of the user logged into the domain member, then create a dummy share on the workgroup machine. It can be whatever. On the domain member, do a NET USE * \\WORKGROUPMACHINE\SHARE. THen try to print. Should work. If that works, you can make that drive mapping persistent by adding /PERSISTENT:YES to the end. Added benefit of using persistent is that upon reboot, if it runs into a credentials problem, but the usernames match, it'll ask you for the password. [edit: the other option is to use a GPO login script or regular login script with the same NET USE command but without the persistent switch...but i can't remember if it'll fail if it can't match up the credentials]

Ideally however, I would suggest you get away from using a workgroup in a corporate environment. I would create a new domain within the forest for the members of your 'sensitive' group. Domains are fairly good security boundaries and while keeping your data secure, will also give those members access to other forest resources. If you're *really* paranoid, you can set up another forest and trust the two. Integrating the workgroup into the/a forest will give you thea bility to provide central management to the workstations, implement Exchange, etc.

spived2 · 05-08-2005, 01:10 AM

Hey boober, thanks for the advice, I'll give those options a try.

I would set them up on a different domain, but we don't have the resources to do such a thing here atm. It's only 8 machines that are on the workgroup, and they're protected behind our network, but they just dont want our net/sys admins having access to their sensitive materials.

BTW, it's not a corporate enviroment

this is a military network, we just use a lot of the same equipment and software as our civilian counterparts.

05-07-2005, 03:13 AM	#1 (permalink)
spived2 Desert Rat Location: Arizona	Another printer question... Where I work we have win2k3 running and all the users on the site log in through active directory. One section of our site runs on a different network because of doctor patient confidentiality, so they are connected to the net through us but run on their own workgroup off a router and pnat. Anyways, one of the computers behind their router IS connected to us through the domain, but they need to have that computer be able to print off a printer that is running off a computer that's on the work group. (I know it's a little confusing, sorry) The problem is that the users have to manually connect to the printer everytime they log on. When they log off and back on again, it loses that connection and says access denied. Now for my question: Is there a startup script or something that will allow the computer on the domain to automatically connect to the printer that is off the domain? I'm pretty unfimiliar with startup scripts in group policy, and I couldn't find anything on google that seemed to help. Also, it seems that in order to connect to the printer you have to put in the admin username/password, is there also a script to automatically do that as well? Any help will be greatly appreciated, that way that unit won't have to buy a brand new printer just for one computer and ease of use. Thanks -Mack __________________ "This visage, no mere veneer of vanity, is it vestige of the vox populi, now vacant, vanished, as the once vital voice of the verisimilitude now venerates what they once vilified. However, this valorous visitation of a by-gone vexation, stands vivified, and has vowed to vanquish these venal and virulent vermin vanguarding vice and vouchsafing the violently vicious and voracious violation of volition. The only verdict is vengeance; a vendetta, held as a votive, not in vain, for the value and veracity of such shall one day vindicate the vigilant and the virtuous. Verily, this vichyssoise of verbiage veers most verbose vis-à-vis an introduction, and so it is my very good honor to meet you and you may call me V." - V

05-08-2005, 01:10 AM	#3 (permalink)
spived2 Desert Rat Location: Arizona	Hey boober, thanks for the advice, I'll give those options a try. I would set them up on a different domain, but we don't have the resources to do such a thing here atm. It's only 8 machines that are on the workgroup, and they're protected behind our network, but they just dont want our net/sys admins having access to their sensitive materials. BTW, it's not a corporate enviroment this is a military network, we just use a lot of the same equipment and software as our civilian counterparts. __________________ "This visage, no mere veneer of vanity, is it vestige of the vox populi, now vacant, vanished, as the once vital voice of the verisimilitude now venerates what they once vilified. However, this valorous visitation of a by-gone vexation, stands vivified, and has vowed to vanquish these venal and virulent vermin vanguarding vice and vouchsafing the violently vicious and voracious violation of volition. The only verdict is vengeance; a vendetta, held as a votive, not in vain, for the value and veracity of such shall one day vindicate the vigilant and the virtuous. Verily, this vichyssoise of verbiage veers most verbose vis-à-vis an introduction, and so it is my very good honor to meet you and you may call me V." - V

05-07-2005, 08:34 AM	#2 (permalink)
boober Crazy Location: Western Cananananda	hi Mack. You may want to try adding the username/password of the user in question to the machine that hosts the workgroup printer. That will probabl solve the issue of having to use the admin account. But you may still need to use a login script create a mapping to let the two machines 'authenticate'. I think a printer mapping will fail even if the username and pass are correct when dealing with a domain member trying to access a workgroup machine. Honestly can't remember since I deal with 100% domain members and servers. What I've done to force authentication between domain members and workgroup machines in the past, is make sure the workgroup machine has the same U/P of the user logged into the domain member, then create a dummy share on the workgroup machine. It can be whatever. On the domain member, do a NET USE * \\WORKGROUPMACHINE\SHARE. THen try to print. Should work. If that works, you can make that drive mapping persistent by adding /PERSISTENT:YES to the end. Added benefit of using persistent is that upon reboot, if it runs into a credentials problem, but the usernames match, it'll ask you for the password. [edit: the other option is to use a GPO login script or regular login script with the same NET USE command but without the persistent switch...but i can't remember if it'll fail if it can't match up the credentials] Ideally however, I would suggest you get away from using a workgroup in a corporate environment. I would create a new domain within the forest for the members of your 'sensitive' group. Domains are fairly good security boundaries and while keeping your data secure, will also give those members access to other forest resources. If you're really paranoid, you can set up another forest and trust the two. Integrating the workgroup into the/a forest will give you thea bility to provide central management to the workstations, implement Exchange, etc.