Printing via RDP from W2K8 access denied error

[Roger Vicker]

Environment: single W2K8 server domain (no other server of any size, function
or flavor) and users on XP over a WAN.

The users can connect, work and see their local printers redirected in RDP.
However whenever they print nothing ever arrives at their local printer. The
server's event log shows an 6161 event.

The document Test Page, owned by it, failed to print on printer USERSPRT
(redirected 3). Try to print the document again, or restart the print
spooler.
Data type: RAW. Size of the spool file in bytes: 135341. Number of bytes
printed: 0. Total number of pages in the document: 1. Number of pages
printed: 0. Client computer: \\RDPSERVER01. Win32 error code returned by the
print processor: 5. Access is denied.

Log Name: System
Source: Microsoft-Windows-PrintSpooler
Date: 10/11/2008 8:05:59 PM
Event ID: 6161
Task Category: None
Level: Error
Keywords: Classic
User: RDPDOMAIN\it
Computer: RDPSERVER01.RDPDOMAIN.local
Description:
The document Test Page, owned by it, failed to print on printer USERSPRT
(redirected 3). Try to print the document again, or restart the print
spooler.
Data type: RAW. Size of the spool file in bytes: 135085. Number of bytes
printed: 0. Total number of pages in the document: 1. Number of pages
printed: 0. Client computer: \\RDPSERVER01. Win32 error code returned by the
print processor: 5. Access is denied.

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-PrintSpooler"
Guid="{e4c60dfa-ecc5-4889-b406-e9ddd38463c8}" EventSourceName="Print" />
<EventID Qualifiers="49152">6161</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2008-10-12T01:05:59.000Z" />
<EventRecordID>13799</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>RDPSERVER01.RDPDOMAIN.local</Computer>
<Security UserID="S-1-5-21-937972965-681441152-3252368214-1139" />
</System>
<EventData>
<Data Name="param1">Test Page</Data>
<Data Name="param2">it</Data>
<Data Name="param3">USERSPRT (redirected 3)</Data>
<Data Name="param4">RAW</Data>
<Data Name="param5">135085</Data>
<Data Name="param6">0</Data>
<Data Name="param7">1</Data>
<Data Name="param8">0</Data>
<Data Name="param9">\\RDPSERVER01</Data>
<Data Name="param10">5</Data>
<Data Name="param11">Access is denied.
</Data>
</EventData>
</Event>

This happens even to members of the administrator's group and I have tried
adding an administrator to the Print Operators group without any improvement.

What authority where needs to be granted so the remote users can print?

Thanks

[Vera Noest [MVP]]

The most likely cause for this problem is that you are using a
printer driver which isn't TS compatible.
Have you enabled EasyPrint?

http://blogs.technet.com/askperf/archive/2008/02/17/ws2008-
terminal-services-printing.aspx
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?Um9nZXIgVmlja2Vy?=

Post by Roger Vicker
Environment: single W2K8 server domain (no other server of any
size, function or flavor) and users on XP over a WAN.
The users can connect, work and see their local printers
redirected in RDP. However whenever they print nothing ever
arrives at their local printer. The server's event log shows an
6161 event.
The document Test Page, owned by it, failed to print on printer
USERSPRT (redirected 3). Try to print the document again, or
restart the print spooler.
Data type: RAW. Size of the spool file in bytes: 135341. Number
of bytes printed: 0. Total number of pages in the document: 1.
Number of pages printed: 0. Client computer: \\RDPSERVER01.
Win32 error code returned by the print processor: 5. Access is
denied.
Log Name: System
Source: Microsoft-Windows-PrintSpooler
Date: 10/11/2008 8:05:59 PM
Event ID: 6161
Task Category: None
Level: Error
Keywords: Classic
User: RDPDOMAIN\it
Computer: RDPSERVER01.RDPDOMAIN.local
The document Test Page, owned by it, failed to print on printer
USERSPRT (redirected 3). Try to print the document again, or
restart the print spooler.
Data type: RAW. Size of the spool file in bytes: 135085. Number
of bytes printed: 0. Total number of pages in the document: 1.
Number of pages printed: 0. Client computer: \\RDPSERVER01.
Win32 error code returned by the print processor: 5. Access is
denied.
This happens even to members of the administrator's group and I
have tried adding an administrator to the Print Operators group
without any improvement.
What authority where needs to be granted so the remote users can print?
Thanks

[Roger Vicker]

Easy Print is enabled by default.

I have added the GPO for "Use Terminal Services Easy Print driver first"

Post by Vera Noest [MVP]
The most likely cause for this problem is that you are using a
printer driver which isn't TS compatible.
Have you enabled EasyPrint?
http://blogs.technet.com/askperf/archive/2008/02/17/ws2008-
terminal-services-printing.aspx
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

[Vera Noest [MVP]]

Mmm. And the clients are running .NET 3.0 SP1 or higher?

_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

=?Utf-8?B?Um9nZXIgVmlja2Vy?=

Post by Roger Vicker
Easy Print is enabled by default.
I have added the GPO for "Use Terminal Services Easy Print
driver first"

Post by Vera Noest [MVP]
The most likely cause for this problem is that you are using a
printer driver which isn't TS compatible.
Have you enabled EasyPrint?
http://blogs.technet.com/askperf/archive/2008/02/17/ws2008-
terminal-services-printing.aspx

[Roger Vicker]

Yep. And in at least one case all the patches since that.

It sure looks like something going on in the server because it is the one
logging the access denied 6161.

I have seen some posts about "domain users" authority to the Spooler folder
but this is W2K8.

Post by Vera Noest [MVP]
Mmm. And the clients are running .NET 3.0 SP1 or higher?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
=?Utf-8?B?Um9nZXIgVmlja2Vy?=

Post by Roger Vicker
Easy Print is enabled by default.
I have added the GPO for "Use Terminal Services Easy Print
driver first"

Post by Vera Noest [MVP]
The most likely cause for this problem is that you are using a
printer driver which isn't TS compatible.
Have you enabled EasyPrint?
http://blogs.technet.com/askperf/archive/2008/02/17/ws2008-
terminal-services-printing.aspx

[Daniel Havlín]

Do you finally solve this problem?

I am in "the same" situation. I do not belive, that it could be because of
uncompatible driver, I have several printers installed on my client station
(Vista Bus. x64 SP1), my every printers I can see maped on W2K8 Server x64
using Terminal Services Easy Print when I am connected via RDP. But if I try
to print something, it looks like everything is OK, but nothing is printed.
In the LOG is the message below. :-(

Please help!

Thank you
Daniel

Post by Roger Vicker
Yep. And in at least one case all the patches since that.
It sure looks like something going on in the server because it is the one
logging the access denied 6161.
I have seen some posts about "domain users" authority to the Spooler folder
but this is W2K8.

Post by Vera Noest [MVP]
Mmm. And the clients are running .NET 3.0 SP1 or higher?
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
TS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___
=?Utf-8?B?Um9nZXIgVmlja2Vy?=

Post by Roger Vicker
Easy Print is enabled by default.
I have added the GPO for "Use Terminal Services Easy Print
driver first"

Post by Vera Noest [MVP]
The most likely cause for this problem is that you are using a
printer driver which isn't TS compatible.
Have you enabled EasyPrint?
http://blogs.technet.com/askperf/archive/2008/02/17/ws2008-
terminal-services-printing.aspx

[Roger Vicker]

While getting ready to dump Easy Print Driver I found a document that matched
2008 more closely. It recommended to grant the Users group full access to
%windir%\system32\spool and remembering the bad documentation on getting the
remote users able to signon I also add the Terminal Services Users group. The
grand did error with an "Access Denied" on the Tools sub-folder.

Now they can print but they get an error pop-up after each and every report.
They are all XP SP3.

Microsoft has known about the error pop-up since June and that it is a .Net
error. They say that we will have to wait until some future service pack to
see it fixed.

Post by Daniel Havlín
Do you finally solve this problem?
I am in "the same" situation. I do not belive, that it could be because of
uncompatible driver, I have several printers installed on my client station
(Vista Bus. x64 SP1), my every printers I can see maped on W2K8 Server x64
using Terminal Services Easy Print when I am connected via RDP. But if I try
to print something, it looks like everything is OK, but nothing is printed.
In the LOG is the message below. :-(
Please help!
Thank you
Daniel

[Daniel Havlín]

Eh, maybe this is my problem - I have no spool direcoty under
%windir%\system32\ ? How it comes? Should I create the directory manually or
should it be done automatically by installing of something else?

Daniel

Post by Roger Vicker
While getting ready to dump Easy Print Driver I found a document that matched
2008 more closely. It recommended to grant the Users group full access to
%windir%\system32\spool and remembering the bad documentation on getting the
remote users able to signon I also add the Terminal Services Users group. The
grand did error with an "Access Denied" on the Tools sub-folder.
Now they can print but they get an error pop-up after each and every report.
They are all XP SP3.
Microsoft has known about the error pop-up since June and that it is a .Net
error. They say that we will have to wait until some future service pack to
see it fixed.

Post by Daniel Havlín
Do you finally solve this problem?
I am in "the same" situation. I do not belive, that it could be because of
uncompatible driver, I have several printers installed on my client station
(Vista Bus. x64 SP1), my every printers I can see maped on W2K8 Server x64
using Terminal Services Easy Print when I am connected via RDP. But if I try
to print something, it looks like everything is OK, but nothing is printed.
In the LOG is the message below. :-(
Please help!
Thank you
Daniel

[Daniel Havlín]

Sorry.. my fault..of course I have the spool :-) Your recomendation is
working, I can print! :-) Is this normal sollution of the problem to change
the rights to the spool dir? Should it be done by some standard tool during
installation of Terminal Services?

Daniel

Post by Roger Vicker
While getting ready to dump Easy Print Driver I found a document that matched
2008 more closely. It recommended to grant the Users group full access to
%windir%\system32\spool and remembering the bad documentation on getting the
remote users able to signon I also add the Terminal Services Users group. The
grand did error with an "Access Denied" on the Tools sub-folder.
Now they can print but they get an error pop-up after each and every report.
They are all XP SP3.
Microsoft has known about the error pop-up since June and that it is a .Net
error. They say that we will have to wait until some future service pack to
see it fixed.

Post by Daniel Havlín
Do you finally solve this problem?
I am in "the same" situation. I do not belive, that it could be because of
uncompatible driver, I have several printers installed on my client station
(Vista Bus. x64 SP1), my every printers I can see maped on W2K8 Server x64
using Terminal Services Easy Print when I am connected via RDP. But if I try
to print something, it looks like everything is OK, but nothing is printed.
In the LOG is the message below. :-(
Please help!
Thank you
Daniel

[Roger Vicker]

It appears to be SOP as there are several articles on the web that indicate
some form of granting authority for TS printing whether using Easy Print or
model specific print drivers.

Now if Microsoft would just release the .Net fix (looks like over 6 months
so far) so the client error doesn't show up...

Post by Daniel Havlín
Sorry.. my fault..of course I have the spool :-) Your recomendation is
working, I can print! :-) Is this normal sollution of the problem to change
the rights to the spool dir? Should it be done by some standard tool during
installation of Terminal Services?
Daniel

Post by Roger Vicker
While getting ready to dump Easy Print Driver I found a document that matched
2008 more closely. It recommended to grant the Users group full access to
%windir%\system32\spool and remembering the bad documentation on getting the
remote users able to signon I also add the Terminal Services Users group. The
grand did error with an "Access Denied" on the Tools sub-folder.
Now they can print but they get an error pop-up after each and every report.
They are all XP SP3.
Microsoft has known about the error pop-up since June and that it is a .Net
error. They say that we will have to wait until some future service pack to
see it fixed.

Post by Daniel Havlín
Do you finally solve this problem?
I am in "the same" situation. I do not belive, that it could be because of
uncompatible driver, I have several printers installed on my client station
(Vista Bus. x64 SP1), my every printers I can see maped on W2K8 Server x64
using Terminal Services Easy Print when I am connected via RDP. But if I try
to print something, it looks like everything is OK, but nothing is printed.
In the LOG is the message below. :-(
Please help!
Thank you
Daniel

[isc28240]

Hi, guys
I have a very similar problem in my environment:

1 Win 2008 Srv std with latest patches
30 Win Vista Business SP1 and .Net framework 3.5 and latest patches

Clients use our terminal server trought a WAN.

When I log on my ts session, printers are redirected with easy print driver
and I can see their properties, but when I try to print, jobs never come out
of the printer.

Windows logs this error every time I try to print:

Log Name: System
Source: Microsoft-Windows-PrintSpooler
Date: 25/11/2008 18:15:48
Event ID: 6161
Task Category: None
Level: Error
Keywords: Classic
User: cycom\administrador
Computer: server.cycom.local
Description:
The document Test Page, owned by it, failed to print on printer hp1012
(redirected 1). Try to print the document again, or restart the print
spooler.
Data type: RAW. Size of the spool file in bytes: 125089. Number of bytes
printed: 0. Total number of pages in the document: 1. Number of pages
printed: 0. Client computer: \\cintron. Win32 error code returned by the
print processor: 5. Access is denied.

This is happenning even with the administrator acount. I tried to give full
permisions on spool directory to domain users, remote desktop users and even
to alone users and nothing, they can't print anything.


The printers work just fine locally , I cand send test pages and word and
excel files. The problem is when I am inside my TS session.

The funny thing is that if I change the GPO to use real drivers instead of
the easy print driver, I can use some printers but we have some very cheap
printers and I know that is not a very good idea to load these drivers in the
server

Sorry about my english, I am Mexican and I don't have many oportunities to
practice it.

Any help is welcome.
Thanks in advance .

[Roger Vicker]

No excuses for the English. You did very well.

I had the same exact problem, as posted earlier. As posted earlier, I got it
fixed by granting "FULL" authority to the Spool folder (and all sub-folders)
for the OU/Group that the remote users belong to. It took a couple of tries
with different Groups but it eventually worked. I don't remember if it took a
reboot of the server or not.

Probably not related but the clients were all XP Pro and fully patched.

Post by isc28240
Hi, guys
1 Win 2008 Srv std with latest patches
30 Win Vista Business SP1 and .Net framework 3.5 and latest patches
Clients use our terminal server trought a WAN.
When I log on my ts session, printers are redirected with easy print driver
and I can see their properties, but when I try to print, jobs never come out
of the printer.
Log Name: System
Source: Microsoft-Windows-PrintSpooler
Date: 25/11/2008 18:15:48
Event ID: 6161
Task Category: None
Level: Error
Keywords: Classic
User: cycom\administrador
Computer: server.cycom.local
The document Test Page, owned by it, failed to print on printer hp1012
(redirected 1). Try to print the document again, or restart the print
spooler.
Data type: RAW. Size of the spool file in bytes: 125089. Number of bytes
printed: 0. Total number of pages in the document: 1. Number of pages
printed: 0. Client computer: \\cintron. Win32 error code returned by the
print processor: 5. Access is denied.
This is happenning even with the administrator acount. I tried to give full
permisions on spool directory to domain users, remote desktop users and even
to alone users and nothing, they can't print anything.
The printers work just fine locally , I cand send test pages and word and
excel files. The problem is when I am inside my TS session.
The funny thing is that if I change the GPO to use real drivers instead of
the easy print driver, I can use some printers but we have some very cheap
printers and I know that is not a very good idea to load these drivers in the
server
Sorry about my english, I am Mexican and I don't have many oportunities to
practice it.
Any help is welcome.
Thanks in advance .