Print Management Console on R2 as the all seeing eye of the datacenter

Since I joined the beta, one of the most used R2-specific feature I was using/testing out was this module. Now that I can use my "management laptop" to keep an eye on "my" datacenter/terminal servers, it's wonderful.

Case in point, we have a bunch of forests on our network and within those forests are a lot of terminal servers with various printer drivers loaded on them.

Sometimes, outside of my control, someone will load a printer driver onto a terminal server that is an older style driver (aka NT 'kernel mode' printer driver). The unfortunate thing about those drivers is that if they don't sanitize/verify the data getting passed to them, it is very easy to take down a terminal server if there is a bug in the driver. Instant blue screens are usually the result because it is running in the kernel context. This is one of the primary reasons (I believe) that these type of drivers were given a 'penalty box' GPO in Windows 2003 and totally eliminated in Longhorn.

If a system seems to be tanking with blue screens, the first thing I would always check is to see if anyone added any older style drivers. You could always browse the '2' directory under %windir%\system32\spool\drivers\w32x86 but a lot of times it would be hard to figure out what file belonged to what driver unless you went mucking around in the .inf files.

The screenshot I'm attaching shows how PMC makes that job easier. I can sort by driver version (aka usermode or kernel mode or newer) and see a list of printers that could be causing the blue screen.

Being able to do that across forests is very handy, but to a certain extent might open up a security issue. It seems by default, Windows 2000 machines let you view all this driver information without any trusts setup between forests. If I were a 'bad guy' and somehow got access to the printer spooler, I could see that a server had an older kernel mode driver and try to send it specially crafted print job that would blue screen the system.

Windows 2003 seems to have default permissions setup so you can't do that sort of cross forest 'information mining'. Perhaps a 'print server permission lockdown tool' would be handy, sort of like the IIS lockdown tool.

Anyway, that is why I really like PMC on my XP laptop and just one possible use of it for people like myself.

Posted by Aaron Tiensivu in Server at 18:06 | Comments (5) | Trackback (1)

16540 hits

Trackbacks

Trackback specific URI for this entry

Print Management Console in Server 2003 R2
Our team is shipping something very important soon - a new Print Management Console as part of Windows...

Weblog: Andy Simonds: XPS and the Digital Documents Team
Tracked: Nov 09, 18:34

Comments

Display comments as (Linear | Threaded)

I looove that you are digging the PMC. We worked on this a long time and hopefully it will make a lot of people's lives better who have to manage printers.

Thanks for the comments,
Andy (microsoft)

#1 Andy Simonds (Homepage) on 2005-11-09 18:09 (Reply)

Andy, I too like the product (I have had it working once on another machine).

It now refuses point blank to work correctly, I am having exactly the same issue as Brian Delaney from an XP Pro SP2 workstation with .NET 2 installed ??

Regards

Eddie.

#1.1 Eddie Priest on 2006-12-07 10:58 (Reply)

I love the idea of PMC, but am having a tough time getting it to work. I can see all of the drivers and ports on a print server fine, but the printers themselves never show up. What am I doing wrong?

#2 Brian Delaney on 2006-06-16 07:52 (Reply)

Oh, this is my exact problem too. It must be a registry thing. I loaded R2 with beta and had this problem. Then later Fdisk'd and reloaded with a normal copy of R2. Everything worked great until a friend fooling around with my hardware crashed my drive. I got a new drive..reloaded and now I can see the drivers on the servers but not the printers. Has anyone got a solution for this.
Jerry

#2.1 Jerry Stone on 2007-04-02 13:56 (Reply)

can one use the PMC on a windows 2003 server that is not R2?

#3 NIK on 2007-12-17 13:26 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	E-Mail addresses will not be displayed and will only be used for E-Mail notifications. Standard emoticons like :-) and ;-) are converted to images.
	Remember Information? Subscribe to this entry