Print Management Console on R2 as the all seeing eye of the datacenter

Since I joined the beta, one of the most used R2-specific feature I was using/testing out was this module. Now that I can use my "management laptop" to keep an eye on "my" datacenter/terminal servers, it's wonderful.

Case in point, we have a bunch of forests on our network and within those forests are a lot of terminal servers with various printer drivers loaded on them.

Sometimes, outside of my control, someone will load a printer driver onto a terminal server that is an older style driver (aka NT 'kernel mode' printer driver). The unfortunate thing about those drivers is that if they don't sanitize/verify the data getting passed to them, it is very easy to take down a terminal server if there is a bug in the driver. Instant blue screens are usually the result because it is running in the kernel context. This is one of the primary reasons (I believe) that these type of drivers were given a 'penalty box' GPO in Windows 2003 and totally eliminated in Longhorn.

If a system seems to be tanking with blue screens, the first thing I would always check is to see if anyone added any older style drivers. You could always browse the '2' directory under %windir%\system32\spool\drivers\w32x86 but a lot of times it would be hard to figure out what file belonged to what driver unless you went mucking around in the .inf files.

The screenshot I'm attaching shows how PMC makes that job easier. I can sort by driver version (aka usermode or kernel mode or newer) and see a list of printers that could be causing the blue screen.

Being able to do that across forests is very handy, but to a certain extent might open up a security issue. It seems by default, Windows 2000 machines let you view all this driver information without any trusts setup between forests. If I were a 'bad guy' and somehow got access to the printer spooler, I could see that a server had an older kernel mode driver and try to send it specially crafted print job that would blue screen the system.

Windows 2003 seems to have default permissions setup so you can't do that sort of cross forest 'information mining'. Perhaps a 'print server permission lockdown tool' would be handy, sort of like the IIS lockdown tool.

Anyway, that is why I really like PMC on my XP laptop and just one possible use of it for people like myself.