Lets say my domain is structured as follows:
For the computers:
DOMAIN\North\Computers\OU1\PC1
DOMAIN\North\Computers\OU1\PC2
DOMAIN\North\Computers\OU1\PC2
.
.
.
DOMAIN\North\Computers\OU1\PCN
DOMAIN\North\Computers\OU2\PC1
DOMAIN\North\Computers\OU2\PC2
DOMAIN\North\Computers\OU2\PC2
For the Users:
DOMAIN\North\Staff\User
DOMAIN\North\Sales\User
DOMAIN\North\Marketing\User
There are different areas (North, South, East, West) and different OUs for the PCs. The point is the structure is the same as above no matter where you are. Now I have a print server with shared printers. It is trivial to set permissions so that The North Marketing people can only print to their printer. Is it possible to restrict printer permissions based upon the PC OU?
For example let's pretend there is a shared printer that all the North\OU1 PCs typically print to. I would like someone, no matter if they are vising from the east to be able to authenticate with that printer if and only if they are logged onto a PC that resides in DOMAIN\North\Computers\OU1. If they are on an OU2 PC they should be denied.
I am not allowed to violate the model set above. I am not allowed to add the visiting east staff member to a group in the north.
Print server is Server 2008 if that matters.
Best Answer
Assuming the printers you're talking about are exposed to users as Windows print queues then, no, there isn't functionality in the product to do what you're talking about.
Dynamic Access Control (DAC) is the first object permission system in Windows that allows the client computer to be taken into account in the access control decision, but DAC doesn't apply to print queues.
OUs aren't Seucurity Principals because they don't have Security Identifiers (SIDs). As such, OU "membership" can't be used in security decisions anyway.
There isn't any native functionality in the product I can think of that will do what you want. You'd pretty well have to bolt-on something third-party to make this happen (and even then I'm not coming up with good ideas).
I suppose you could stand up a dedicated print server computer to host the queues for each "area" and use firewall rules to limit the cleint computers computers that can communicate with the file and print sharing service (the "Server" service) on each machine. Seems like a terrible waste of OS licenses.