We have a weird problem with Devices and Printers on a Windows 2012 Server (not R2). Let me introduce the environment, without real names.
We have an AD member server (let's call it Server1) of a domain (let's call it OurDomain), so obviously, OurDomain\Domain Admins group is member of Server1\Administrators group (and double checked). This member server has the RDS role, because some client/server applications run on that server and normal users access those applications. In that server there are a number of locally configured print queues. Each user group has been authorized to use only one print queue, via Security Tab in every print queue. 'Everybody' security object has no rights on these queues, and Server1\Administrators group has admin rights on every queue (all right checked in Security tab). One of the OurDomain\Domain Admins group member has created these print queues, which are connected to TCP/IP ports, each one in a different physical location (branch offices). None of these print queues are shared, so Print Server role is not needed nor installed. These queues are intended solely to print from client/server apps running in Server1. When this administrator creates a queue, an entry is added to the Security tab with his account name and admin rights.
The problem is that, when another member of the OurDomain\Domain Admins group logs into Server1 from a Remote Desktop connection, he/she can't see all these queues. The strange thing is that, as a member of OurDomain\Domain Admins group, he/she is a member of the local Server1\Administrators group, who has admin rights in every print queue. In fact, in the Effective Access Tool, those admin accounts show admin rightsd on every queue. But they still can't see the queues via Remote Desktop. The weurdest thing is that normal users, which are members only of their respective Branch Office group, they can see only the printer they are allowed to see, which is absolutely correct and the intended functionality. So it is like Control panel - Devices and Printers doesn't apply correctly the membership of OurDomain\Domain Admins group to Server1\Administrators group only to render the icons for every print queue. And that's a recent behaviour, because it has been detected recently and the system is running nearly two years without complains about this.
There is no GPO applied to this Server1 affecting printing or user or admin rights.
I googled for a couple of days without positive results.
We have an AD member server (let's call it Server1) of a domain (let's call it OurDomain), so obviously, OurDomain\Domain Admins group is member of Server1\Administrators group (and double checked). This member server has the RDS role, because some client/server applications run on that server and normal users access those applications. In that server there are a number of locally configured print queues. Each user group has been authorized to use only one print queue, via Security Tab in every print queue. 'Everybody' security object has no rights on these queues, and Server1\Administrators group has admin rights on every queue (all right checked in Security tab). One of the OurDomain\Domain Admins group member has created these print queues, which are connected to TCP/IP ports, each one in a different physical location (branch offices). None of these print queues are shared, so Print Server role is not needed nor installed. These queues are intended solely to print from client/server apps running in Server1. When this administrator creates a queue, an entry is added to the Security tab with his account name and admin rights.
The problem is that, when another member of the OurDomain\Domain Admins group logs into Server1 from a Remote Desktop connection, he/she can't see all these queues. The strange thing is that, as a member of OurDomain\Domain Admins group, he/she is a member of the local Server1\Administrators group, who has admin rights in every print queue. In fact, in the Effective Access Tool, those admin accounts show admin rightsd on every queue. But they still can't see the queues via Remote Desktop. The weurdest thing is that normal users, which are members only of their respective Branch Office group, they can see only the printer they are allowed to see, which is absolutely correct and the intended functionality. So it is like Control panel - Devices and Printers doesn't apply correctly the membership of OurDomain\Domain Admins group to Server1\Administrators group only to render the icons for every print queue. And that's a recent behaviour, because it has been detected recently and the system is running nearly two years without complains about this.
There is no GPO applied to this Server1 affecting printing or user or admin rights.
I googled for a couple of days without positive results.