Separator pages fail to print and the �Users� group fail to install printer driver from server after applying MS09-022 (KB 961501)

After installing MS09-022 customers may notice that they are no longer able to print Separator pages. This patch makes it mandatory that the separator files be present in C:\Windows\System32 folder or in a folder named \SepFiles which can be present anywhere. For example you can have the .sep files inside E:\SepFiles\*.sep. However even when these two conditions are true you may notice that the separator files are not getting printed.

Additionally, after a Windows Server 2003 based server install MS09-022, users of the "Users" group may not install printer driver for a shared printer from this server to a client computer correctly.

This problem can happen if the Users do not have appropriate permissions to the root drive. For example if the sep files are present under C:\Windows\System32, the users should have "List Folder Contents" permission on the C: drive.

This is because MS09-022 security patch uses a system API GetLongPathName to make sure the separator page is in a secure place., and the API needs to enumerate the path starting from the C:\ root folder to build the long path. So it requires the current user to have the READ permission to the C: \ root folder. Otherwise the API call GetLongPathName will fail with Access Denied.

Add Users group to C: drive or to the drive in which the separator files are stored and give them �List Folder Contents� permission.

1. Open My computer. Right-click the drive to which you want to modify the permissions.
2. Go to the Security tab. Add Users group and assign them List Folder Contents permission and click ok.

If you want to assign a more granular setting, assign the �List Folder / Read data� permissions from the Special permission list (this is the least permission reqd)

1. Open My computer. Right-click the drive to which you want to modify the permissions.
2. Go to the Security tab. Add Users group if it is not listed there.
3. Click on Advanced > Change Permissions.
4. Choose Users group from the list and click Edit
5. Choose "This Folder, subfolders and Files" in the Apply To drop down menu.
6. Select "List Folder / Read data" permission from the Allow list.
7. Click ok