Using a UPS Label Printer with Non-Administrative User Accounts
One of the largest and most popular shipping companies in the United States is United Parcel Service (UPS). They have an extensive website that allows you to enter shipment information, calculate shipping fees, print shipping labels, track package deliveries, and view your shipment history. A nice feature of their website is the ability to print large shipping labels you can stick directly on your packages. It’s a bit complicated to set up, but a big time saver. I ran into a problem though on a Windows system when running on a limited (non-admistrative) user account.
My staff use Dell desktops running Windows XP and I wanted to let any staff member print UPS labels easily from their desk. So I purchased a compatible thermal label printer and attached it to my network through a small print server. I happened to have an older Eltron 2442 laying around and used that (they’re available very inexpensively on eBay). You have to install a special UPS Thermal Printer driver (you don’t use the printer driver from the manufacturer) and you have to install either an ActiveX control (Internet Explorer) or a browser plugin (Firefox). You’ll find the files and instructions here. After installing the drivers, you configure the website to use the label printer by logging into your account and going to the “Set Preferences” page under the “Shipping” menu option. There’s also a handy link to print a sample label.
The Administrative Rights Problem
The process that UPS documents works great if you’re running as an administrator, but doesn’t work if you’re running on a limited user account. To get it to work I found it necessary to log in as an administrator in order to install the UPS Thermal Printer driver and the browser plugin. Then I logged back in as the normal user account and tried to print a test label. This is the error I received:
I tried using a different browser, reinstalling, and many other experiments at this point and exchanged several emails with the UPS support staff but could not get it to work. If I temporarily gave the user account administrative rights it worked fine, so I knew that the drivers and browser helpers were installed correctly. As soon as I dropped the account back to normal user rights, it quit working again. There was obviously an access rights problem.
To track down the problem I used the trusty Process Monitor utility from Microsoft. Process Monitor requires administrative rights so I used the “runas” command to execute the utility while logged on with the limited user account. Process Monitor logs all file and registry activity performed on the system (for any user account) along with the success or failure status of each API call. By capturing only the activity from just before clicking the test link and stopping as soon as the error was displayed, I limited the logging to a somewhat reasonable number of lines – only 30,000 or so! Fortunately it’s easy to apply filters to the display so I excluded all the processes that obviously weren’t involved (like winlogon and lsass) and excluded all API calls that didn’t return an error. Browsing through the list I found a line where a registry read call failed in section of the registry related to the UPS printer.
I turns out that the installation program that created those registry keys give them fairly limited permissions. So I logged in as the administrator and used the “regedit” command to add FULL CONTROL permissions for the EVERYONE group to each of the UPS Thermal Printer registry keys. Note that the keys were created to not inherit permissions from their parent keys, so it’s necessary to change the permissions on all 4 keys separately. Adding permissions for the EVERYONE group was probably a larger hammer than I needed, but I was tired of messing with it and it worked! On my systems, the top registry key involved is “HKEY_LOCAL_MACHINE\SOFTWARE\United Parcel Service”:
After this change, the label printer works fine using the limited user account.
Firefox 3 Label Printing Issue
When I tested printing labels using FireFox 3, I found another problem where I got two copies of each label I tried to print. It didn’t do this under IE so it must be a bug in the UPS FireFox plugin. I worked around this by installing the IETab Firefox extension. This handy extension allows you to specify a list of websites that should be rendered using an embedded copy of IE rather than the normal FireFox rendering engine, and is a great way to deal with any sites that require Internet Explorer (perhaps because they require using an ActiveX control) while using still using FireFox. I added the standard variations on the UPS domain names to the IETab sites list (“http://ups.com/”, “http://www.ups.com/”, “https://ups.com/”, and “https://www.ups.com/”) and it worked great.