Just looking for some clarification. nw6.5 sp5, zen 7sp1, iprint client 4.20

Printers (and manager/broker) in OU=PRINTCONTAINER.O=TOP
(tree is much more complex and vast, but this is the overall setup)

with zen I can push an iPrint policy to deploy printers. They work fine,
test fine, etc.

Couple hours later, users start receiving login dialogs requiring
authentication on the iprint client. Other users start having printing
failure.. and trying to open the printer properties on Windows will give
you the error stating that the driver is corrupt, etc. Putting in a local
user seems to work. But we have users also installing printers from other
locations in the tree, and those authentications don't work.

If I remove the printer, then install it manually from server/ipp, it works
again for a while.

Because users and printers are not in same container, is this breaking the
ability to print? Do I need to define the User container as being Users
of the iprint printers? I had the understanding that Authentication is
only required if using SSL. The way it is setup, only the parent container
is listed as User, but I wasn't aware that this was required for Low or
Medium security iPrint'ing.