Printer permissions using local groups RRS feed

  • Question

  • Hi all,

    I hope that this isn't a stupid question and I'm sure it's going to repeat a question someone else has asked, but I did search first and couldn't find a definitive answer.

    We have a 2008R2 server and have setup some network printers.

    In the main local administrator group on the server, I have added a domain security group that 6 of us are members of.

    I have granted the local administrator group FULL rights to the printers.

    None of the 6 users from the domain group have rights over the printer!

    If I check effective permissions on one of the printers, the domain group does not have any rights over the printer. However, when I check the effective permissions of one of the users in the domain group, they have FULL rights! Obviously with the domain group not having rights, the user therefore does not have rights.

    If I add the domain group directly in to the printer security rights, the 6 users have full rights again, but we want to use local groups to secure the printers.

    I must have missed something obvious, but this is how I had it working on 2003 servers in the past.

    Thanks in advance,


    Friday, November 18, 2011 11:15 AM


All replies

  • That's the way Microsoft IT has set this up but did not change any of the security of individual printers since machine\administrators has admin rights with the default setting

    Here's some addition information on printer security changes in 2008 R2.  http://technet.microsoft.com/en-us/library/ee524015(WS.10).aspx

    Alan Morris Windows Printing Team
    • Marked as answer by Bruce-Liu Tuesday, November 29, 2011 4:04 PM
    Friday, November 18, 2011 8:30 PM
  • @Alan: I have two questions about W2K8R2 printer server security:

    1. Is there a way to inherit the security rights set at server-level to the already installed printers - perhaps through PowerShell?
    2. Is there a Group Policy settings to be able to change the print server security of already installed W2K8R2 printer servers?

    Thanks in advance!

    Monday, November 21, 2011 9:39 AM
  • 1)  Not a way to inherit, but you can configure existing printers using the setprinter.exe tool from the 2003 Windows resource kit.

    2)  There are no policies for this configuration setting

    Resource kit tools: http://www.microsoft.com/download/en/details.aspx?DisplayLang=en&id=17657

    some instructions using setprinter.  It seems to be easier to perform this from a remote machine http://www.tech-archive.net/Archive/Win2000/microsoft.public.win2000.printing/2006-02/msg00019.html


    Alan Morris Windows Printing Team
    • Marked as answer by Bruce-Liu Tuesday, November 29, 2011 4:04 PM
    Monday, November 21, 2011 7:58 PM