How do i change the user group "everyone" permissions on a local printer using a script? I've been digging around and something's telling me to use ACL using powershell?

1 Answer 1


Please see the below resources and quoted steps for detail on setting printer permissions via command line in Windows (both PowerShell and Batch).

Batch modify printer permissions

If you want to do it with a comand line tool, get subinacl from the Resource Kit:


subinacl /printer <\printer name> /grant=Everyone=F

or by modifying Steve's script:

for /f %a in ('net share ^| find "Spooled"') do subinacl /printer %a /grant=Everyone=F


PowerShell - Add Printer Permission

Windows Server 2012 comes with the PrintManagement module, which makes automation Management of Printers easier. But testing cmdlets like Add-Printer and Set-Printer I noticed that you can set Printer Permission only using the Parameter -PermissionSDDL . These Parameters in both cmdlets expect Printer Permission using Security Definition Description Language (SDDL) which is not what you can type on the command line that easy.

Function Add-LHSPrinterPermissionSDDL 

    ConfirmImpact = 'Low', 
    SupportsShouldProcess = $false 


        HelpMessage='A Security Group or User like "Domain\GroupName" or "Domain\UserName"')] 



    Set-StrictMode -Version Latest 

    ${CmdletName} = $Pscmdlet.MyInvocation.MyCommand.Name 

} # end BEGIN 


        $isContainer = $false 
        $isDS = $false 
        $SecurityDescriptor = New-Object -TypeName ` 
            Security.AccessControl.CommonSecurityDescriptor ` 
            $isContainer, $isDS, $existingSDDL 

        Write-Verbose "Adding Permission for Group $Account" 
        #get the SID for the specified Group and add it to the SDDL 
        $NTAccount = New-Object Security.Principal.NTAccount $Account 
        $NTAccountSid = $NTAccount.Translate([Security.Principal.SecurityIdentifier]).Value 

            268435456, #full control all operations 
            [System.Security.AccessControl.PropagationFlags]::None) | Out-Null 

        return $SecurityDescriptor.GetSddlForm("All") 
    catch [Exception]  
        Write-Error -Message "Failed To Generate SDDL (review inner exception):`n $_.Message" ` 
            -Exception $_.Exception 
} # end PROCESS 

END { Write-Verbose "Function ${CmdletName} finished." } 
} #end Function Add-LHSPrinterPermissionSDDL


Additional Resources

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .