Is there a way to allow standard users to restart (stop/start) the Print Spooler?

Question

For some reason, multiple laptops on our wifi network often lose the ability to print to a device attached to a server on the network. Restarting the Print Spooler on each laptop fixes the issue. However, restarting the Windows Print Spooler service (via either services.msc or via the net start/stop command) requires administrative privileges.

Is there a way to allow standard users to restart their local print spooler service without requiring elevation or administrative privileges? For example, via a policy change?

Answer 1

I ended up using Method 3 at How to grant users rights to manage services in Windows 2000.

1. Download and install SubInACL.exe
2. run "C:\Program Files\Windows Resource Kits\Tools\subinacl" /service Spooler /grant=<username>=TO

SubInACL works on Windows 7.

The T grant parameter is for start service access and the O parameter is stop service access.

Now <username> can:

• run sc stop Spooler and sc start Spooler
• run net stop "Print Spooler" and net start "Print Spooler"
• use the Restart button on the Print Spooler item in services.msc

Answer 2

Try: SetACL: Windows ACL management http://sourceforge.net/projects/setacl/

SetACL + GUI = SetACL Studio http://helgeklein.com/setacl-studio/

Answer 3

An old blog entry has the correct solution (look under "Allow All Authenticated Users to Restart Service"). Run the following once in an elevated command prompt:

sc sdset Spooler "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA) (A;;LCRPWP;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

Replace Spooler with the name of whatever service users need to restart. Use the rest of the line exactly as-is. I don't know what it means, but it works. :-)

After a few seconds, you will see this response:

[SC] SetServiceObjectSecurity SUCCESS

Now all authenticated users can restart the service.

Answer 4

First inspect and document existing default permissions.
From an elevated command prompt, type:

sc.exe sdshow spooler

Results:
D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Key to reading the output:

D: — Discretionary ACL (DACL)
S: — System Access Control List (SACL)

The first letter means; allow (A) or deny (D)

The next set of symbols is assignable permissions:

CC — SERVICE_QUERY_CONFIG (request service settings)
LC — SERVICE_QUERY_STATUS (service status polling)
SW — SERVICE_ENUMERATE_DEPENDENTS
LO — SERVICE_INTERROGATE
CR — SERVICE_USER_DEFINED_CONTROL
RC — READ_CONTROL
RP — SERVICE_START
WP — SERVICE_STOP
DT — SERVICE_PAUSE_CONTINUE

The list of trustees is long, but we are looking for Authenticated Users (AU) which is contained in the first set of parenthesis.

Adding RP, WP, and DT permissions for authenticated users (AU) should do the trick:

(A;;CCLCSWLOCRRCRPWPDT;;;AU)

To set these permissions, again from an elevated command prompt:

sc.exe sdset spooler "D:(A;;CCLCSWLOCRRCRPWPDT;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

To restore permissions to their defaults, effectively removing the ability of authenticated users to start/stop/pause/resume the spooler service:

sc.exe sdset spooler "D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

Much of the credit must be given to IT Connect of University of Washington at https://itconnect.uw.edu/wares/msinf/other-help/understanding-sddl-syntax/