5

For some reason, multiple laptops on our wifi network often lose the ability to print to a device attached to a server on the network. Restarting the Print Spooler on each laptop fixes the issue. However, restarting the Windows Print Spooler service (via either services.msc or via the net start/stop command) requires administrative privileges.

Is there a way to allow standard users to restart their local print spooler service without requiring elevation or administrative privileges? For example, via a policy change?

|improve this question
  • try secpol.msc local security policy i beleive they changed the shortcut in Win7/Vista but im sure it would be easyt o find – dc5553 May 1 '12 at 16:16
  • The sc command allows you to change the permissions on a service. I believe the options are sdshow and sdset. The SDDL syntax is documented here: msdn.microsoft.com/en-us/library/windows/desktop/… – Harry Johnston May 2 '12 at 2:35
  • sc sdshow spooler shows service permissions. Need to decipher SDDL syntax to make changes. – sean e May 2 '12 at 15:05
12

I ended up using Method 3 at How to grant users rights to manage services in Windows 2000.

  1. Download and install SubInACL.exe
  2. run "C:\Program Files\Windows Resource Kits\Tools\subinacl" /service Spooler /grant=<username>=TO

SubInACL works on Windows 7.

The T grant parameter is for start service access and the O parameter is stop service access.

Now <username> can:

  • run sc stop Spooler and sc start Spooler
  • run net stop "Print Spooler" and net start "Print Spooler"
  • use the Restart button on the Print Spooler item in services.msc
|improve this answer
  • 1
    Awesome. As an admin, I've been remoting to a user's PC to do this over and over and over and... but no more, thanks to you! – ThisClark Mar 10 '15 at 16:14
  • Whoops... when I tried this (elevated) for the service MySQL I got "MySQL - OpenService Error : 5 Access is denied" – mike rodent Mar 14 '16 at 21:16
  • This does not work. It makes no difference. Standard users still get System error 5 has occurred and Access is denied. I'm running Windows 10 though. – Gary S. Nov 5 '17 at 12:16
  • 1
    I simplified it by granting access to the group "everyone" and it worked great, including on Windows 10. Note: don't include the quotes. – AnthonyVO Feb 14 '18 at 19:14
1

Try: SetACL: Windows ACL management http://sourceforge.net/projects/setacl/

SetACL + GUI = SetACL Studio http://helgeklein.com/setacl-studio/

|improve this answer
0

An old blog entry has the correct solution (look under "Allow All Authenticated Users to Restart Service"). Run the following once in an elevated command prompt:

sc sdset Spooler "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA) (A;;LCRPWP;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

Replace Spooler with the name of whatever service users need to restart. Use the rest of the line exactly as-is. I don't know what it means, but it works. :-)

After a few seconds, you will see this response:

[SC] SetServiceObjectSecurity SUCCESS

Now all authenticated users can restart the service.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.