Is there a way to allow standard users to restart (stop/start) the Print Spooler?

For some reason, multiple laptops on our wifi network often lose the ability to print to a device attached to a server on the network. Restarting the Print Spooler on each laptop fixes the issue. However, restarting the Windows Print Spooler service (via either services.msc or via the net start/stop command) requires administrative privileges.

Is there a way to allow standard users to restart their local print spooler service without requiring elevation or administrative privileges? For example, via a policy change?

sean e

Posted 2012-05-01T15:35:55.487

Reputation: 2 471

try secpol.msc local security policy i beleive they changed the shortcut in Win7/Vista but im sure it would be easyt o find – dc5553 – 2012-05-01T16:16:16.250

The sc command allows you to change the permissions on a service. I believe the options are sdshow and sdset. The SDDL syntax is documented here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa379570%28v=vs.85%29.aspx

– Harry Johnston – 2012-05-02T02:35:40.817

sc sdshow spooler shows service permissions. Need to decipher SDDL syntax to make changes. – sean e – 2012-05-02T15:05:26.320

Answers

I ended up using Method 3 at How to grant users rights to manage services in Windows 2000.

Download and install SubInACL.exe
run "C:\Program Files\Windows Resource Kits\Tools\subinacl" /service Spooler /grant=<username>=TO

SubInACL works on Windows 7.

The T grant parameter is for start service access and the O parameter is stop service access.

Now <username> can:

run sc stop Spooler and sc start Spooler
run net stop "Print Spooler" and net start "Print Spooler"
use the Restart button on the Print Spooler item in services.msc

sean e

Posted 2012-05-01T15:35:55.487

Reputation: 2 471

1Awesome. As an admin, I've been remoting to a user's PC to do this over and over and over and... but no more, thanks to you! – ThisClark – 2015-03-10T16:14:30.873

Whoops... when I tried this (elevated) for the service MySQL I got "MySQL - OpenService Error : 5 Access is denied" – mike rodent – 2016-03-14T21:16:54.103

This does not work. It makes no difference. Standard users still get System error 5 has occurred and Access is denied. I'm running Windows 10 though. – Gary S. – 2017-11-05T12:16:14.887

1I simplified it by granting access to the group "everyone" and it worked great, including on Windows 10. Note: don't include the quotes. – AnthonyVO – 2018-02-14T19:14:33.667

Try: SetACL: Windows ACL management http://sourceforge.net/projects/setacl/

SetACL + GUI = SetACL Studio http://helgeklein.com/setacl-studio/

jkjohn88

Posted 2012-05-01T15:35:55.487

Reputation: 11

Welcome to Super User! This answer doesn't explain how the software solved the user's problem. Compare to the other answer. We have recommendations on our meta site on how to write great software recommendations, please take a look.

– Daniel Beck – 2012-09-28T07:59:31.253

An old blog entry has the correct solution (look under "Allow All Authenticated Users to Restart Service"). Run the following once in an elevated command prompt:

sc sdset Spooler "D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA) (A;;LCRPWP;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY) S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

Replace Spooler with the name of whatever service users need to restart. Use the rest of the line exactly as-is. I don't know what it means, but it works. :-)

After a few seconds, you will see this response:

[SC] SetServiceObjectSecurity SUCCESS

Now all authenticated users can restart the service.

Gary S.

Posted 2012-05-01T15:35:55.487

Reputation: 111