Allowing non-Admin User to Clear and Restart Print Spooler on Windows 2003

Posted on 2007-10-11
Last Modified: 2011-09-20

I have a Windows 2003 AD Domain.

The print queue on one of our printers occasionally gets jammed with a print job. When this happens I must not only delete the job, but I need to restart the print spooler service to clear it out. I want to give this ability to the user in the form of a script.

I have tried using:

sc \\printserver stop spooler

from the user's computer, but I get the following error:

[SC] OpenSCManager FAILED 5:

Access is denied.

I have added the user to the "Print Operators" security group, but I am still getting the error message. I do not want to add the user to the Local Admins for the print server.
Question by:axygen
    LVL 70

    Expert Comment

    Assign the user/group the right to "Manage printer" on the printer's security tab.

    Author Comment

    I still get Access is denied when using the sc command.
    LVL 2

    Expert Comment

    How about creating a scheduled task to run the script? You can run a scheduled task manually and also set the admin credentials to do it without the user being able to discover the admin credentials.

    Author Comment

    @Olski -  How would I go about setting this up? Do I set it up on their computer, or on the printserver?
    LVL 26

    Expert Comment

    Greetings Axygen,

    Why not giving Everyone or Print Operator full access over Print Spooler service...

    SubInACL /Service Spooler /Grant=Everyone=F
    SubInACL /Service Spooler /Grant=Everyone=TOP

    (TOP means they can sTart, stOp and Pause the service)

    Get SubInACL from the Win2000

    More Info:

    ** Letting a User Start and Stop Services Without Granting the User Administrator Privileges

    ** Another way to grant the right to manage Windows 2000 services

    ** Server Operator Cannot Stop/Start Spooler Service

    Hope this helps!
    LVL 2

    Accepted Solution

    You would need to do it on the user's computer. Put the script file (batch file?) on the user's computer (in a folder called script on C: to make it easy to find).

    Go to control panel, Scheduled Taks.
    Double click Add Sceduled Task
    When it opens click next and then browse and browse to the script file and click open.
    Enter a name for the task like restart print spooler and select One Time Only and click next
    Click next again and enter the credentials for an admin account that has the rights to perform the spooler restart.
    Click next and tick the box for "Open Advanced properties.....
    In the advanced properties untick the "Enabled (Scheduled task runs at specified  time)"
    Click Ok.

    Now in Scheduled tasks right click the restart print spooler task and click run. This will then run the script under the credentials you entered.

    Sometimes scheduled tasks can be funny and you have to re-enter the credentials in the Advanced properties, so try this if it doesn't work first time.

    Author Comment

    @Olski - thanks, I'll try that after hours.

    @farhankazi - thanks for the links, the last one seems to be what I'm looking for. Will try that if @Olski's method doesn't work.

    Author Comment

    @Olski - it worked thanks!

    In case anyone's wondering here's my batch script...

    sc \\printserver stop spooler
    ping -n 5
    sc \\printserver start spooler

    To test it out I actually set used, ping -n 30, and just monitored the print spooler service on printserver. I saw that it turned off and after about 30 pings (however long that takes) it started up again.
    LVL 2

    Expert Comment

    No worries, glad it sorted your problem.
    LVL 3

    Expert Comment

    how do you know if a schedule task did run successfully or not? is there a log file somewhere? thanks.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Join & Write a Comment

    If you use a Brother DCP 130C or similar Brother printer, at some point you might encounter the following problem: after you change the ink cartridge, the printer displays an "ink empty" message. Sometimes you just need to follow the instructions…
    On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
    This video is in connection to the article "The case of a missing mobile phone (". It will help one to understand clearly the steps to track a lost android phone.
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now