Why can I access only the security tab on a server’s printers

permissionsprintingwindows 7windows-server-2003

Context: Win7 64-bit client, Windows Server 2003

I log into the server using MSTSC. The server is running Windows Server 2003, 32bit.

I call up the list of Printers and Faxes from the Start menu. I right-click on a printer on the server. I get told that I don't have the relevant privileges and that I can access only the Security tab.

The list on that tab says that Domain Admins have full rights. I'm in the Domain Admins group. However, I don't seem to have full rights.

The printer is a RICOH Aficio SP 4210N. Print Management says that 32bit and 64bit drivers are present.

Any idea why the rights are there, but the outworking of them isn't?

Best Answer

The description of your issue sounds like potential ACL corruption. In order to repair this, you would need take ownership and correct the ACL.

Click on the "Advanced" button within the "Security" tab. In the next window, select "Owner" and select the desired user. The default owner is the local group %COMPUTERNAME%\Administrators, click "OK".

This will correct the ownership, you will still need to correct the ACL to grant proper access for users.

We've had this issue following a BSOD on our print server. As we've hundreds of printer shares, correcting the owner/ACLs manually would have been... ...painful. The following batch file (sorry, our problem pre-dated PowerShell!) should help.

Dump a listing of the bare print share names into a file printers.txt, then run this. You'll need Helge Klien's excellent command line utility SetACL.

@ECHO OFF
SET PRNSRV=your_print_server_name    

FOR /F %%P in (printers.txt) DO (

    ECHO Processing: %%P

    ECHO Taking ownership
    setacl -on "\\%PRNSRV%\%%P" -ot prn -actn setowner -ownr "n:Administrators"

    ECHO Clear ACL
    setacl -on "\\%PRNSRV%\%%P" -ot prn -actn ace -actn clear -clr "dacl,sacl"

    ECHO Create default ACEs
    setacl -on "\\%PRNSRV%\%%P" -ot prn -actn ace -ace "n:Administrators;p:full"
    setacl -on "\\%PRNSRV%\%%P" -ot prn -actn ace -ace "n:CREATOR OWNER;p:man_docs"
    setacl -on "\\%PRNSRV%\%%P" -ot prn -actn ace -ace "n:Everyone;p:print"
    setacl -on "\\%PRNSRV%\%%P" -ot prn -actn ace -ace "n:Power Users;p:full"

)
Related Topic