Windows 7 and 10 clients on domain network, printing to various print shares on Windows servers…users are having jobs get stuck in their print queue with “Access Denied” listed as the status. These are all users who have been printing to these print shares for months or even years without issue. They’ll then build up multiple print jobs behind the stuck job before realizing there’s a problem. As soon as they cancel the “Denied” job, all the other jobs print.

Anyone seen an issue like this? Perhaps there’s some recent WSUS update that has caused this? Haven’t been able to find anything so far.

Applies To: Windows Server 2012

To do this, follow these steps: Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers. In the navigation pane, right-click your domain name, and then click Properties. Click the Group Policy tab, click the GPO that you want to modify, and then click Edit. Go to Settings and select Printers. Click on Open Queue and select the problematic file. Cancel the print job. If the printer still doesn’t respond, go to the Printer Menu and cancel all documents.

Planning security for your print servers and determining how to restrict access to them is an important part of print server administration. In Windows Vista® and Windows Server® 2008, only full system administrators were able to perform print administrative tasks. In Windows Server 2008 R2 and Windows Server 2012, you can delegate print management tasks directly to users who are not system administrators. You can also define default printer security settings that are inherited when you add new printers to your print server.

If I open the queue like this: pq = new PrintQueue(ps, printQueue); The open works find, but when I try to access the jobs in that queue, I get the access denied message.

These changes enable the following improvements for printer and print server administration:

• You can control access to resources and balance workloads by delegating specific print administrative tasks to users without adding them to the Administrators security group.

• You can manage permission settings through the improved user interface of the Security tab in the Print Server Properties dialog box.

• You can manage your printer infrastructure by configuring default printer security settings which new printers inherit automatically when you add them. You can configure the settings per server so that you do not have to configure the printers individually.

Configuring security settings

This section covers the following:

Note

Print server security can be configured only by members of the Administrators group.

The print server security user interface

In Windows Server 2012, users in the Administrators group can configure the print security settings directly by editing the print server access control list (ACL) permissions in the Print Management Microsoft Management Console (MMC) snap-in. (To view the ACL permissions for your printer server, open Server Manager, click Tools, and then click Print Management. In the left pane, click Print Servers, right-click the applicable print server and then click Properties. In the Print Server Properties dialog box, click the Security tab.)

Figure 1 shows the user interface of the Security tab that is opened by a user who is a member of the Administrators group.

Figure 1: Print Server Properties Security tab

In a domain, members of the Administrators group can remotely configure the print server security settings. You can do this by using the Print Management snap-in. The remote functionality for users to view the print server security user interface is supported for certain earlier operating systems, including Windows Server 2008, Windows Vista with SP1, and Windows Vista with SP2. However, the delegated print administrator functionality is currently only available on Windows Server 2008 R2 and Windows Server 2012.

Setting permissions in Print Server Properties

Print server permissions control the levels of access for users on a particular print server. Printer permissions control which printing tasks users can perform on newly added printers that are managed by the print server. Administrators should assign these permissions as needed to users who are not system administrators.

After an administrator customizes the security settings for the print server, all newly added printers to this print server automatically inherit these security settings. (The security settings for the existing printers on the server are not altered.)

The two levels of print server permissions are:

• View Server

  The View Server permission assigns the ability to view the print server. Without the View Server permission, users cannot see the printers that are managed by the server. By default, this permission is given to members of the Everyone group.

• Manage Server

  The Manage Server permission assigns the ability to create and delete print queues (with already installed drivers), add or delete ports, and add or delete forms. A standard user with this permission is called a “delegated print administrator.”

  Note

  Only users who have Manage Server access and are members of the Administrators group can add printer drivers.

The three levels of printer permissions are:

• Print

  The Print permission assigns the ability for users to connect to printers and to print, pause, resume, start, and cancel their own documents. By default, this permission is given to members of the Everyone group when a print queue is created.

• Manage Documents

  The Manage Documents permission assigns the ability to control job settings for all documents and to pause, restart, and delete all documents.

• Manage Printers

  The Manage Printer permission assigns the ability to pause and restart the printer, change spooler settings, share a printer, adjust printer permissions, and change printer properties.

The ability to assign access to a printer on a per-user or a per-group basis makes it possible to manage printers from a central location. For example, an administrator could limit access to a printer in a public area while managing the printer from a more secure, central location.

In Windows Server 2012, the default print server and printer security settings are as follows:

Creating a delegated print administrator

Members of the Administrators group can create a full delegated print administrator by assigning the Manage Server permission to a user. When the Manage Server permission is assigned, the View Server permission is also automatically assigned. You can also delegate a subset of these permissions to create a partial delegated print administrator.

To create a full delegated print administrator

1. Open Server Manager, click Tools, and then click Print Management.

   In the left pane, click Print Servers, right-click the applicable print server, and then click Properties.

   In Print Server Properties, click the Security tab.

2. To configure permissions for a new group or user, click Add. Type the name of the group or user that you want to set permissions for by using the following format: domain nameusername. Click OK to close the dialog box.

   Tip

   Before adding any printers to the server, you should create a group of users who can perform delegated print tasks, and then configure the proper permissions. If you do this, all newly added printers automatically inherit these settings, and you do not have to individually configure existing printers for the print server.

3. Highlight the user or group name that you just added, and in Permissions for <user or group name>, click Allow for the Manage Server permission. (The View Server permission is assigned too.)

4. Select the Allow check boxes for the Print, Manage Documents, and Manage Printers permissions.

To create a partial delegated print administrator

• To enable an administrator to add printers:

  Follow the previous instructions, but select the Allow check boxes for the Manage Server and Print permissions. (View Server permission is assigned automatically too.)

• To enable an administrator to manage existing print queues:

  Follow the previous instructions, but select the Allow check boxes for the View Server, Print, Manage Documents, and Manage Printer permissions.

Print-related permissions and the tasks they enable

The following table lists the print tasks that a user can perform when assigned the corresponding permissions from the Print Server PropertiesSecurity tab.

Designing and creating print security groups

Following is a list of suggested print security groups and their associated permissions:

• System Administrators Group: Consists of members of the Administrators security group.

• Print Administrators Group: Consists of members of the System Administrators group and users who have been assigned some set of delegated print administrator rights. Depending on what rights you assign, members of this group may be considered full delegated administrators or partial delegated administrators.

Note

If you want to mitigate the ability of members of the Administrators group to perform print management tasks, instead of adding whole groups to these print security groups, you can add members individually, and then assign the proper permissions.

The following table demonstrates which actions can be performed depending on the permissions assigned:

Print Queue Access Denied Windows 10

Note

We recommend that only a member of the System Administrators group install drivers. If a delegated print administrator plans to remotely add or manage queues, the System Administrator should install the driver to the following directory by using Windows PowerShell® or manually:systemdrive<STRONG>Windows<STRONG>System32<STRONG>spool<STRONG>drivers<EM>processor_architecture<STRONG>3

Cancel Print Queue Access Denied

For more information about Windows PowerShell Print Management cmdlets, see Print Management Cmdlets in Windows PowerShell.