We have a Windows 2003 server managing about a hundred printers, all shared network resources. Some users in our company have the rights to manage print queues, i.e. 'Windows cannot connect to the printer Access is denied (Win-7-10)' This error show when share a printer in network.
-->- This issue is seen if the setting 'Render Print job on client computer' is unchecked on the 'Shared' tab for the Printer Queue. Additionally, if Microsoft KB3139649 has not been applied to the server, an 'Access Denied' message may be seen when trying to connect with the shared Windows Printer Queue. On the 'Security' tab for the Printer Queue.
- A print job is stuck in the print queue and prevents further print jobs from printing. Cancel and Delete buttons are gray or do not respond. Perform the following tasks in the order given. Try using the printer after each task to see if the issue is resolved.
- If the printer queue is still stuck, you can go to the Printer menu and click Cancel All Documents. If this won’t work, restart your computer and printer, unplug any wired connections and plug them back before the reboot is finished.
Applies To: Windows Server 2012
Planning security for your print servers and determining how to restrict access to them is an important part of print server administration. In Windows Vista® and Windows Server® 2008, only full system administrators were able to perform print administrative tasks. In Windows Server 2008 R2 and Windows Server 2012, you can delegate print management tasks directly to users who are not system administrators. You can also define default printer security settings that are inherited when you add new printers to your print server.
These changes enable the following improvements for printer and print server administration:
You can control access to resources and balance workloads by delegating specific print administrative tasks to users without adding them to the Administrators security group.
You can manage permission settings through the improved user interface of the Security tab in the Print Server Properties dialog box.
You can manage your printer infrastructure by configuring default printer security settings which new printers inherit automatically when you add them. You can configure the settings per server so that you do not have to configure the printers individually.
Configuring security settings
This section covers the following:
Note
Print server security can be configured only by members of the Administrators group.
The print server security user interface
In Windows Server 2012, users in the Administrators group can configure the print security settings directly by editing the print server access control list (ACL) permissions in the Print Management Microsoft Management Console (MMC) snap-in. (To view the ACL permissions for your printer server, open Server Manager, click Tools, and then click Print Management. In the left pane, click Print Servers, right-click the applicable print server and then click Properties. In the Print Server Properties dialog box, click the Security tab.)
Figure 1 shows the user interface of the Security tab that is opened by a user who is a member of the Administrators group.
Figure 1: Print Server Properties Security tab
In a domain, members of the Administrators group can remotely configure the print server security settings. You can do this by using the Print Management snap-in. The remote functionality for users to view the print server security user interface is supported for certain earlier operating systems, including Windows Server 2008, Windows Vista with SP1, and Windows Vista with SP2. However, the delegated print administrator functionality is currently only available on Windows Server 2008 R2 and Windows Server 2012.
Setting permissions in Print Server Properties
Print server permissions control the levels of access for users on a particular print server. Printer permissions control which printing tasks users can perform on newly added printers that are managed by the print server. Administrators should assign these permissions as needed to users who are not system administrators.
After an administrator customizes the security settings for the print server, all newly added printers to this print server automatically inherit these security settings. (The security settings for the existing printers on the server are not altered.)
The two levels of print server permissions are:
View Server
The View Server permission assigns the ability to view the print server. Without the View Server permission, users cannot see the printers that are managed by the server. By default, this permission is given to members of the Everyone group.
Manage Server
The Manage Server permission assigns the ability to create and delete print queues (with already installed drivers), add or delete ports, and add or delete forms. A standard user with this permission is called a “delegated print administrator.”
Note
Only users who have Manage Server access and are members of the Administrators group can add printer drivers.
The three levels of printer permissions are:
Print
The Print permission assigns the ability for users to connect to printers and to print, pause, resume, start, and cancel their own documents. By default, this permission is given to members of the Everyone group when a print queue is created.
Manage Documents
The Manage Documents permission assigns the ability to control job settings for all documents and to pause, restart, and delete all documents.
Manage Printers
The Manage Printer permission assigns the ability to pause and restart the printer, change spooler settings, share a printer, adjust printer permissions, and change printer properties.
The ability to assign access to a printer on a per-user or a per-group basis makes it possible to manage printers from a central location. For example, an administrator could limit access to a printer in a public area while managing the printer from a more secure, central location.
In Windows Server 2012, the default print server and printer security settings are as follows:
Everyone | Creator Owner | Administrators |
|---|---|---|
Allow | Allow | |
Manage Documents | Allow | Allow |
Manage Printers | Allow | |
View Server | Allow | Allow |
Manage Server | Allow |
Creating a delegated print administrator
Members of the Administrators group can create a full delegated print administrator by assigning the Manage Server permission to a user. When the Manage Server permission is assigned, the View Server permission is also automatically assigned. You can also delegate a subset of these permissions to create a partial delegated print administrator.
To create a full delegated print administrator
Open Server Manager, click Tools, and then click Print Management.
In the left pane, click Print Servers, right-click the applicable print server, and then click Properties.
In Print Server Properties, click the Security tab.
To configure permissions for a new group or user, click Add. Type the name of the group or user that you want to set permissions for by using the following format: domain nameusername. Click OK to close the dialog box.
Tip
Before adding any printers to the server, you should create a group of users who can perform delegated print tasks, and then configure the proper permissions. If you do this, all newly added printers automatically inherit these settings, and you do not have to individually configure existing printers for the print server.
Highlight the user or group name that you just added, and in Permissions for <user or group name>, click Allow for the Manage Server permission. (The View Server permission is assigned too.)
Select the Allow check boxes for the Print, Manage Documents, and Manage Printers permissions.
To create a partial delegated print administrator
To enable an administrator to add printers:
Follow the previous instructions, but select the Allow check boxes for the Manage Server and Print permissions. (View Server permission is assigned automatically too.)
To enable an administrator to manage existing print queues:
Follow the previous instructions, but select the Allow check boxes for the View Server, Print, Manage Documents, and Manage Printer permissions.
Print-related permissions and the tasks they enable
The following table lists the print tasks that a user can perform when assigned the corresponding permissions from the Print Server PropertiesSecurity tab.
Manage Printers | Manage Documents | View Server | Manage Server | |
|---|---|---|---|---|
View the print queue (on the local server) | Yes | |||
Print owned documents to the queue | Yes | |||
View, pause, restart, and cancel all print jobs in a queue | Yes | |||
Update installed or included drivers, and drivers available from Windows Update, to an existing queue Note This does not apply to clustered print environments. | Yes | |||
Add or delete a form in a queue | Yes | |||
View the printer properties | Yes | |||
View the print server proprieties | Yes | |||
Configure printer security permissions in a print queue | Yes | |||
Manage the print server security descriptor setServerSecurityDescirptor flag | ||||
Add a print queue to a print server | Yes, when the drivers are already installed. | |||
Delete a print queue from a print server | Yes, but only the queue they have permissions for. | |||
Add a print driver to a print server | Yes, but locally only. The user must be a member of the Administrators group to add drivers (including remotely) to the print server. | |||
Delete a print driver from a print server | Yes, but only for drivers (not driver packages). | |||
Add, delete, and configure ports on a print server | Yes | |||
Add and delete a form on a print server | A user who is assigned Manage Printers, but not Manage Server, permissions can add a form when AllowUserManageForms is set in the Windows registry to a non-zero value. A user can add forms up to the specified value for AllowUserManageForms. A user can only add user forms and delete user forms. However, a user with SERVER_ACCESS_ADMINISTER permission can add and delete printer and user forms with no limitations. | Yes | ||
Share the printer | Yes, if you have Manage Printer permissions on the print server and the File and Printer Sharing* exceptions have been enabled in Windows Firewall with Advanced Security. | Yes, if you have Manage Printer permissions on the print server and the File and Printer Sharing* exceptions have been enabled in Windows Firewall with Advanced Security. |
Designing and creating print security groups
Following is a list of suggested print security groups and their associated permissions:
System Administrators Group: Consists of members of the Administrators security group.
Print Administrators Group: Consists of members of the System Administrators group and users who have been assigned some set of delegated print administrator rights. Depending on what rights you assign, members of this group may be considered full delegated administrators or partial delegated administrators.
Note
If you want to mitigate the ability of members of the Administrators group to perform print management tasks, instead of adding whole groups to these print security groups, you can add members individually, and then assign the proper permissions.
The following table demonstrates which actions can be performed depending on the permissions assigned:
Standard Users: Can connect to printers and print their documents (Permissions: Print, View Server) | Partial Delegated Administrators: Can add printers (Permissions: Print, View Server, Manage Server) | Partial Delegated Administrators: Can manage existing queues (Permissions: Print, View Server, Manage Printers, Manage Documents) | Full Delegated Administrators: Can perform all administrative print tasks (Permissions: Print, Manage Documents, Manage Printers, View Server, Manage Server) | System Administrators: Can fully administer the system (Permissons: Print, Manage Documents, Manage Printers, View Server, Manage Server) | |
|---|---|---|---|---|---|
View the print queue on the local server | Yes | Yes | Yes | Yes | Yes |
Print to the queue | Yes | Yes | Yes | Yes | Yes |
View, pause, restart, or cancel print jobs owned by the user in a queue | Yes | Yes | Yes | Yes | Yes |
Modify all print jobs in a queue | Yes | Yes | Yes | ||
Update an installed or included driver to an existing queue | Yes | Yes | Yes | ||
Add or delete a form in the queue | Yes | Yes | Yes | ||
View the printer properties | Yes | Yes | Yes | Yes | Yes |
View the print server proprieties | Yes | Yes | Yes | Yes | Yes |
Manage security permission on the print queue | Yes | Yes | Yes | ||
Manage the print server security descriptor setServerSecurityDescirptor flag | Yes | ||||
Add and delete the print queue on a server | Yes, but you can add a printer using only a preinstalled driver. | Yes, but you can only delete the print queue with the Manage Printer permission. | Yes, but you can add a printer using only a preinstalled driver. | Yes | |
Add and delete a print driver on a server | Yes, but locally only. The user must be a member of the Administrators group to add non-included drivers or to add drivers remotely to the print server. | Yes, but locally only. The user must be a member of the Administrators group to add non-included drivers or to add drivers remotely to the print server. | Yes | ||
Add, delete, and configure ports on a print server | Yes | Yes | Yes | ||
Add and delete a form on a print server | Yes | Yes | Yes | ||
Share the printer | Yes, if you have Manage Printer permissions on the print server and the File and Printer Sharing* exceptions have been enabled in Windows Firewall with Advanced Security. | Yes, if the File and Printer Sharing* exceptions have been enabled in Windows Firewall with Advanced Security. | Yes |
Note
We recommend that only a member of the System Administrators group install drivers. If a delegated print administrator plans to remotely add or manage queues, the System Administrator should install the driver to the following directory by using Windows PowerShell® or manually:systemdrive<STRONG>Windows<STRONG>System32<STRONG>spool<STRONG>drivers<EM>processor_architecture<STRONG>3
Print Queue Access Denied Windows 10
For more information about Windows PowerShell Print Management cmdlets, see Print Management Cmdlets in Windows PowerShell.