Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the best way (cleanest) to lock out printing on vista client machines (on a domain)?

share|improve this question
Do you also want to restrict printing to a document like PDF? –  Joseph Jun 5 '09 at 18:12
add comment

3 Answers

Hmm... If your users don't have Administrator rights and you wanted to disable all printing I suppose you could use Group Policy to force the "Spooler" service to "Disabled".

There are some applications (Microsoft Access comes to mind) that need to get a device context to a printer before they will work (the "Reports" feature in Access works like this), so disabling the Spooler service is probably not the best idea in practice, but it would work in theory.

If you can test your applications and verify that they work with the Spooler service stopped and disabled then that's a very easy setting to set domain-wide.

It might be more practical to just not configure any local printers on the client computers and set the group policy option to prevent users from adding printers.

share|improve this answer
disabling the spooler was also my first thought, and I tried it... it's not a good solution-- –  Scott Kramer Jun 5 '09 at 17:58
Yeah-- didn't think it would be, but it was worth a shot. I'd go the second route then. –  Evan Anderson Jun 5 '09 at 18:09
add comment

I like Evan's answer but I'll add one more.

If ALL of the printers are "print server only printers" on a Windows server in your organization, then you could always create a DENY in the security settings of the printer, or just limit the security to those that are allowed to print to the printers.

That would prevent everything but creating a local printer using a TCP/IP port, but like Evan said you can use a GPO or remove them as admins to accomplish that part of it.

share|improve this answer
add comment

You can get 98% of the way there by making sure the user does not have local admin privileges, that there is no local printer already attached, and that there is no server-based network printer to which they have rights.

If you can't get by the local admin restriction, stopping the spooler service (as Evan suggested) might work. There is also a Group Policy setting to prevent users from installing printer drivers. But someone with local admin rights who knows what they are doing will be able to get something printed eventually.

share|improve this answer
they don't wave local admin priv, but when you plug a usb printer in, it magically works... trying to avoid that-- –  Scott Kramer Jun 5 '09 at 19:45
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.