Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the best way (cleanest) to lock out printing on vista client machines (on a domain)?

share|improve this question
Do you also want to restrict printing to a document like PDF? – Joseph Jun 5 '09 at 18:12

Hmm... If your users don't have Administrator rights and you wanted to disable all printing I suppose you could use Group Policy to force the "Spooler" service to "Disabled".

There are some applications (Microsoft Access comes to mind) that need to get a device context to a printer before they will work (the "Reports" feature in Access works like this), so disabling the Spooler service is probably not the best idea in practice, but it would work in theory.

If you can test your applications and verify that they work with the Spooler service stopped and disabled then that's a very easy setting to set domain-wide.

It might be more practical to just not configure any local printers on the client computers and set the group policy option to prevent users from adding printers.

share|improve this answer
disabling the spooler was also my first thought, and I tried it... it's not a good solution-- – Scott Kramer Jun 5 '09 at 17:58
Yeah-- didn't think it would be, but it was worth a shot. I'd go the second route then. – Evan Anderson Jun 5 '09 at 18:09

I like Evan's answer but I'll add one more.

If ALL of the printers are "print server only printers" on a Windows server in your organization, then you could always create a DENY in the security settings of the printer, or just limit the security to those that are allowed to print to the printers.

That would prevent everything but creating a local printer using a TCP/IP port, but like Evan said you can use a GPO or remove them as admins to accomplish that part of it.

share|improve this answer

You can get 98% of the way there by making sure the user does not have local admin privileges, that there is no local printer already attached, and that there is no server-based network printer to which they have rights.

If you can't get by the local admin restriction, stopping the spooler service (as Evan suggested) might work. There is also a Group Policy setting to prevent users from installing printer drivers. But someone with local admin rights who knows what they are doing will be able to get something printed eventually.

share|improve this answer
they don't wave local admin priv, but when you plug a usb printer in, it magically works... trying to avoid that-- – Scott Kramer Jun 5 '09 at 19:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.