Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We setup a new 64bit Print Server (Server 2008 R2) and on our previous print server we had the helpdesk as a member of the power users group, and gave them "Manager Printers" so they could change printer ports when printers went down.

it looks like there was an oversight and it wasn't added when we setup the new server.

I've added them to power users, and went into Print Server Properties in "PRINTMANAGEMENT.MSC" and granted the permissions, but it seems like this is only going to apply to new printers as it doesn't appear to be inheriting to any existing printers.

anyway to get these permissions to propogate to the existing printers?

these are setup as local printers, bound to Standard TCP / IP ports.

share|improve this question
The SetACL.exe can set permissions on printers. I suspect there is some easy way to do it with Powershell as well. You just need to get a list, and script fixing the ACL on each. – Zoredache Nov 21 '12 at 20:40
up vote 3 down vote accepted

I came across this question realizing I never posted what I did, ultimately I figured out a way to use SUBINACL.exe (needs to be in a path directory like System32)

and passed it through a powershell loop of all the printers

here's the code, run it from the PS Console as Administrator on the Print Server

$Logpath = "c:\temp\logs"

Stop-Transcript -ErrorAction "SilentlyContinue"
Start-Transcript $Logpath -Append

$PRINTERS = (Get-WmiObject Win32_Printer)

foreach($PRINTER in $PRINTERS)
{$Server = $PRINTER.SystemName
 $PrinterName = $
Write-Host \\$Server\$PrinterName 
Invoke-Command -AllowRedirection {subinacl.exe /printer \\$Server\$PrinterName /Grant=domain\username=F}

I don't work there anymore but I hope someone benefits from finding this.

share|improve this answer

I recognize this is not a method by which to apply security permissions to all printers, but it may solve your problem.

The default permissions on a printer usually seems to include manage permissions assigned to the domain group "Print Operators". Consider adding your helpdesk group to "Print Operators".

Also, there appears to be a global set of permissions that may allow for setting to be applied to all printers found under Print Server Properties which can be accesssed by right clicking the Print Server's name in printmanagement.msc.

Note: I have not used the Print Server Properties acl before, so I cannot say if it works the way you want.

share|improve this answer

When I run this it appears to be pulling the server name and printer names but is erroring on running the command --

\[print server name][printer name] Invoke-Command : Cannot evaluate parameter 'ConnectionUri' because its argument is specified as a script block and ther e is no input. A script block cannot be evaluated without input. At C:\ntutils\utils\Subinacl7.ps1:13 char:15 + Invoke-Command <<<< -AllowRedirection {c:\ntutils\utils\subinacl.exe /printer http://$Server/$PrinterName /Grant=ter minalserver\ManagePrintQueues=M} + CategoryInfo : MetadataError: (:) [Invoke-Command], ParameterBindingException + FullyQualifiedErrorId : ScriptBlockArgumentNoInput,Microsoft.PowerShell.Commands.InvokeCommandCommand

share|improve this answer
This does not appear to be an answer to the OP's question; what command are you trying to provide? – Castaglia Apr 5 at 2:22
Not sure what you mean, I ran the script above with the domain\group name I wanted and that was the resulting error. 2008R2 server. I'm relatively new at Powershell so trying to work out what I missed here. – Mike Apr 5 at 16:21
Mike, just curious, did you install subinacl separately, its not part of windows command set by default, you have to download and place it in a path directory like windows/system32 – Matt Hamende Apr 6 at 3:47
Yes, I downloaded/installed the latest version of subinacl from MS to system32, run the script from the same folder, in PS as admin. I get the same error message for each printer, "Cannot evaluate parameter 'ConnectionUri' because its argument is specified as a script block and there is no input." – Mike Apr 6 at 19:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.