4

After applying this "solution" I have no way of starting the spooler service, not even as Admin.

If I open services.msc as Administrator, that service has disappeared, as noted here (I wish I found that before).

How can I reset permissions for the spooler service?

7

The SYSTEM security context can reset it. You don't mention your Windows version, but in Windows Server 2008 and newer versions it can be a bit difficult to get a SYSTEM command prompt. It's very easy, though, to get the "Task Scheduler" in all versions of Windows to run a command as SYSTEM.

  • Dump the security descriptor from a known-good machine using the sc sdshow spooler command.

  • Create a scheduled task on the broken machine to run the command %SystemRoot%\system32\sc.exe with the arguments sdset spoooler <paste good security descriptor here>.

  • Set the task to run as SYSTEM

  • Manually run the task

Your service's security descriptor will be restored to normal.

| improve this answer | |
  • 2
    I found easier to use PsExec. The full command was PsExec.exe /s sc sdset spooler D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD). – Yajo Nov 21 '14 at 8:27
0

In addition to Evan's Task Scheduler method, I also had to

  1. Remove the following registry key (folder)

    HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder\Security

enter image description here

  1. Reboot the server
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.