Minimal privileges to allow print job deletion

Question

_{Thursday, September 22, 2016 2:09 PM}

Hello,

I need to allow our helpdesk to delete print queues on domain member print servers.  I have added the users to the Print Operators group on the domain member print servers so that they can manage the print queues, and I've added them to the Remote Management Servers so that they're able to log in.  Unfortunately they do not appear to be able to delete the queues.  Looking that the description of the Print Operators group:

Members can administrator printers installed on domain controllers

These print servers are domain members, however they are not domain controllers.

Is there a way to allow users to manage print queues without making them members of local administrator?

Thanks

All replies (3)

_{Wednesday, September 28, 2016 9:23 AM ✅Answered}

Hi,

Please try this GPO:

In Group Policy editor, expand the following folders: User Configuration, Administrative Templates, Control Panel, and Printers.The following settings can be configured under User Configuration:

Disable the deletion of printers:Prevents users from deleting local and network printers. If a user tries to delete a printer, such as by using the Delete command in the Printers tool in Control Panel, Windows displays a message that explains that the action is prevented by a policy. However, this policy does not prevent users from running programs to delete a printer.

Best Regards,
Cartman
Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Friday, September 23, 2016 2:31 AM}

Hi,

>>Is there a way to allow users to manage print queues without making them members of local administrator?

You could add them to print server security user interface and set the permission you want.

Please check this link for details:

Assigning Delegated Print Administrator and Printer Permission Settings in Windows Server 2008 R2

https://technet.microsoft.com/en-us/library/ee524015(v=ws.10).aspx

Best Regards,
Cartman
Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Monday, September 26, 2016 6:52 PM}

Apologies, my question was not clear.

Users need to be able to delete print jobs however I need to prevent them from deleting the actual printers themselves.  It appears if I grant them the 'manage printers' privilege they are then able to delete the printer mistakenly. 

Can this be prevented somehow?