Home / server / Questions / 816040
Accepted
Slipeer
Asked: 2016-11-21 23:39:50 +0800 CST

Deny printing of documents from any workstations and servers to some user group?

  • 772

Is it possible Active Directory domain completely deny printing of documents from any workstations and servers to some user group using Group Policy or another way?

It is important that:

  • the prohibition must apply to the user (another user on the same computer must be able to print).
  • the prohibition must works, even if the user's PC has a locally connected printer.
  • it must be able to quickly enable or disable the user to print, by changing its membership in the domain group.
  • some printers are connected to users' computers via USB
group-policy printing active-directory

2 Answers

    • Add a security group 'DenyPrinting' to all printers with the setting Print -> Deny.
    • Use GPO to 'Disable the addition of printers' for this group.
    • Add users to the group who shouldn't print
    • 1
  2. Best Answer

    Best way that i found:

    On all computers in the domain using GPP create a task for the regular run powershell script with local system account:

    $Account = "DOMAIN\Group_deny_print"
Get-Printer -full | Where-Object Type -eq "Local" | foreach { 
    try  
    { 
        $acl = New-Object -TypeName Security.AccessControl.CommonSecurityDescriptor $false, $false, ($_ | Select-Object PermissionSDDL -ExpandProperty PermissionSDDL);
        Write-Host "Deny $Account print to printer ($_.Name)";
        $NTAccountSid = (New-Object Security.Principal.NTAccount $Account).Translate([Security.Principal.SecurityIdentifier]).Value;
        $acl.DiscretionaryAcl.AddAccess( 
                [System.Security.AccessControl.AccessControlType]::Deny, 
                $NTAccountSid, 
                131080, #Print = (ACCESS_MASK.PRINTER_ACCESS_USE | BASE_RIGHTS.READ_CONTROL),
                [System.Security.AccessControl.InheritanceFlags]::None, 
                [System.Security.AccessControl.PropagationFlags]::None);
        $newacl = $acl.GetSddlForm("All");
    }
    catch [Exception]  
    { 
        Write-Error -Message "Failed:`n $_.Message" -Exception $_.Exception 
    } 
    $_ | Set-Printer -PermissionSDDL $newacl -verbose;
}

    But int's work only in Windows Server 2012 / Windows 8 or later.

    • 0