Needing to Grant User permission to delete jobs/restart spooler

[Robert W]

Hello to all,

I am working in a production environment that has operations going on a 24/7
basis. To minimize our On Call status, I have been assigned to create user
accounts for certain individuals during the 2nd and 3rd shifts to be able to
login via a terminal server connection and have them only able to manipulate
deleting print jobs from printer queues and the ability to stop and restart
the spooler. Can anyone guide me to what groups these newly created users
should be members of so that I can have them locked down to a point where
they cannot shut down the server or startup a unauthorized program? I have
already eliminated the Shutdown menu option on the Start Menu and replaced
with Logoff. I know of a setting to only allow certain icons on the
desktop. But I need to know the groups who have permission to delete pint
jobs from queues and to restart the spooler service.

 

[Bram]

Robert,

Create a group "PrintOps" and assign this group:

1) Printer queue Permissions (per queue)
2) Access to SPOOLER and LPDSVC services
3) Access to terminal services

Ad2)
subinacl /service spooler /Grant="PrintOps"=F
subinacl /service lpdsvc /Grant="PrintOps"=F

The users should be in "Users" and "PintOps" server groups to do their job

/Bram