Programmatically Change Permissions in Print Clusters

Executive Summary:

The SubInACL utility, which you can find in the Microsoft Windows Server 2003 Resource Kit, is a versatile tool that lets you view, edit, remove, add, and migrate access control entries (ACEs) for files, directories, file shares, printer shares, and more. Because SubInACL is a command-line tool, you can script its use. Here's an example of how you can write a script that uses SubInACL to change permissions in a print cluster.

Q: I need to change the permissions for the printers in my company's print cluster. Our print cluster consists of two Window Server 2003 servers connected to a NAS device that provides shared storage to both servers. In the cluster, there are 10 logical resource groups, with 30 to 40 printers in each logical resource group. I'd like to replace the built-in Power Users group that Windows 2003 assigns by default to each printer's ACL with a group that has Manage Printer and Manage Document rights. (Some users who shouldn't have permission to manage the printers are embedded into the Power Users group by Group Policy Objects—GPOs—applied to the server, but we'd rather remove Power Users from the printers than tweak the GPOs at this time.) With 300 to 400 printers, changing the permissions manually on each printer would be too cumbersome. Do you have any idea on how this can be scripted?

—Scott . . .