Windows Server 2008 R2
I'm having a hard time trying to grant some end users the ability to cancel print jobs on network printers. I created a global security group called "PrintOps", and added the end users in it. Then, I RDP'd into the print server, opened up the Print Management console > Print Servers > and right-clicked on PRINT01 (local). Then, I clicked on Security, and added "PrintOps". I granted the following: Print, Manage Printers, Manage Documents, and View Server. Finally, a restarted the Print Spooler service, and had a end user try it. On their Windows 7 SP1 workstations, they opened Devices and Printers, double-clicked the network printer, tried to Cancel the document in queue, but received "Access Denied".
After this happened, I went back to PRINT01, and looked at the printers' Security tab. The "PrintOps" security group wasn't in there. Therefore, I added to each printer the security group, and granted the following: Print, Manage documents, and Manage this printer. I restarted the print spooler service on PRINT01, and then had an end user try again -- "Access Denied". The end user has restarted the workstation, and has logged off/on.
Finally, I added "PrintOps" to the C:\WINDOWS\System32\spool\printers folder, and granted it Full Control. This permission was inherited to all subfolders and files. Again, I restarted the print spooler service, and had the end user try again. Same result: "Access Denied".
Am I missing something here?