Printer cannot be removed. Access denied.

[Jxx]

rundll32 printui.dll,PrintUIEntry /dl /n "Microsoft Office Document Image Writer" /c\\[name of remote computer]

This command works on the system I'm sitting at, but not on remote computers. Turns out that our users overwhelmingly don't want the print-to-file thing that comes with Office, and our lab teachers have asked that it be removed from every computer in thier labs.
I am an admin on all of these computers, and yet I get a dialog box saying "Printer cannot be removed. Access is denied," on them when I try to run the command against them remotely. If I log into the machine and run it with its own name in there, it works just fine. Anyone know what the cause/solution to this is?

They're all WinXP, SP1, built-in firewall is not turned on.

 

[Unforgiven]

this wont help you with a remote command but the microsoft office document writer can be uninstalled from add/remove programs by going into microsoft office and selecting the "change" option instead of "uninstall". its under the "office tools" heading.

 

[Jxx]

Yep. Should've mentioned that I know that.
I'm trying to avoid having to go to ~100 computers at 4 different sites.

 

[imported_Phil]

Have you run it as the domain adminstrator account?

 

[Jxx]

Yes. First tried with an account that was an admin on all the machines with that result. Then tried while logged in as a domain admin, and got the same thing.

 

[imported_Phil]

Hmm, not sure. Your best bet for help on this one will be someone like dclive or Sianath, as they work for Microsoft

 

[MrChad]

Originally posted by: Dopefiend
Hmm, not sure. Your best bet for help on this one will be someone like dclive or Sianath, as they work for Microsoft

dclive doesn't work for MS.

 

[imported_Phil]

Originally posted by: MrChad

Originally posted by: Dopefiend
Hmm, not sure. Your best bet for help on this one will be someone like dclive or Sianath, as they work for Microsoft

dclive doesn't work for MS.

He doesn't? Hmm, must be confusing him with someone else

 

[jtoomey]

I'm posting this here in case anyone else needs help with this. I found that WMI couldn't delete the Microsoft Office Document Image Writer remotely because of the Network account's security, which is set to Deny. You find this by right-clicking the Microsoft Office Document Image Writer and looking at the security tab. If you remove the "deny", WMI can delete the printer remotely. I noticed that I always got the same error "80041003 Access denied", whether I called the WMI Delete method using C#, or I used psexec to invoke this script remotely:
psexec \\ComputerName cscript c:\windows\system32\prnmngr.vbs -d -p "Microsoft Office Document Image Writer" -m "Microsoft Office Document Image Writer Driver" -r "Microsoft Document Imaging Writer Port:"
Both approaches (C# and prnmngr.vbs) worked with other printers on remote machines, which was my indicator that it wasn't a security issue with WMI itself. I barked up that wrong tree for 2 full days (if you search Google for WMI and Access Denied, you get lots of tips on fiddling with security settings under Control Panel>Component Services that really have nothing to do with the specific problem for the Microsoft Office Document Image Writer).
Unfortunately I haven't found a way to remotely remove the deny setting for the Network account on the Microsoft Office Document Image Writer printer, but I will post that too if I find an answer.

 

[jtoomey]

This did the trick to change the permissions and delete the printer remotely. It has 4 steps:
1) Copy over the free utility SetAcl to the C drive of the computer:
xcopy i:\hike\jt\setacl.exe \\ComputerName\c$

2) Give full rights to the Network account by running SetACL remotely (using the utility psexec to invoke it):
psexec \\ComputerName c:\SetACL.exe -on "ms office document image writer" -ot prn -actn ace -ace "n:Network;p:full"

3) Delete the printer, again using psexec to invoke it remotely:
psexec \\ComputerName cscript c:\windows\system32\prnmngr.vbs -d -p "ms office document image writer" -m "Microsoft Office Document Image Writer Driver" -r "Microsoft Document Imaging Writer Port:"

4) Delete the setacl utility
del \\ComputerName\c$\setacl.exe

 

[dgenesis]

The method overall was brilliant. Thanks for the guide. I had to doctor it a bit due to the forum's auto-smilies and some incorrect naming in the reference. Here's the revised guide:

• Download the SetACL program from http://helgeklein.com/
• Extract SetACL.exe from the downloaded compressed file to an accessible location (example C:\).
• Copy SetACL to Remote PC:
  

  xcopy C:\SetACL.exe \\{Remote Hostname}\C$

• Change NETWORK permissions on Image Writer:
  

  psexec \\{Remote Hostname} C:\SetACL.exe -on "Microsoft Office Document Image Writer" -ot prn -actn ace -ace "n:Network;p:full"

• Delete the Image Writer:
  

  psexec \\{Remote Hostname} cscript C:\Windows\System32\prnmngr.vbs  -d -p "Microsoft Office Document Image Writer" -m "Microsoft Office Document  Image Writer Driver" -r "Microsoft Document Imaging Writer Port:"

• Delete SetACL on Remote PC:
  

  del /q \\{Remote Hostname}\C$\SetACL.exe