Printer cannot be removed. Access denied.

[Jxx]

rundll32 printui.dll,PrintUIEntry /dl /n "Microsoft Office Document Image Writer" /c\\[name of remote computer]

This command works on the system I'm sitting at, but not on remote computers. Turns out that our users overwhelmingly don't want the print-to-file thing that comes with Office, and our lab teachers have asked that it be removed from every computer in thier labs.
I am an admin on all of these computers, and yet I get a dialog box saying "Printer cannot be removed. Access is denied," on them when I try to run the command against them remotely. If I log into the machine and run it with its own name in there, it works just fine. Anyone know what the cause/solution to this is?

They're all WinXP, SP1, built-in firewall is not turned on.

 

[Unforgiven]

this wont help you with a remote command but the microsoft office document writer can be uninstalled from add/remove programs by going into microsoft office and selecting the "change" option instead of "uninstall". its under the "office tools" heading.

 

[Jxx]

Yep. Should've mentioned that I know that.
I'm trying to avoid having to go to ~100 computers at 4 different sites.

 

[imported_Phil]

Have you run it as the domain adminstrator account?

 

[Jxx]

Yes. First tried with an account that was an admin on all the machines with that result. Then tried while logged in as a domain admin, and got the same thing.

 

[imported_Phil]

Hmm, not sure. Your best bet for help on this one will be someone like dclive or Sianath, as they work for Microsoft 🙂

 

[MrChad]

Originally posted by: Dopefiend
Hmm, not sure. Your best bet for help on this one will be someone like dclive or Sianath, as they work for Microsoft 🙂

dclive doesn't work for MS.

 

[imported_Phil]

Originally posted by: MrChad

Originally posted by: Dopefiend
Hmm, not sure. Your best bet for help on this one will be someone like dclive or Sianath, as they work for Microsoft 🙂

dclive doesn't work for MS.

He doesn't? Hmm, must be confusing him with someone else 🙂

 

[jtoomey]

I'm posting this here in case anyone else needs help with this. I found that WMI couldn't delete the Microsoft Office Document Image Writer remotely because of the Network account's security, which is set to Deny. You find this by right-clicking the Microsoft Office Document Image Writer and looking at the security tab. If you remove the "deny", WMI can delete the printer remotely. I noticed that I always got the same error "80041003 Access denied", whether I called the WMI Delete method using C#, or I used psexec to invoke this script remotely:
psexec \\ComputerName cscript c:\windows\system32\prnmngr.vbs -d -p "Microsoft Office Document Image Writer" -m "Microsoft Office Document Image Writer Driver" -r "Microsoft Document Imaging Writer Port:"
Both approaches (C# and prnmngr.vbs) worked with other printers on remote machines, which was my indicator that it wasn't a security issue with WMI itself. I barked up that wrong tree for 2 full days (if you search Google for WMI and Access Denied, you get lots of tips on fiddling with security settings under Control Panel>Component Services that really have nothing to do with the specific problem for the Microsoft Office Document Image Writer).
Unfortunately I haven't found a way to remotely remove the deny setting for the Network account on the Microsoft Office Document Image Writer printer, but I will post that too if I find an answer.

 

[jtoomey]

This did the trick to change the permissions and delete the printer remotely. It has 4 steps:
1) Copy over the free utility SetAcl to the C drive of the computer:
xcopy i:\hike\jt\setacl.exe \\ComputerName\c$

2) Give full rights to the Network account by running SetACL remotely (using the utility psexec to invoke it):
psexec \\ComputerName c:\SetACL.exe -on "ms office document image writer" -ot prn -actn ace -ace "n:Network;p:full"

3) Delete the printer, again using psexec to invoke it remotely:
psexec \\ComputerName cscript c:\windows\system32\prnmngr.vbs -d -p "ms office document image writer" -m "Microsoft Office Document Image Writer Driver" -r "Microsoft Document Imaging Writer Port:"

4) Delete the setacl utility
del \\ComputerName\c$\setacl.exe

 

[dgenesis]

The method overall was brilliant. Thanks for the guide. I had to doctor it a bit due to the forum's auto-smilies and some incorrect naming in the reference. Here's the revised guide:

• Download the SetACL program from http://helgeklein.com/
• Extract SetACL.exe from the downloaded compressed file to an accessible location (example C:\).
• Copy SetACL to Remote PC:
  

  xcopy C:\SetACL.exe \\{Remote Hostname}\C$

• Change NETWORK permissions on Image Writer:
  

  psexec \\{Remote Hostname} C:\SetACL.exe -on "Microsoft Office Document Image Writer" -ot prn -actn ace -ace "n:Network;p:full"

• Delete the Image Writer:
  

  psexec \\{Remote Hostname} cscript C:\Windows\System32\prnmngr.vbs  -d -p "Microsoft Office Document Image Writer" -m "Microsoft Office Document  Image Writer Driver" -r "Microsoft Document Imaging Writer Port:"

• Delete SetACL on Remote PC:
  

  del /q \\{Remote Hostname}\C$\SetACL.exe