Printing Works Only for Administrators; Non-Admins Can’t Print

If you’re wondering why standard users can’t print (and only administrators can) especially after relocating your TEMP folder on your Windows computer, this article has the explanation and a fix.

Cause

Moving your Temp folder can sometimes cause printing issues in Windows, depending upon how the Permissions are set in the destination folder or drive. After changing your TEMP or TMP user environment variables to move your Temp folder to a different drive, the new Temp folder inherits the permissions from the parent, often resulting in missing NTFS Permissions for your user account.

After moving the TEMP folder, running the command “ICACLS %TEMP%” from Command Prompt typically shows the Permission entries as below, or slightly similar:

BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\Authenticated Users:(I)(OI)(CI)(IO)(M)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)

There are two things here. Your user account is missing from the list. Also, Authenticated Users and Users have Modify and Read/Execute accesses for your TEMP folder, which are not required. With the above Permissions, the following problems occur:

  • The test page doesn’t print from the standard user token, even if you’re an administrator. Elevated programs can print.
  • Microsoft Print to PDF generates a 0-byte file or does nothing when printed as a standard user.

In short, the following are the Permission entries we really need.

NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
W10-PC\Ramesh:(OI)(CI)(F)

*where Ramesh, in this example, is the user name.

Fix: Printing Works Only for Administrators

Here is how to fix the Permissions for the TEMP folder so that even non-administrators/Users can print.

Fix the TEMP folder Permissions

Open an elevated or Admin Command Prompt.



Type the following commands exactly as given below, and press ENTER after each command:

icacls %temp% /inheritance:r
icacls %temp% /grant %username%:(OI)(CI)F /T /C
icacls %temp% /grant Administrators:(OI)(CI)F /T /C
icacls %temp% /grant System:(OI)(CI)F /T /C
md %temp%\Low
icacls %temp%\Low /setintegritylevel (OI)(CI)low

The first command removes all inherited Permissions for the TEMP folder. The next three commands are to grant Administrators, SYSTEM, and your user account Full Control Permissions recursively (including sub-folders and files). And the last command sets the integrity level of “%TEMP%\Low” folder to Low Mandatory Integrity Level so that the folder can be accessed by programs running in low IL, like Internet Explorer. This needs to be set in order to avoid printing issues in Web browsers, like Internet Explorer.

Now you get this result when running “ICACLS %TEMP%“, which is exactly what we need.

That should fix printing issues related to incorrect NTFS Permissions. You can, of course, configure the same Permissions using Permissions dialog via Temp folder properties, but I personally prefer Icacls because it’s a quicker way to accomplish the task. If you’re doing it using the Permissions tab, it should eventually look like this.


One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded Winhelponline.com in 2005.

7 thoughts on “Printing Works Only for Administrators; Non-Admins Can’t Print”

  1. Well done Sir!
    It was pretty helpful to fix my printing issues in Win 10.
    If have moved the %temp% folder since NT times back in the 1990s and did not face this before.
    BR, some thankful guest 😉

    Reply
  2. My AppData file was faultless (it already looked like you showed), so there must be another reason for why I cannot print PDFs from Outlook with “Microsoft print to PDF”
    (I was “force updated” to Win 10 (Pro in my case) last summer)

    Reply
  3. This kinda solved the problem. The issue is, I have to do this every new day I turn on the PC. Is there a way to keep these changes forever?

    Reply
  4. Thanks. It solved a problem I have had for a couple of months for which I have tried other solutions that were aimed at correcting problem with the spooler system.

    Reply
  5. Thank you very much. This solved the problem for one of my customers.

    I especially like that you provided command line instructions. Much appreciated!

    Reply

Leave a Comment