Using a domain administrator service account (Windows)

KB Home   |   Using a domain administrator service account (Windows)

When the PaperCut Application Server (the primary server component) is installed on Windows, it starts under the local system account. In most cases the permissions provided by this local system account are adequate for the normal function of PaperCut. However, the permissions provided by this local system account are inadequate for the following services:

  • Accessing trusted network resources (e.g. secured AD contexts) and network shares - Secured resources (e.g. domain contexts or network shares) may be required to perform functionality such as user synchronizing or shared account importing via a directory scan on a network share / mapped drive. But by default, the Windows SYSTEM account is prevented from accessing network shares.
  • Delivering Winpopup system notifications (e.g. low balance notifications) to Windows clients running on your network.

To run the above as Windows services, you need to run the PaperCut Application Server using a domain administrator service account rather than the local system account:

  1. Navigate to Control Panel → Administrative Tools → Computer Management → System Tools → Local Users and Groups and create a new domain administrator service account/ local user account with domain administrator level access.
  2. Enable the option Password never expires.
  3. Navigate to Control Panel → Administrative Tools → Services → Properties → Log On
  4. Select the option Log on as: This account:
  5. Enter the credentials for the newly created account.
  6. Click OK.
  7. Restart the service.
  8. Use the domain administrator service account just created while logging in and running the PaperCut Application Server.

Enable Remote Procedure Calls (RPC) on all Windows clients

This procedure is required only when if you need to deliver Winpopup system notifications (e.g. low balance notifications) to Windows clients running on your network:

  1. Navigate to Start → Run to open the Registry Editor.
  2. Enter regedit.
  3. Click OK.
  4. Navigate to SYSTEM → CurrentControlSet → Control → Terminal Server → to locate the key HKEY_CUREENT_USER.
  5. Right-click on the HKEY_CUREENT_USER key and select AllowRemoteRPC.
  6. Click Modify.
  7. Change the value to 1.

Winpopup system notifications (e.g. low balance notifications) will now be delivered to all the Windows clients running on your network.

See also


Categories: Implementation / Deployment

Comments

Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.

Article last modified on June 13, 2017, at 01:30 PM
Printable View   |   Article History   |   Edit Article