When the PaperCut Application Server (the primary server component) is installed on Windows, it starts under the local system account. In most cases the permissions provided by this local system account are adequate for the normal function of PaperCut. However, the permissions provided by this local system account are inadequate for the following services:
- Accessing trusted network resources (e.g. secured AD contexts) and network shares - Secured resources (e.g. domain contexts or network shares) may be required to perform functionality such as user synchronizing or shared account importing via a directory scan on a network share / mapped drive. But by default, the Windows SYSTEM account is prevented from accessing network shares.
- Delivering Winpopup system notifications (e.g. low balance notifications) to Windows clients running on your network.
To run the above as Windows services, you need to run the PaperCut Application Server using a domain service account rather than the local system account. It does not need to be a Domain Administrator account, just a domain account with local admin rights:
- Navigate to Control Panel → Administrative Tools → Computer Management → System Tools → Local Users and Groups and create a new domain service account/ local user account with the adequate level of access.
- Enable the option Password never expires.
- Navigate to Control Panel → Administrative Tools → Services → Properties → Log On
- Select the option Log on as: This account:
- Enter the credentials for the newly created account.
- Click OK.
- Restart the service.
- Use the domain service account just created while logging in and running the PaperCut Application Server.
Please note: If the account under which the service is running does not have local admin rights, then the PaperCut services might not start. Using an account which has adequate rights is the key to get it working as expected.
This procedure is required only when if you need to deliver Winpopup system notifications (e.g. low balance notifications) to Windows clients running on your network:
- Navigate to Start → Run to open the Registry Editor.
- Enter regedit.
- Click OK.
- Navigate to SYSTEM → CurrentControlSet → Control → Terminal Server → to locate the key HKEY_CURRENT_USER.
- Right-click on the HKEY_CURRENT_USER key and select AllowRemoteRPC.
- Click Modify.
- Change the value to 1.
Winpopup system notifications (e.g. low balance notifications) will now be delivered to all the Windows clients running on your network.