SPLCTL authority removal

Hello all,

We're going through remediation for a pen test that was done at my company. A LOT of the normal users in the plants have both JOBCTL and SPLCTL authority. I know that they should ideally not have either one. Removing them is easy enough, but the havoc it might cause is what I want to avoid. We have an ERP system (CMS) that has built-in commands for accessing printer writers and being able to start/stop them. These are pretty heavily used throughout our plants. A colleague reminded me that removing the SPLCTL authority will restrict these users from starting their own printers. I've tested this by making a dummy copy of a typical user's account and removing SPLCTL and then trying to start the printer, and of course it doesn't work.

I'd really like to avoid going through a whole process of changing menus and using adopted authority, etc. to then be able to remove SPLCTL authority. Anyone else had this quandary and found a simple solution? Thanks in advance for any info.

Bill