Restricting Printing

[Iain.Faulkner]

Afternoon all,

I'm trying to restrict printing to some of our printers.

Just to give you the full situation, our school is split into 5 colleges and each college has its own designated IT Suite each with its own mono laser printer which is monitored by PCounter.

All network printers in school are deployed through Group Policy, and in theory the only PC's which can print to each printer are those which have been allocated it.

Unfortunately this isn't the case, roaming profiles (for staff) are storing printer mappings and as such staff are printing all over the school to printers in other colleges which is costing the other college's money for toner etc (I know some staff are doing this on purpose!).

What I'm trying to achieve, as a result, is to properly restrict which PC's can print to each printer. I had hoped to achieve this by editing the security settings on each printer, however if I put in here the pc names of those that I want to be able to print to it, it stops all users from printing until I add the users back in.

Is there a way in which I can achieve what I'm trying to do?

Any help anyone can provide will be gratefully received.

[sukh]

Hi

Are all of your staff split at each site, i.e will staff at college 1 only be located at that college?

Also, say for example, staff member 1 only allowed to print to their own college site?

Sukh

[eddyc]

Could you not put something in the logoff script to remove all of the printers attached to the profile and then add the one that they should have back in when they log on?
That is what we do and seems to work quite well.

[Iain.Faulkner]

Hi all,

sukh, apologies for not being clear. Our colleges are more like a traditional "House" system, they aren't physical buildings. All our staff are based on the one site.

ect, I don't suppose I can be cheeky and ask you to post the contents of the script you run?

[Willott]

Could Group Policy Preferences be used - don't know what OS your clients use. We use this for deploying/deleting printers - you can filter based on OU, machine details, all sorts, and set to delete all shared printer connections as one of the preference items (I'd suggest this being 1st one!).

[Iain.Faulkner]

We're Windows 7 across the board, thanks for that though I'll take a look and see if that will work.

[Willott]

Health warning on the above... once you've started on GPP you may end up converting any logon scripts etc you currently have (I'm going to be moving our drive mappings across to it shortly, have used it to deploy some files and registry settings to change our logon screen)! Nothing bad for your health really... just time consuming to start with (but pays off afterwards)

[Iain.Faulkner]

We did try to use this for drive mapping when we put vista in a few years ago, but it wasn't reliable. Not really tried it with 7 yet though, so definitely worth a try.

[CyberNerd]

Health warning on the above... once you've started on GPP you may end up converting any logon scripts etc you currently have (I'm going to be moving our drive mappings across to it shortly, have used it to deploy some files and registry settings to change our logon screen)! Nothing bad for your health really... just time consuming to start with (but pays off afterwards)

What does GPP do that makes it better than a scripting language>?

[Willott]

It's fully gui based, so easier to see where things are applying, and logging for it shows in event viewer which can be helpful for seeing where issues lie. It's probably more an alternative than better - the targetting is very easy to complete, which may be usefuly for some people, I wouldn't like to script some of the targetting which can be put in place.

Cheers

Will

[3s-gtech]

GUI

[CyberNerd]

I see, GUI - prettier but less options

[sukh]

If you can't get the script you can try point and click.

Description of the Point and Print Restrictions policy setting in Windows Server 2003 and Windows XP

[3s-gtech]

I see, GUI - prettier but less options

You'd think, but it's pretty good - for example, we use it to map our SIMS S: drive. It gives the option to hide the drive for users, plus the type of connection made to the drive.

[David_PCN]

Why not use client codes, then charge back the staff members department?