+ Post New Thread
Results 1 to 9 of 9
Windows Thread, Windows Picture & Fax Viewer + Printer in Technical; Just recently I have discovered a problem that could be a security loophole. Basically I have disabled all our students ...
  1. #1

    Join Date
    Jun 2008
    Posts
    718
    Thank Post
    118
    Thanked 64 Times in 52 Posts
    Rep Power
    31

    Windows Picture & Fax Viewer + Printer

    Just recently I have discovered a problem that could be a security loophole.

    Basically I have disabled all our students from adding/deleting/searching in the 'Printer and Faxes' for printers through GPO. However, this goes right out of the window because students can easily add a printer using the Windows Picture & Fax viewer.

    They simply open up a picture, click on the print icon, click next and it's from here they can then click 'Install Printer' and search for printers across the network.

    Is there any way I can prevent students from doing this? I'm having a problem whereby they are adding most of the SMT printers and printing to them. On one occasion someone sent 700 copies of a nude Pamela Anderson to the principal's printer. Thankfully he was out on a meeting all day.

  2. #2

    elsiegee40's Avatar
    Join Date
    Jan 2007
    Location
    Kent
    Posts
    11,067
    Thank Post
    1,792
    Thanked 2,187 Times in 1,618 Posts
    Rep Power
    773
    The way I have got round this may be slow and painfiul if you have many printers that you don't want the students to print to.

    I have used the security tab for the banned printers and only allowed staff and administrators permission to use the printers... removing all mention of pupils. Having inadvertently removed my own permissions for said printers I have discovered you definitely can't add them by any means to use them.

    EDIT

    If they're local printers, you'll have to logon with admin rights to the appropriate PC, I think
    If they are network printers, you can use Papercut, Print Manager Plus or similar to block their use by students
    Last edited by elsiegee40; 10th December 2008 at 10:28 AM.

  3. #3

    webman's Avatar
    Join Date
    Nov 2005
    Location
    North East England
    Posts
    8,406
    Thank Post
    639
    Thanked 961 Times in 661 Posts
    Blog Entries
    2
    Rep Power
    324
    If your printers are shared from the servers, can't you just set the appropriate security per-printer to ensure students don't have the rights to print to them?

    EDIT: ^ ^ What she said

  4. #4

    broc's Avatar
    Join Date
    Jan 2006
    Location
    England
    Posts
    2,046
    Thank Post
    104
    Thanked 401 Times in 265 Posts
    Rep Power
    150
    Our print management software is set up to throw away any printout that comes from Picture and Fax viewer....... or anything that has http in the document title... saves a fortune in printing costs.

  5. #5

    Join Date
    Jun 2008
    Posts
    718
    Thank Post
    118
    Thanked 64 Times in 52 Posts
    Rep Power
    31
    Quote Originally Posted by elsiegee40 View Post
    The way I have got round this may be slow and painfiul if you have many printers that you don't want the students to print to.

    I have used the security tab for the banned printers and only allowed staff and administrators permission to use the printers... removing all mention of pupils. Having inadvertently removed my own permissions for said printers I have discovered you definitely can't add them by any means to use them.

    EDIT

    If they're local printers, you'll have to logon with admin rights to the appropriate PC, I think
    If they are network printers, you can use Papercut, Print Manager Plus or similar to block their use by students
    I've done this to all the printers in the school now. Created a security group and put in the students to prevent them from doing this to all standalone printers. Especially the SMT printers.

    However, I would still like these students to print to other printers when they're in a particular classroom. For example, students are in classroom 1 and print to classroom 2 printer. You ban them from printing to that printer using a security group, but what happens afterwards? They go to classroom 2 and then find they can't print to it. Is there some other way to do this?

  6. #6

    Join Date
    Jun 2008
    Posts
    718
    Thank Post
    118
    Thanked 64 Times in 52 Posts
    Rep Power
    31
    Quote Originally Posted by broc View Post
    Our print management software is set up to throw away any printout that comes from Picture and Fax viewer....... or anything that has http in the document title... saves a fortune in printing costs.
    What print management software are you using?

  7. #7

    broc's Avatar
    Join Date
    Jan 2006
    Location
    England
    Posts
    2,046
    Thank Post
    104
    Thanked 401 Times in 265 Posts
    Rep Power
    150
    Quote Originally Posted by Chuckster View Post
    What print management software are you using?
    PCounter for Windows.

    We bought it after we caught a student who had just finished printing enough A4 colour images to paper her bedroom walls ......

  8. #8

    broc's Avatar
    Join Date
    Jan 2006
    Location
    England
    Posts
    2,046
    Thank Post
    104
    Thanked 401 Times in 265 Posts
    Rep Power
    150
    We run a VBS script which deletes all non-local printers from student systems at startup and adds new ones based upon an environment variable we set up called 'LOCATION' (I think the script was downloaded from Edugeek & modified locally).

    The first time the script runs the drivers get copied from the print server.

    We then run the same script when the students log on, this adds the printers to their sessions. As the drivers are already loaded they don't need permission to install printers. GPO prevents students using Add/Remove printer to change our selection.

    This process means students only get printers local to where they are working.

    I an sure this is/was described elsewhere on Edugeek; I claim no credit, I certainly didn't invent it!

  9. #9

    elsiegee40's Avatar
    Join Date
    Jan 2007
    Location
    Kent
    Posts
    11,067
    Thank Post
    1,792
    Thanked 2,187 Times in 1,618 Posts
    Rep Power
    773
    This thread has the script Broc's talking about. It uses the computer name to work out which room the user is in.

    A Printer Script

SHARE:
+ Post New Thread

Similar Threads

  1. Removeing MS XPS Document Writer & Symantec Fax Starter Ed
    By atfnet in forum How do you do....it?
    Replies: 13
    Last Post: 10th July 2011, 11:58 AM
  2. Samsung Network Laser B&W Printer £30!
    By FN-GM in forum Recommended Suppliers
    Replies: 1
    Last Post: 10th September 2008, 12:26 PM
  3. Printing to Windows Printer
    By ahunter in forum Mac
    Replies: 4
    Last Post: 1st February 2008, 12:35 PM
  4. Replies: 7
    Last Post: 27th September 2006, 08:19 AM
  5. Print Management & GPO Printer Installs
    By RobC in forum Windows Vista
    Replies: 1
    Last Post: 7th July 2006, 09:42 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •