Stop printing from MAC Laptop

[apur32]

I need the solution regarding the MAC Laptop printing. We manage printers with pcounter on MS Windows 2003 network. The staff members who have their own mac laptops can directly print bypassing Pcounter to any network printer ( Even if I pause it on the server they still can print).

Any suggestion to stop this on the server or on the printers rather than on the staff mac laptops.

[apur32]

Any response on the following question. I know there are lots of geek out there who can help

I need the solution regarding the MAC Laptop printing. We manage printers with pcounter on MS Windows 2003 network. The staff members who have their own mac laptops can directly print bypassing Pcounter to any network printer ( Even if I pause it on the server they still can print).

Any suggestion to stop this on the server or on the printers rather than on the staff mac laptops.

[K.C.Leblanc]

What printers are you using?

Some might let you restrict which I.P. adresses they'll recieve print jobs from, you could tie it down to just your printer server. If you're really determined (and have managed switches) you could also put all your printers in a separate vLan and then multihome your printer server in both vLans.

EDIT: It also might be worth seeing what happens when you disable 'bonjour' on the printers.

[apur32]

We are using all HP printers most of them are HP laserjet 3505n.

This vlan look like good solution. Can you please elaborate more on it.

But we have other windows laptops which we want them to print wireless.

How will this happen? Will they be keep on printing through print server even if they are on different VLAN.

[pwds]

I'd be looking to disable all protocols except those used by the print server (which should stop Mac printing) and also restrict the printer to only accept jobs from the IP address of your print server if this is supported.

Since only jobs sent through the print server will have that originating IP address as far as the printer is concerned, students won't be able to avoid sending through PCounter. Jobs sent from elsewhere will be ignored.

If you go down the VLAN route it is possible for the NIC on your print server to have an IP address on both VLANs so it can communicate but probably best not attempted if you've not done it before unless you're also short of IP addresses on your network.

[David_PCN]

You could look at PrinterOn - It's an add on to Pcounter which allows users to print from their own laptops, home PC's or java enabled devices even if they are not authenticated for security reasons.

[mdrabble]

Are the mac users logging on to the network or just connecting for certain services.

One possible way (although I have never tried this and is just a thought)

If they are not logging on to the network, remove the everyone group from the security permissions on the printer and replace with authenticated users.
Anyone who logs on to the network get authenticated and should be allowed to print etc.
Mac users who are just connecting and not logging on are not authenticated and should not be allowed to print.

Should work but like I said I have never tried it.

Hope that makes sense........

[p858snake]

Take the security rights away from the printers, All you want is the security groups that you need. (and if you want you can add the wants and put in a deny if you ever so desire)

[Arcath]

If the problem is that instead of printing to \\PrintServer\Printer the Macs are creating thier own port to it so isntead of requiring usernames and passwords and the permissions on the server they simply print direct to it.

VLANs would solve this by placing the printers on a "seperate" network, so the "Find a printer" wizard in mac os wont find the printers and they would have to add them via the print server and hence get your security.

To do this would would have to setup a VLAN for printers, so lets say the curriculum network runs on VLAN1 (i know 1 is special for for demos sake lets just roll with it). Every port in school bar the printer ones would need to be un-tagged members of VLAN1 and all the Printer ports members of VLAN2. All the inter-switch cables would need to be on both VLANs as tagged members (asin they tell the next switch which VLAN the packet came from). The next step is too have the print server on both networks either by having 2 network cards or using a VLAN utility to split the 1 card (HP have one that lets you change IPconfig per VLAN). if you use a utility you want 1 tagged port, if not you want 2 un-tagged. If you are using reservations for the printers you will need to add the DHCP server to VLAN2 aswell.

With that the print server is the only thing able to communicate with the printers, so all print traffic has to go through it.

As has been mentioned do some research first and try a small scale test as VLANing can cause lots of problems during setup if you don't think things through. This wont work if any of your switches don't support VLANs or if you have any hubs on the end of cables as you will be VLANing off every printer and this will most likely mean having a VLAN that spans the entire site and every switch.

My instructions have no guarantee of working, and i would reccomend you look into the other possibilities as you may find that you can solve other problems with them.