Install Colour printer only for staff - but flexibly...

[sonofsanta]

As for everyone, printing here can cost a bit. We're not as bad as many but it's still been largely unrestricted so there is definitely room for improvement.

 

We're just about to go onto lease-hire to cut down costs, but I'd like to cut down usage as well - in particular, colour. First, the background.

 

Current Situation

At the moment there's a lot of redundant machines, because where we want colour for staff and mono for students, there are physically two printers - one colour, one mono, and the colour is only added for staff.

 

We're a vanilla Win2003 R2/XP environment, with printers added via GPO (pushprinterconnections.exe), and we do run PCounter (2.40), although we barely use it to any of its potential.

 

What we're doing

With the new lease hire printers, we're consolidating such situations to just one colour printer, and what I'd like is for staff to have colour available, and students to only have mono.

 

I want it to be able to add the relevant colour printer for a room, so ideally the GPO should be added to the computer OU, not the user. I can then create two printers in PCounter - one that is forced to mono (deletes any colour jobs) and one that allows colour that is only added for staff, through security filtering. If we can get hold of mono/colour drivers we can do it that way, instead.

 

Ideally I want to be able to add students to this group as necessary as well - i.e., coursework time, rather than the teacher having to do all the colour printing we can just add the relevant students into the group for the time being to allow them colour, and remove them at the end.

 

Just to add to the complication as well, I want a couple of rooms to always be able to print in colour (e.g. Art), regardless of who is logged on - so if it's a one off colour job, instead of the student having to be added to the group, log off, log on, print, we remove them from the group etc. - instead, they can just go to the relevant room and log on there to print in colour.

 

Options

:confused:Can I create a GPO that uses pushprinterconnections as a user script, uses security filtering, and add this GPO to the computer OUs? Is it that easy? I could then create a separate GPO for the rooms that should always have colour that just pushes that out at a machine level.

 

:confused:Would it be easier, perhaps, to just add the printer once, as colour, but price colour in PCounter so that students can't afford to print? Staff are unlimited. We can then change a student to unrestricted when necessary. The always-colour-rooms just won't have the multiplier applied in PCounter.

 

:confused:Does other software do this better/easier? Paperclip gets mentioned a lot round here. Obviously, though, this involves spending money so I'm keen not to reinvent the wheel (as it were) by purchasing software to replace software we already own.

 

-----

 

I'm going to play with options anyway, as much as anything this post is just about forcing me to put everything down in writing so I can work it through in my own head, but if anyone has already solved this problem with a flash of inspiration that I've so far been denied, please let me know!

 

ADDED BONUS: If anyone knows how to force the default printer as well, that'd be lovely, so I can make the mono option the default for staff. I suppose I could always add the mono-only exclusively for students, and colour for staff, and just default that printer to mono - might be better as they will just choose colour in the normal way then.

[plexer]

Deploying printer information using a vbs as we do aloows us to set the default printer to whatever we require.

 

Ben

[sonofsanta]

We used scripting at my last place and it was always a horrible cludge :/ I know there will be a better way of doing it than the way it was done there, but it leaves a bad taste. GPO control is more flexible if we suddenly want to push a printer out to another room.

 

Obvious thought of obviousness: loopback processing is designed for just this scenario. Not that I've used it before, though, so could someone advise on best way to implement it? Should I add the printer as a computer script (startup) or user script (logon) if I use loopback processing?

[sonofsanta]

An update, after a day of frustration.

 

Loopback sort of works. Because the GPO is applied to machine OUs, the printer needs to be deployed per-machine, not per-user. Running pushprinterconnections at user logon does add the printer at a user level - it takes a few seconds after logon for it to appear, whereas the printers added at startup are already there.

 

So far, all good.

 

However, when I then try and apply security filtering - so that the GPO only applies to members of the DL Staff group - nothing happens. This is because the machine itself is not part of that group, so I add Domain Computers to the filtering as well. At that point, because the computer is always allowed the GPO, the printer is always added regardless of who logs on. This is completely useless to me.

 

I've not had a further chance to play today, but if anyone knows a way of making the security filtering operate on an AND basis instead of OR, or another way around this problem, please let me know. My next option is to create groups for the machines that reflect the rooms (therefore duplicating the OU structure, but with groups) so that I can then add the OU to the Staff OU and filter by computer group. I suspect that would work, but be a lot messier, a lot more work with creating the groups etc. and be harder to read what printers are where in AD. Right now you can expand a computer OU and see what printers are linked there; this way, you'd have some (the mono printers) added like that, others added in a long list at the top of the user OU tree, and the useful information hidden away in the groups.

 

Someone out there smarter than me at AD must have found a way around this already - any advice?

[AngryTechnician]

Group Policy Preferences will do all of this, but only once it's patched with hotfixes as even the version shipped with Windows 7 doesn't work properly with OU or security group filtering.

 

If you're willing to push out the patches and have at least one Vista/7 machine to configure the policies, you could be in business.

[sonofsanta]

Group Policy Preferences will do all of this, but only once it's patched with hotfixes as even the version shipped with Windows 7 doesn't work properly with OU or security group filtering.

 

If you're willing to push out the patches and have at least one Vista/7 machine to configure the policies, you could be in business.

 

Alas, we are all XP, and my home PC & laptop are both Win7 Home so no joy there either

 

Planning to try the groups thing today/Monday, this is all just very frustrating because it is just a logic problem and I should be able to brute force my way through it. Why does reality insist on dirtying up my pristine logical constructs?

[teejay]

When we were on 2003, the best way we found is to run the script below from a batch file for each PC in the room. This only needs to be run once from your technicians PC and will deploy the printers permanently (unless of course you reimage etc when it needs running again).

@Echo off
REM this command file will add a network printer to a computer remotely

REM the parameters are:

REM   1 - the name of the computer to which the network printer is to be added
REM   2 - the UNC name of the printer to be added

REM for example, to add the printer called ThePrinter that is shared from the computer PrintServer
REM    to the computer called TheClient:

REM  key this command in a Command Prompt window:

REM     addglobalprinterremotely theclient printserver\theprinter


REM add the specified printer to the specified computer 
@Echo On
rundll32 printui.dll,PrintUIEntry /ga /c\\%1 /n\\%2
@Echo off
REM stop the print spooler on the specified computer and wait until the sc command finishes
@Echo On
start /wait sc \\%1 stop spooler
@Echo off
REM start the print spooler on the specified computer and wait until the sc command finishes
@Echo On
start /wait sc \\%1 start spooler

[sonofsanta]

When we were on 2003, the best way we found is to run the script below from a batch file for each PC in the room. This only needs to be run once from your technicians PC and will deploy the printers permanently (unless of course you reimage etc when it needs running again).

 

Bit iffy about the scripting route because it's not as descriptive as AD is, but at this point I'm willing to give anything a go. Can't see anything in the script that would filter the installed printers based on the logged on user though?

 

 

I should add to the general thread as well that I've tried denying student access to the printer, which does stop them printing, but it doesn't stop the printer from appearing in the printer list. If you try and select the error it throws an error, still shows the (incorrectly) selected printer in the drop down but actually sends the job to the last printer selected, which will just cause no end of confusion and complaints from students thinking they should be able to access it - particularly as the error doesn't say access denied, it waffles on about network issues etc.

So really, need to find a way to hide the printer altogether, or just stop it being added altogether. I'll have an answer soon, I'm sure, it's just finding time to investigate!

[teejay]

Bit iffy about the scripting route because it's not as descriptive as AD is, but at this point I'm willing to give anything a go. Can't see anything in the script that would filter the installed printers based on the logged on user though?

 

 

I should add to the general thread as well that I've tried denying student access to the printer, which does stop them printing, but it doesn't stop the printer from appearing in the printer list. If you try and select the error it throws an error, still shows the (incorrectly) selected printer in the drop down but actually sends the job to the last printer selected, which will just cause no end of confusion and complaints from students thinking they should be able to access it - particularly as the error doesn't say access denied, it waffles on about network issues etc.

So really, need to find a way to hide the printer altogether, or just stop it being added altogether. I'll have an answer soon, I'm sure, it's just finding time to investigate!

 

If you create a batch file for each room which calls the script above for each machine , for instance:

 

call addprinterremotely.cmd machine1 printserver/printer1

call addprinterremotely.cmd machine2 printserver/printer1

....

 

All you do then is on the print server set a security group on the colour printer that denies access for all students.

This really was the easiest and most robust way we found of doing this, wish we could still do this in 2008 R2/W7. It also made it simple if staff wanted students to print in colour for a lesson as you just change the deny access to allow access on the security group.

 

Edit: if you deny all on the printer rather than just printing then its shouldn't appear.

[sonofsanta]

If you create a batch file for each room which calls the script above for each machine , for instance:

 

call addprinterremotely.cmd machine1 printserver/printer1

call addprinterremotely.cmd machine2 printserver/printer1

....

 

All you do then is on the print server set a security group on the colour printer that denies access for all students.

This really was the easiest and most robust way we found of doing this, wish we could still do this in 2008 R2/W7. It also made it simple if staff wanted students to print in colour for a lesson as you just change the deny access to allow access on the security group.

 

Edit: if you deny all on the printer rather than just printing then its shouldn't appear.

 

Seems like the script is doing the same thing as a GPO would, then, and it was the security filtering on the printer that actually prevents students from printing. Which I'm trying to do and having little success with, mystifyingly - with the Domain Local group "All Students" set to Deny on everything listed, applying to printer and documents, it is still showing the printer, it's just denying any action you try to take with it. Which is the effect I want, but with the added risk of students coming and complaining because they think they should be able to print to it. I've even denied Full Control to that group on the GPO and still the printer is visibly added at logon (even after unlinking the GPO, gpupdate, relink, gpupdate, so it is not because the printer is cached in the profile).

 

I have time for further experimentation today, so I will try the computer groups approach, but so far I've not made much progress :/ really don't know why deny permissions on the printer aren't stopping this!

 

(and thanks added for your help so far, cheers)

[sonofsanta]

Right, I'm pretty much giving up on doing this with 2k3 GPO's now.

 

Trying to apply the GPO to the users and filter with a security group for the computers failed in the same way as before, albeit with the opposite result; adding that printer to all staff and trying to filter to apply to just the computers in one room just adds the printer to all staff, everywhere, all the time.

 

So I can filter by location OR by user type but not by both. Rubbish. My 2k8 servers can't come soon enough! (and probably won't come for ages yet if this year's budget is how I'm expecting it to be...)

 

Unless anyone has another stunning insight that has escaped me, then, or a way of running GP preferences on a pure 2k3/XP environment... I think I'll just do this with PCounter, by adding the printer twice, forcing one to mono, and setting the colour version to cost 51 credits to print to - thus preventing students from using it. This at least has the advantage of it being an immediate change if a student needs to print colour, without them needing to log off/on again. Disadvanage is they will all see the printer and try and use it and complain when it doesn't work.

 

Cheers to those who pitched in, can't believe this has been such a challenge, it seemed so obvious a request when I started working it out!

[SteveBentley]

Something I did last time we reconfigured the printing was to create two queues for each printer, one the real one and the other a fake (with the same driver) with a more descriptive name. The fake queue has an unconditional forward rule in PCounter to the real printer.

 

What this means is that if a printer dies or is replaced, you can change where the fake printer forwards to and it should be seamless to the users.

 

You can also then have multiple fakes, with different permissions for different charging levels for staff and students.

 

In terms of dishing out printers to machines, this is how we used to do it before 2008

 

On Error Resume Next

set wshnet = CreateObject("WScript.Network")
set wshshell = wscript.CreateObject("WScript.Shell")

username = wshnet.userName
domain = "yourdomain"
computername = wshnet.computerName

set adsgroup = GetObject("LDAP://ou=staff,dc=ad,dc=you,dc=sch,dc=uk")
if adsgroup.IsMember("LDAP://cn=" & username & ",ou=staff,dc=you,dc=sch,dc=uk") then


wshnet.AddWindowsPrinterConnection "\\server\printershare"
wshnet.SetDefaultPrinter "\\server\printershare"
end if

wscript.quit

 

 

The member of stuff works for member of groups as well, although not recursively

 

set adsgroup = GetObject("LDAP://cn=staffprinter,ou=staff,dc=you,dc=sch,dc=uk")

[sonofsanta]

I like the idea of fakes with the forwards - that might be easier than a few other ideas I've had. I'm going to sit down and hammer out my logic on this tomorrow and work out how I'm going to do it - I suspect there are a few approaches I could take, I just need to decide which is the cleanest.

 

Cheers!

[MatthewL]

We use pushprinterconnections but its not brilliant, some sort of VBS script would be better based on computer name.

 

If you use PCounter you can put a rule in to disallow colour and allow if for a certain group of users.

 

I am based in North East Lincolnshire so if you need anything drop me a line and I will assist.

[mac_shinobi]

You could have an else section so that if they are not a member of said group then it will loop through and remove all printers or I think you would normally do this before having said chunk of code to check which group(s) they are a member of

[MYK-IT]

You can run Group Policy Preferences fine with Windows XP Clients and on a Windows 2003 Domain.

 

We have been using this, doing exactly what your after; deploying printers (with targeting) amongst other things like mapping drives etc.

 

The only extra item you may need is one Windows 7 Pro Client to configure / create the new GPO (admx) policies.

 

1) Install Group Policy Preference Client Side Extensions for Windows XP (KB943729) on every Windows XP Client (can also deploy via WSUS)

Download details: Group Policy Preference Client Side Extensions for Windows XP (KB943729)

 

2) Create a Group Policy Central Store

Creating a Group Policy Central Store

http://download.microsoft.com/download/3/b/a/3ba6d659-6e39-4cd7-b3a2-9c96482f5353/managing_group_policy_admx_files_step_by_step_guide.doc

 

3) Install RSAT and GPMC on your Windows 7 Client (this will allow you to manage the policies)

Download details: Remote Server Administration Tools for Windows 7

 

You could create GPOs that reside within the Computer Accounts OU and enable Loop Back Processing (with Merge enabled) or you could have 1 GPO for the domain, that uses Targeting (ie check computer name / username / security group member etc) to map the correct printer.

 

Within the policy, i normally have remove all network printers first, then map each printer accordingly (with remove item when no longer required enabled). This ensures only your required printers are added and is also helpful if you rename or reconfigure printers; or even change print server.

Edited November 16, 2010 by MYK-IT

[sonofsanta]

If you use PCounter you can put a rule in to disallow colour and allow if for a certain group of users.

 

I'm on PCounter 2.40c (and no maintenance, so no free upgrade) and I can't see groups in the rules anywhere - I can see all the stuff for "if colour, delete/forward/etc." but nothing that would let it decide based on group. Am I just looking in the wrong place? PCounter can see groups for the accounting, but they don't show up in PControl anywhere.

 

VBS scripts might be worth a bit of investigation, I am rusty beyond belief with them but there's no difference in deployment between them and pushprinterconnections as far as GPOs are concerned. Should be a man from the printer company coming in today/tomorrow to discuss how we can go about this anyway, and show me a bit more of PCounter, so I might ask him on the best way he knows of doing this.

[sonofsanta]

You can run Group Policy Preferences fine with Windows XP Clients and on a Windows 2003 Domain.

 

We have been using this, doing exactly what your after; deploying printers (with targeting) amongst other things like mapping drives etc.

 

The only extra item you may need is one Windows 7 Pro Client to configure / create the new GPO (admx) policies.

 

I'd pretty much come to the conclusion that to do it the way I wanted - i.e. pure GPO - was going to have to wait till 2008R2 over the summer (if the financial gods are kind, anyway). I'd look at doing it now except I don't have anything Windows 7 Pro lying around (home machines are on Home cos I cheaped out ) and I need to start rolling the printers out today/tomorrow, so I really need to make do with what I have lying around at the moment for now.

 

Once we get 2008R2 in, though, I thoroughly intend to use GPP to do this, from what I've seen it looks wonderfully useful, I just can't believe it took them so long to get them in place!

[Ric_]

Wouldn't a better solution be as follows...

 

Default all the devices to mono so that users have to select colour in the printer properties. Then only allow certain users access to colour printing via PCounter. If a user is not allowed to print colour, the job will be deleted.

 

Seems obvious to me and you use a simple login script of Goup Policy to deploy your printers.

[sonofsanta]

Wouldn't a better solution be as follows...

 

Default all the devices to mono so that users have to select colour in the printer properties. Then only allow certain users access to colour printing via PCounter. If a user is not allowed to print colour, the job will be deleted.

 

Seems obvious to me and you use a simple login script of Goup Policy to deploy your printers.

 

This is broadly the route I'm going down now, given my lack of group policy preferences. Printers will be defaulted to mono duplex, and the cost of colour printing will be set to 51x the cost of mono. Doing this, students (with 50 credits) will be automatically denied, but teachers (with unrestricted) will be fine. We don't use PCounter for accounting so the effect on the figures isn't important. The advantage of this is that if a student needs to print in colour, we can temporarily grant them unrestricted printing, or if a classroom needs it, we can change the weighting from 51x down to a normal level. The disadvantage is chiefly in the confusion this might create, with students trying to print colour and coming to complain that they can't, but hopefully the message will spread (and I will use PCounter's messaging service to help) that this is the intended functionality.

 

It would be nice if PControl could see user groups but sadly it can't, at least not as far as I can tell in 2.40c.

 

The other disadvantage is that it just doesn't seem as neat to my mind, but I shall have to deal with my personal issues myself I fear!

[browolf]

I'm amazed the teachers aren't insisting that kids need to print colour sometimes.

[sonofsanta]

I'm amazed the teachers aren't insisting that kids need to print colour sometimes.

 

Perhaps largely because I haven't broken the news to them yet...

 

Kids will need to print in colour sometimes, so if they do, they can either give the work to their teacher (e-mail or using the shared Submissions folder) or get the teacher to email us asking for it to be enabled for that student. The real advantage of the PCounter method is that by restricting colour through credits, it's an instant solution. No logging off and on again to get the colour printer added; instead, they send us an email, we tick a box and they can print in colour immediately.

 

If we left colour on all the time, the lunchtime printing would be enormous, and although we could restrict that with timings in 2k3, you would still get plenty of waste in lessons. Students printing powerpoints out at one slide per page, full colour, are the bane of my printing existence. By deliberately making it a bit awkward we're creating a sort of "soft" restriction, and introducing a policing step with the teachers, where any time a student asks to print in colour, the teacher can make sure they are really ready to print in colour.

 

It remains to be seen how well all this will go down!

[36Degrees]

Deploying printer information using a vbs as we do aloows us to set the default printer to whatever we require.

 

Same here. The script detects which OU the computers are in and installs the printers accordingly and there is a shortcut to the script on their desktop in case it doesn't work for any reason (script itself is in a folder on the network with appropriate permissions set to allow access but prevent tampering, etc). This is only done for student installs as the teacher can install printers manually.

[sonofsanta]

most of our colour printers default to mono but the kids can change it themselves but they're restricted by how many pages they can do at a time, and it's low. 8 pages mono, 5 colour I think. Actually the staff are restricted like that too. We want them to use photocopiers...not printers as photocopiers. (we use papercut), You should be able to do that with p-counter. You have to be careful not create too much work, otherwise on balance the cost of teacher's time and your time outweighs the cost of excess printing.

 

Yeah, PCounter can reject on number of pages or number of copies. I certainly intend to restrict on copies, but not on pages, as some of the coursework grows, and can be large. I don't want to create a queue of 30 kids at Repro every time ICT finishes up their coursework.

 

The balance is the tricky thing here, and what I'm trying to work out. Nothing is set in stone, though; if there is sufficient demand for colour that it's imposing on staff time too much, I'll happily review it. I want to keep costs down, but I also don't want to limit the use and growth of ICT in the school. Should it start becoming an issue, I can just change the weighting on colour printing so that students can print a few pages of colour, but they have to weight that against the potential loss of printing further down the line.

 

I should note that there will also be a few printers in school without these restrictions, so that Art (for example) can print freely to colour without involving the teacher, and the colour printer just outside our office will be unrestricted so kids can just come to us and print in colour hassle free.

[browolf]

Perhaps largely because I haven't broken the news to them yet...

 

Kids will need to print in colour sometimes, so if they do, they can either give the work to their teacher (e-mail or using the shared Submissions folder) or get the teacher to email us asking for it to be enabled for that student. The real advantage of the PCounter method is that by restricting colour through credits, it's an instant solution. No logging off and on again to get the colour printer added; instead, they send us an email, we tick a box and they can print in colour immediately.

 

If we left colour on all the time, the lunchtime printing would be enormous, and although we could restrict that with timings in 2k3, you would still get plenty of waste in lessons. Students printing powerpoints out at one slide per page, full colour, are the bane of my printing existence. By deliberately making it a bit awkward we're creating a sort of "soft" restriction, and introducing a policing step with the teachers, where any time a student asks to print in colour, the teacher can make sure they are really ready to print in colour.

 

It remains to be seen how well all this will go down!

 

I think it auto-posted that previous reply I abandoned. damn you ajax.

 

You got to be careful with stuff like that, teachers will soon work out its easier for them to send kids to you than do anything themselves. You might save on printing costs but overall the cost of everyone's time dealing with it might be more.

 

We find the most efficient system overall is to default to mono, allow people to change it themselves but restrict (low) how many pages they can do. That applies to teachers too. In some respects teachers are worse culprits for wasting prints. Teachers have photocopiers they can use for bulk printing.

 

One way to improve efficiency of having teachers do colour printing for students is allow them read only access to kids user areas through a distributed file share.

Edited November 17, 2010 by browolf