"Follow me" printing question

[andyturpie]

Morning,

 

We are due to roll out "Follow me" printing within the school in November. We have selected Papercut embedded devices.

 

To keep things simplistic, on AD we have changed user names to numbers for staff (pupils use their enrolment number anyway), to make it quicker to authenticate at the devices. After my NM spending around 8 hours editing all the staff accounts we are still getting "concerns" around print queue security.

 

My question is if you run this operation, how are you releasing prints more securely than just entering in your user ID or are staff here worrying over nothing?

 

 

Cheers!

 

AJT

[plexer]

You've changed all your users usernames to numbers? are you mad?

 

Surely they could have an id number in any other ad field, employee number for example and the software would have been configured to look at that field for it's auth?

 

Ben

[andyturpie]

Mad? I'm borderline furious lol..

 

As we are a CC4 network it was easier to go down the route of editing the username to numeric within RMMC. Okay, yesterday we had to sync back up a few Outlook mailboxes to 365, but so far it didn't cause too many issues. For us now the "issue" is not what the staff member uses, but how to stop any accidental or willful attempts to view another users print queue from the device.

[Ephelyon]

PaperCut supports user PINs and auto-enrolment (so the first time they just enter their user name/ID and it asks them to set a PIN). They then use a combination of both to log into the printer.

[rickypike]

I simply added a 4 digit print code in the 'Pager field in AD for staff account and used the Sims admission number for the print code for students as these are unique.

 

Staff are linked to shared Accounts and students just print to a personal account with a set credit limit.

 

I just then configured Papercut to Update the users' unique card/identity number from the AD/LDAP field - 'Pager'

 

Works great here, never had any problems and been using it this way for about 2 years.

[andyturpie]

PaperCut supports user PINs and auto-enrolment (so the first time they just enter their user name/ID and it asks them to set a PIN). They then use a combination of both to log into the printer.

 

 

That sounds great, would you know if whether we can just set this to the staff group only?

[Ephelyon]

I think those settings are global I'm afraid. You can set per printer whether it asks for a PIN I suppose. Could be wrong though.

[twin--turbo]

Yikes - Numeric usernames......

 

We have MiFare cards with Toshiba Pcounter Embeded.

 

 

The staff should be more worried about what happens after a job is released but does not print due toa machine fault. If the machine is then recovered what happens to that document that's in the local machine queue.

 

Rob

[carvjo]

We use papercut and follow-me printing - users release print jobs with their door entry cards.. works a treat!

[andyturpie]

We discounted swipe cards due to the number required over 1800 in total, plus its not uncommon to have around 30 usb sticks go missing a week here, we don't wish to add another spoke to the buckled wheel. As teaching staff, not one of them should be printing "sensitive" data. Although we have ensured that SMT have printers in their own office which do not need authentication.

[Big_Ted]

cards are often around 70p each you could use them as identity badges as well.

but the best option here is to keep usernames as they are and just assign ID numbers to users.

[MatthewL]

Magstripe cards can be picked up cheap but proximity which I would recommend are slightly more but you need to weight up the time wasted by manually typing in username and passwords and its a quick bleep of the card and you are in. You can still have the function to manually login if you forget the card but the way we sold it to our staff when I did it was the ID card had to be used to get in building plus staff should always wear it and it was a common thing and we used ours to login using PCounter.

 

If I was to roll it out again I would pick PaperCut with proximity rather than magstripe due the issues encountered.

 

You can setup PaperCut to just have an ID box on screen which can link to a field as already stated above.

 

The only thing PaperCut lacks over PCounter is a little feature in the print queues, in PCounter you can have a public one which jobs are sent to and these are then sent to a hidden one so no one can see the jobs till they login on their ID on the MFD. PaperCut have this in development but that's the only security issue from it all. There are ways I think to prevent users from opening the print queue and seeing the jobs in the queue but not looked at any myself.

[Big_Ted]

You can hide print job names in a queue, that should help.

 

PaperCut KB | I want to hide document names on windows printer queues

[Steven_Cleaver]

We get Staff to logon with their AD Username and Password which times out after a couple of minutes if they forget to logout but only have to hit a button to logout, but only using this on Staff photocopiers.