Deny printing

[rich2211]

Question: What would be the best way to deny printing to a particular printer, from a particular workstation and username.

 

E.g. Deny user 'Jon' to print from workstation 'PC-01' to printer 'Printer-01'

 

Could this be done via a GPO, security settings via the security tab on printer in question, or by a script? We are a college and also use the print management software PaperCut NG.

 

We essentially have workstations in an open access area with printing facilities, but wish to deny a particular user to print from those workstations to the open access printer. However, I wish for this user to print from the classroom workstations to the open access printer.

 

Unfortunately, moving workstations or creating another user account is not an option.

 

Any help is greatly appreciated.

 

Richard.

[featured_spectre]

You should be able to restrict printing by floor/location/room/PC with papercut. You can add a few scripts in to deny or allow printing. Dont run it here but did in the previous establishment of employment, and they had various scripts for various people in various locations.

[cooka]

Depending how large your network is - could you not just add the user to the security properties of the printer which you wish not to print, and just deny all? The downside of this is the user is still able to see the printer listed in their printers, and it looks like you can still print, but, it wont.

 

EDIT: Or if its larger than 1 user, could you not create a security group with the people who you wish to deny printing and deny the whole group in security settings? Or as above use the printer management software. Something that I have no experience of.

 

I had a similar problem, we have 4 photocopiers here, and for some reason some of our machines pick up all of them (which we didnt want), and some only pick up the photocopiers which are told to via GP. As a work around I deny'd the user which I didnt want to print as above. In the end I just set up a GP to remove the unwanted printers and attached it to the OU they were in

Edited January 28, 2014 by cooka

[sparkeh]

Got a couple of ideas.

1. If you use GPPs to deploy printers just use Item Level Targeting to ensure that user doesn't get the printer added.
   
2. Create a group in AD called 'Printing denied' and add the user to it, sycn with PaperCut and add a script like this to the printer (not tested by the way but should be something like this):
   

[color=#770088][font=monospace]function [/font][/color][color=black][font=monospace]printJobHook[/font][/color][color=#666666][font=monospace]([/font][/color][color=#0000FF][font=monospace]inputs[/font][/color][color=#666666][font=monospace], [/font][/color][color=#0000FF][font=monospace]actions[/font][/color][color=#666666][font=monospace]) [/font][/color][color=#666666][font=monospace]{[/font][/color]
[color=#AA7700][font=monospace]// Test if a user is in group called 'Printing denied' and the if the machine name belongs to a restricted machine, if so cancel and log.[/font][/color]
[color=#770088][font=monospace]if [/font][/color][color=#666666][font=monospace]([/font][/color][color=#004499][font=monospace]inputs[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]user[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]isInGroup[/font][/color][color=#666666][font=monospace]([/font][/color][color=#AA2222][font=monospace]"Printing denied"[/font][/color][color=#666666][font=monospace])[/font][/color][color=#666666][font=monospace]) [/font][/color][color=#666666][font=monospace]{[/font][/color]
[color=#770088][font=monospace]if [/font][/color][color=#666666][font=monospace]([/font][/color][color=#004499][font=monospace]inputs[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]job[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]clientMachineOrIP[/font][/color][color=#666666][font=monospace]([/font][/color][color=#AA2222][font=monospace]""[/font][/color][color=#666666][font=monospace])[/font][/color][color=#666666][font=monospace])[/font][/color][color=#666666][font=monospace]{[/font][/color]
[color=#004499][font=monospace]actions[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]job[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]cancel[/font][/color][color=#666666][font=monospace]([/font][/color][color=#666666][font=monospace])[/font][/color][color=#666666][font=monospace];[/font][/color]
[color=#004499][font=monospace]actions[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]log[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]debug[/font][/color][color=#666666][font=monospace]([/font][/color][color=#AA2222][font=monospace]'Job from user "' [/font][/color][color=#666666][font=monospace]+ [/font][/color][color=#004499][font=monospace]inputs[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]user[/font][/color][color=#666666][font=monospace].[/font][/color][color=black][font=monospace]username [/font][/color][color=#666666][font=monospace]+ [/font][/color][color=#AA2222][font=monospace]'" was canceled.'[/font][/color][color=#666666][font=monospace])[/font][/color][color=#666666][font=monospace];[/font][/color]
[color=#666666][font=monospace]}[/font][/color]
[color=#666666][font=monospace]}[/font][/color]
[color=#666666][font=monospace]}[/font][/color]

Using PaperCut is probably the better option as there is no way round it, if that user A sends a print job from machine B then its denied, no question.

Edited January 28, 2014 by sparkeh