Mystery Printer

[xxlonewolfxx123]

Hi All,

 

Got a strange one here, long story short we have some students/pcs in the school that are able to print to a networked (cable) printer that they should not be able to access, details.

 

Printer: HP MFP M476DN

Security Settings: Staff/Network Admin groups only

Group Policy Printer: set to only about 5 pc's which are staff pc's and inaccessible to students.

 

All web services are turned off on printer like cloud printing etc.

 

There seems to be no logs of these pc's/students even printing to this printer from within our print manager program, it only shows the staff prints.

 

The only way we have tracked down the pc's that were used was due to one of the documents had a students name on it, so we looked through the logs and have narrowed it down to possibly only one room being able to print to it. I logged onto these pc's as the student we think was able to print and it does not show the printer anywhere in "Devices and Printers".

 

I have also set up a Syslog server for that printer to send to but it does not give any info on which user is printing.

 

Any ideas on how to track and figure this out?

 

If you want more info let me know, i have tried to be as in depth as i see is needed.

 

Also looked in Smoothwall as a off chance, did a report on that student. The only thing we found was a https address with the ip of the printer and at the end something like "openapi", cant remember exactly and cant find it again at the moment. We followed the link but it was invalid through web browser.

 

Thanks.

[andydis]

is the printer shared from a print server?

if so enable PRint queue logging ( Two Minute Drill: Enabling Print Queue Logging - Ask the Performance Team - Site Home - TechNet Blogs)

 

Are you sure you have turned off bonjour / appletalk?

[xxlonewolfxx123]

is the printer shared from a print server?

if so enable PRint queue logging ( Two Minute Drill: Enabling Print Queue Logging - Ask the Performance Team - Site Home - TechNet Blogs)

 

Are you sure you have turned off bonjour / appletalk?

 

Sorry yes totaly forgot that, yes it is shared from a print server.

 

Funnily enough just after i wrote this thread i enabled the queue logging, will have to wait for it to happen again.

 

 

[xxlonewolfxx123]

Yet again another print out but no logs on server, room pcs or printer.

[tech_guy]

Muddled IP Address in printer config?

[Oaktech]

can students add a printer through the print dialogue in word? Have they added it by IP address thus bypassing your print controls?

[tech_guy]

Student with iPhone / iPad using HP ePrint?

[xxlonewolfxx123]

Muddled IP Address in printer config?

 

Not that we can see nope.

 

can students add a printer through the print dialogue in word? Have they added it by IP address thus bypassing your print controls?

 

Nope, tested and permissions block this ability.

 

Student with iPhone / iPad using HP ePrint?

 

Unknown on this as we cannot see anything on Smoothwall that indicates a connection but also HP ePrint service is turned off on the printer so should not be possible anyway.