Inappropriate Prints

[JoeFulford]

Hi All,

 

I've got a real headache going on here. Every now and then we get dodgy print jobs coming through to our printers. Yesterday we have 10 pages of pornographic images sent to our Library printer. We use Papercut here which tracks all of the print jobs and logs. This is all good and everything except whenever we have dodgy print jobs come through that we need to track back to a user, it always shows up as being printed from 'SYSTEM' and the file name just 'Photo'. I can't imagine this is from the same student, in fact I know for sure that it's not. I've looked on CCTV as well and no one has gone to the printer and printed straight from a USB stick or cabled directly in.

 

Has anyone ever had to deal with anything like this before or does anyone have any idea how it might have been printed through as 'SYSTEM'??

 

I'm really struggling here!

 

Thanks,

JF

[Edu-IT]

Have you asked PaperCut? I've not come across this before. Usually, if it doesn't know the user, it won't print.

[synaesthesia]

You can turn on "print preview" in Papercut to show images of what's been printed in the job list, which may certainly help.

Any software you have running such as Impero to be able to trace who was logged on, when etc?

Sounds like someone may be printing from a station where a network printer has been installed by an admin and the admin credentials were saved or something similar. Anything else from the Printer's job log?

[MatthewL]

SYSTEM doesn't sound right as in theory everything should pass with its credentials. Do you have any tablet printing setup?

 

Also what make/model of machine are you using, have you looked at the job log on the machine, I know Sharp's you can look at and find out the details on there.

[JoeFulford]

UPDATE: Mystery solved. I checked CCTV and realised that the student had his phone out. It then clicked and got us thinking. Tested a print from my phone and sure enough it came through logged as 'SYSTEM'. If anyone ever comes across this problem then be sure to check your BYOD users. Unfortunately there is no way to actually track which phone or user this came from however I believe that there is a way somehow that you can block 'SYSTEM' or 'administrator' from printing through Papercut.

[MatthewL]

Have you got your PaperCut setup to be available on a network they can see from their phones?

 

You can reject jobs if not authenticated by their AD credentials so you would then be able to trace.

[JoeFulford]

Have you got your PaperCut setup to be available on a network they can see from their phones?

 

You can reject jobs if not authenticated by their AD credentials so you would then be able to trace.

 

We have yes. Do you know how this is done? I had a quick look at it earlier and added the Deny option from anyone who's not a member of the 'AllStaff' and 'AllStudents' AD Group but the print managed to still make it through? Our Print Copy Scan support company are going to have a look through it for us and try to help me get it all sorted.

[MatthewL]

I am not 100% sure as its never a situation I have come across, have you had a look on the KB? I have seen something when going through menus.

[JoeFulford]

I am not 100% sure as its never a situation I have come across, have you had a look on the KB? I have seen something when going through menus.

 

Hi Matt,

 

I've figured out how to block this. So I finally realised that when printing from iOS and it going through fingerprint on our print server it get's listed as "administrator" and when from an Android Device it's "SYSTEM". On Papercut you can open up these usernames and look on the account. From the profile page you can block printing indefinitely. Have tested this morning and all blocked perfectly. No more phantom printing!

 

Cheers

[MatthewL]

Question is why was the kids mobile device connected to that WLAN?

 

Least you got it sorted, not used FingerPrint like that so its what caught me out.

[JoeFulford]

Question is why was the kids mobile device connected to that WLAN?

 

Least you got it sorted, not used FingerPrint like that so its what caught me out.

 

We use BYOD. I sent weeks setting up Ruckus authentication, VLAN's and so on. Everything needed for BYOD to be contained but some of the teachers have I think released the main WiFi password to the students and so they're on the normal WiFi. It's hassle changing the Network Key so I just try keeping it contained.