northeast_technician Posted January 12, 2016 Posted January 12, 2016 Hello one of my schools as a mac server and a windows server. the printers within school are connected to the windows server. when I have students logging into the mac suite that we have it asks them for authorization when trying to print. any suggestions as to what's going wrong would be greatly appreciated.
ijk Posted January 12, 2016 Posted January 12, 2016 Hello, Assuming the Mac clients are bound to an Active Directory? Are the printer security settings allowing printing from "Everyone"? If so, try "Domain Users". Nic 1
northeast_technician Posted January 12, 2016 Author Posted January 12, 2016 its joined to both but they login as a separate mac login on the macs
ijk Posted January 12, 2016 Posted January 12, 2016 (edited) I think you have an authentication problem. If you added the printers manually to each Mac, you could remove and re-add them as IP printers (each Mac will print directly to the printer and no auth is required). What are your Mac management tools, if any? Edited January 12, 2016 by ijk Typo 1
3s-gtech Posted January 12, 2016 Posted January 12, 2016 Nothing is going wrong - when you try to print you need to authenticate to the Windows based print server first. You may even find this if you have print permissions for 'Everyone'. Our Yosemite Macs are having a mare with printing to a Windows print server, as they're not authenticating properly even with an AD account. It's quite delicate. 1
ijk Posted January 12, 2016 Posted January 12, 2016 its joined to both but they login as a separate mac login on the macs Just to clarify: your students do not use their Windows credentials to log in to these Macs? 1
MicrodigitUK Posted January 12, 2016 Posted January 12, 2016 (edited) How to enable Kerberos authentication for shared printers 1. Execute the following Terminal command to enable the CUPS web interface: cupsctl WebInterface=yes 2. Open the URL localhost:631 in Safari. Login with local admin details 3. Open “Printers” tab 4. For each printer you wish to share using Kerberos: 4a. Click the printer name in the list. 4b. Choose “Set Default Options” from the “Administration” pop-up menu. 4c. Click “Policies”. 4d. Choose “kerberos” from the “Operation Policy:” pop-up menu. 4e. Click “Set Default Options”. 5.Automatic Authenticated Printing To enable auto authencticated printing as the logged in user to a windows printer share you will need to firstly find the name that the mac has assigned the printer this can be found by typing lpstat -v Then type in the following comman in the termial, replacing text between quotes with the desired printer as established by using the above command. Root is not required. lpadmin -p "mcx_0" -o auth-info required=negotiate Repeat this comand for each of the printers on your Mac. (Note do this in your master image Mac before tacking an image) lpadmin -p "mcx_0" -o auth-info required=negotiate lpadmin -p "mcx_1" -o auth-info required=negotiate lpadmin -p "mcx_2" -o auth-info required=negotiate Edited January 12, 2016 by MicrodigitUK 1
MicrodigitUK Posted January 12, 2016 Posted January 12, 2016 its joined to both but they login as a separate mac login on the macs If they do not logon to the Mac as a AD user then they will not have access to a Windows print shared for AD users and it will ask for a AD user. But if they log in to Mac as a AD user and authentication is set up correctly then you won't need to re enter the user or password. 1
northeast_technician Posted January 13, 2016 Author Posted January 13, 2016 Just to clarify: your students do not use their Windows credentials to log in to these Macs? correct
northeast_technician Posted January 13, 2016 Author Posted January 13, 2016 If they do not logon to the Mac as a AD user then they will not have access to a Windows print shared for AD users and it will ask for a AD user. But if they log in to Mac as a AD user and authentication is set up correctly then you won't need to re enter the user or password. i did originally have it set so that they logged in as their windows id but i had problems with documents opening and people saving items etc
ijk Posted January 13, 2016 Posted January 13, 2016 (edited) i did originally have it set so that they logged in as their windows id but i had problems with documents opening and people saving items etc Fair enough. You say you've a suite of Macs, so I'm assuming visiting each Mac is a pain, but not a nightmare. If you use Workgroup Manager to manage the Macs, then you might save some time but you may still need to visit each Mac to reset the printing system and clear out the Windows printers that are currently added/listed. I would do this: Log in to each Mac as an administrator and remove all the printers listed in System Prefs > Printers & Scanners If you use Workgroup Manager or another admin tool to manage the Macs, remove any configuration policy that adds printers to the Macs Reboot the Macs Log in to one and check that the printers are really gone. If you find printers still listed then you'll probably need to check each Mac and follow these instructions: https://support.apple.com/en-gb/HT201539 to reset the printing system. Next, either Log in to each Mac and add each the printer(s) using either Bonjour or IP Or, if you use Workgroup Manager or another admin tool Add each printer to the Mac server and allocate them to the Mac clients use your admin tool I forget, but you may be able to do some/all of the above using Apple Remote Desktop, if you have that available. Hope that helps. Edited January 13, 2016 by ijk typo 1
northeast_technician Posted January 13, 2016 Author Posted January 13, 2016 is it best to have the mac server bind to windows dc as well yeah?
ijk Posted January 13, 2016 Posted January 13, 2016 is it best to have the mac server bind to windows dc as well yeah? That's a choice you make, rather than a good/bad question. Regarding the content of this thread, the way you've described your set up (students log into the Macs with non-Windows accounts) it doesn't matter if the Mac server is bound to AD, and I think if you follow my post above you should find that the students are able to print from the Macs without being prompted to authenticate. In the long term the school will probably want students working at the Macs to have access to their document folders etc, which are presumably stored and managed by your Windows servers. You mention that you have had that set up, but that you ran into difficulties. That isn't uncommon - you will find numerous threads here and elsewhere that will probably mirror your issues. You'll have to determine what is desired and work towards that I guess. 1
3s-gtech Posted January 13, 2016 Posted January 13, 2016 lpadmin -p "mcx_0" -o auth-info required=negotiate Repeat this comand for each of the printers on your Mac. (Note do this in your master image Mac before tacking an image) lpadmin -p "mcx_0" -o auth-info required=negotiate lpadmin -p "mcx_1" -o auth-info required=negotiate lpadmin -p "mcx_2" -o auth-info required=negotiate OS X doesn't like "auth-info required" but it doesn't seem to mind "AuthInfoRequired". 2
northeast_technician Posted January 14, 2016 Author Posted January 14, 2016 Hi guys thanks for your help on this one i really appreciate it. Just a quick update I can get the printer to work for multiple users on the machine I tried without the need to re enter a AD user and password however I tried to share it on the mac server and through CUPS but it doesnt seam to push it out to the clients. Any ideas?
ijk Posted January 14, 2016 Posted January 14, 2016 What are you using to 'push it out'? Can you let us have a bit more information about your Mac server?
northeast_technician Posted January 15, 2016 Author Posted January 15, 2016 I tried work group manager and sharing the printer through cups
ijk Posted January 15, 2016 Posted January 15, 2016 The following need to be in place: The Mac clients joined to the Open Directory The Mac clients are members of an OD Computer Group, e.g. iMacs Add the printer to the server in the usual manner, i.e. System Preferences > Print & Fax You do not need to turn on 'Print' in Server Admin. Open Workgroup Manager and select your Mac computer group. Select the Preferences item Select Printing Under Printers: Select Always (Manage) Under the Printer List: Select the printer under Available Printers and Add it to the User's Printer List The checkboxes below are choices. We have: Allow user to modify the printer list unchecked Allow printers that conenct directly to user's computer checked Require an administrator password unchecked Only show managed printers checked Under Access Select the printer you added to the user's printer list Click Make Default Leave Require an administrator password unchecked. Click Apply Now Click Done Restart one of your Macs and check the results. The printer should have been added to the list and other printers removed. A number of things: The Macs may not have the correct software/drivers for your printer(s). If this is the case (the printer is listed as a generic postscript printer) then you'll need to add the software to each Mac. The Macs' list of printers may not have updated properly (additional printers are listed, no printers are listed, general kookiness), in which case you'll need to reset the printing system following the instructions in the link I posted earlier. You might consider doing that anyway, simply so that you're starting from a clean slate. Hope that helps.
Kineas Posted January 25, 2016 Posted January 25, 2016 I just install the drivers for printers manually, and then use WGM to set the users to connect to the printers by IP address. Never had a problem.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now