Printing from Mac connected to Windows network

[northeast_technician]

Hello one of my schools as a mac server and a windows server. the printers within school are connected to the windows server. when I have students logging into the mac suite that we have it asks them for authorization when trying to print. any suggestions as to what's going wrong would be greatly appreciated.

[ijk]

Hello,

 

Assuming the Mac clients are bound to an Active Directory? Are the printer security settings allowing printing from "Everyone"? If so, try "Domain Users".

 

Nic

[northeast_technician]

its joined to both but they login as a separate mac login on the macs

[ijk]

I think you have an authentication problem. If you added the printers manually to each Mac, you could remove and re-add them as IP printers (each Mac will print directly to the printer and no auth is required). What are your Mac management tools, if any? Edited January 12, 2016 by ijk
Typo

[3s-gtech]

Nothing is going wrong - when you try to print you need to authenticate to the Windows based print server first. You may even find this if you have print permissions for 'Everyone'. Our Yosemite Macs are having a mare with printing to a Windows print server, as they're not authenticating properly even with an AD account. It's quite delicate.

[ijk]

its joined to both but they login as a separate mac login on the macs

 

Just to clarify: your students do not use their Windows credentials to log in to these Macs?

[MicrodigitUK]

How to enable Kerberos authentication for shared printers

 

 

 

1. Execute the following Terminal command to enable the CUPS web interface:

 

cupsctl WebInterface=yes

 

 

 

2. Open the URL localhost:631 in Safari. Login with local admin details

 

 

 

3. Open “Printers” tab

 

 

 

4. For each printer you wish to share using Kerberos:

 

 

 

4a. Click the printer name in the list.

 

 

 

4b. Choose “Set Default Options” from the “Administration” pop-up menu.

 

 

 

4c. Click “Policies”.

 

 

 

4d. Choose “kerberos” from the “Operation Policy:” pop-up menu.

 

4e. Click “Set Default Options”.

 

 

 

5.Automatic Authenticated Printing

 

 

To enable auto authencticated printing as the logged in user to a windows printer share you will need to firstly find the name that the mac has assigned the printer this can be found by typing

 

lpstat -v

 

 

Then type in the following comman in the termial, replacing text between quotes with the desired printer as established by using the above command. Root is not required.

 

lpadmin -p "mcx_0" -o auth-info required=negotiate

 

 

Repeat this comand for each of the printers on your Mac. (Note do this in your master image Mac before tacking an image)

 

lpadmin -p "mcx_0" -o auth-info required=negotiate

 

lpadmin -p "mcx_1" -o auth-info required=negotiate

 

lpadmin -p "mcx_2" -o auth-info required=negotiate

Edited January 12, 2016 by MicrodigitUK

[MicrodigitUK]

its joined to both but they login as a separate mac login on the macs

 

If they do not logon to the Mac as a AD user then they will not have access to a Windows print shared for AD users and it will ask for a AD user.

 

But if they log in to Mac as a AD user and authentication is set up correctly then you won't need to re enter the user or password.

[northeast_technician]

Just to clarify: your students do not use their Windows credentials to log in to these Macs?

correct

[northeast_technician]

If they do not logon to the Mac as a AD user then they will not have access to a Windows print shared for AD users and it will ask for a AD user.

 

But if they log in to Mac as a AD user and authentication is set up correctly then you won't need to re enter the user or password.

 

i did originally have it set so that they logged in as their windows id but i had problems with documents opening and people saving items etc

[ijk]

i did originally have it set so that they logged in as their windows id but i had problems with documents opening and people saving items etc

 

Fair enough.

 

You say you've a suite of Macs, so I'm assuming visiting each Mac is a pain, but not a nightmare. If you use Workgroup Manager to manage the Macs, then you might save some time but you may still need to visit each Mac to reset the printing system and clear out the Windows printers that are currently added/listed.

 

I would do this:

 

1. Log in to each Mac as an administrator and remove all the printers listed in System Prefs > Printers & Scanners
   
2. If you use Workgroup Manager or another admin tool to manage the Macs, remove any configuration policy that adds printers to the Macs
   
3. Reboot the Macs
   
4. Log in to one and check that the printers are really gone. If you find printers still listed then you'll probably need to check each Mac and follow these instructions: https://support.apple.com/en-gb/HT201539 to reset the printing system.
   

Next, either

 

• Log in to each Mac and add each the printer(s) using either Bonjour or IP
  

Or, if you use Workgroup Manager or another admin tool

 

• Add each printer to the Mac server and allocate them to the Mac clients use your admin tool
  

 

I forget, but you may be able to do some/all of the above using Apple Remote Desktop, if you have that available.

 

Hope that helps.

Edited January 13, 2016 by ijk
typo

[northeast_technician]

is it best to have the mac server bind to windows dc as well yeah?

[ijk]

is it best to have the mac server bind to windows dc as well yeah?

 

That's a choice you make, rather than a good/bad question.

 

Regarding the content of this thread, the way you've described your set up (students log into the Macs with non-Windows accounts) it doesn't matter if the Mac server is bound to AD, and I think if you follow my post above you should find that the students are able to print from the Macs without being prompted to authenticate.

 

In the long term the school will probably want students working at the Macs to have access to their document folders etc, which are presumably stored and managed by your Windows servers. You mention that you have had that set up, but that you ran into difficulties. That isn't uncommon - you will find numerous threads here and elsewhere that will probably mirror your issues. You'll have to determine what is desired and work towards that I guess.

[3s-gtech]

lpadmin -p "mcx_0" -o auth-info required=negotiate

 

 

Repeat this comand for each of the printers on your Mac. (Note do this in your master image Mac before tacking an image)

 

lpadmin -p "mcx_0" -o auth-info required=negotiate

 

lpadmin -p "mcx_1" -o auth-info required=negotiate

 

lpadmin -p "mcx_2" -o auth-info required=negotiate

 

OS X doesn't like "auth-info required" but it doesn't seem to mind "AuthInfoRequired".

[northeast_technician]

Hi guys thanks for your help on this one i really appreciate it. Just a quick update I can get the printer to work for multiple users on the machine I tried without the need to re enter a AD user and password

however I tried to share it on the mac server and through CUPS but it doesnt seam to push it out to the clients. Any ideas?

[ijk]

What are you using to 'push it out'? Can you let us have a bit more information about your Mac server?

[northeast_technician]

I tried work group manager and sharing the printer through cups

[ijk]

The following need to be in place:

• The Mac clients joined to the Open Directory
  
• The Mac clients are members of an OD Computer Group, e.g. iMacs
  

Add the printer to the server in the usual manner, i.e. System Preferences > Print & Fax

You do not need to turn on 'Print' in Server Admin.

 

Open Workgroup Manager and select your Mac computer group.

• Select the Preferences item
  
• Select Printing
  

Under Printers:

• Select Always (Manage)
  

Under the Printer List:

• Select the printer under Available Printers and Add it to the User's Printer List
  

The checkboxes below are choices. We have:

• Allow user to modify the printer list unchecked
  
• Allow printers that conenct directly to user's computer checked
  
• Require an administrator password unchecked
  
• Only show managed printers checked
  

Under Access

• Select the printer you added to the user's printer list
  
• Click Make Default
  
• Leave Require an administrator password unchecked.
  

Click Apply Now

Click Done

 

Restart one of your Macs and check the results. The printer should have been added to the list and other printers removed.

 

A number of things:

 

The Macs may not have the correct software/drivers for your printer(s). If this is the case (the printer is listed as a generic postscript printer) then you'll need to add the software to each Mac.

 

The Macs' list of printers may not have updated properly (additional printers are listed, no printers are listed, general kookiness), in which case you'll need to reset the printing system following the instructions in the link I posted earlier. You might consider doing that anyway, simply so that you're starting from a clean slate.

 

Hope that helps.

[Kineas]

I just install the drivers for printers manually, and then use WGM to set the users to connect to the printers by IP address. Never had a problem.