Restrict printing by computer/location not user?? Server 2012 R2

[Obee1]

Hi guys

 

Got a bit of an issue with a printer that we have shared from our print server being printed to by machines outside of it's location.

 

It's based in the library, but students in classrooms appear to be able to print to it.

I have changed the share and NTFS permissions to only allow the computers in the Library to print to it, but that doesn't appear to work.

I have then looked at the effective permissions for a user and see that they don't have access, but they are still able to print...?

 

We do have Papercut, but as far as I can see Papercut only allows restriction by user?

 

Any thoughts or ideas on ways to enforce a restriction?

I have read various posts from people stating that you should be able to restrict via permissions for computers or security group containing the computers, but doesn't seem to work...?

 

Thanks in advance for any thoughts/ideas??

[Rob_D]

If it were me, I'd just not map that printer for those computers, and use GPO to block adding new printers.

[Reverend_Dan]

If it were me, I'd just not map that printer for those computers, and use GPO to block adding new printers.

Yep that's exactly what I do, teachers computers are mapped to the nearest MFD, so a pupil can log on there and print if needed but most of the time they send it to staff who print. For the bit extra hassle, it has saved us about 30-40% of our printing bill.

[NB9457]

Also, on Print Management, untick 'List in directory', this will help prevent people finding it as easy.

[Obee1]

If it were me, I'd just not map that printer for those computers, and use GPO to block adding new printers.

 

Thanks for response.

Yeah that's a kind of second string to the issue actually.

 

We have printers mapped upon location, so that printer should only be mapping for the nine machines that we have in that room. Interestingly however that is not the case.

 

It appears to be mapped in other random locations, but without any logic.

 

So for each location there is generally 3 printers mapped, which are the nearest printers. We also use virtual queuing so that the print jobs can be ejected on multiple devices (follow me print).

 

So essentially I have kind of done half of what you've said, but we don't ban from installing additional printers to allow for fault tolerance (either printers not correctly mapping or printer breakdowns, requiring a new printer to be added).

[Obee1]

Also, on Print Management, untick 'List in directory', this will help prevent people finding it as easy.

 

Already done this too.

 

They're not navigating and finding it I don't think.

generally it is linked to the other problem that I have about it mapping in places that it shouldn't.

 

For an added complication, It does also have airprint as it requires printing from iPads. I realise that we can't restrict printing from mobile BYODs.

[Obee1]

Yep that's exactly what I do, teachers computers are mapped to the nearest MFD, so a pupil can log on there and print if needed but most of the time they send it to staff who print. For the bit extra hassle, it has saved us about 30-40% of our printing bill.

 

Oh my!! There'd be uproar here if we asked pupils to logon to staff machines to print or for staff to print students jobs for them.

 

We don't have too much wastage issues now as we have applied soft credit limits to students. We use Papercut to ensure that jobs are only released at the device by students or via the web interface by staff.

 

So wastage is fairly minimal now.

I'd recommend you look at Papercut MF - would make your life a darn sight easier.

[Rob_D]

Yeah that's a kind of second string to the issue actually.

 

We have printers mapped upon location, so that printer should only be mapping for the nine machines that we have in that room. Interestingly however that is not the case.

It appears to be mapped in other random locations, but without any logic.

 

How are you mapping your printers and determining PC location?

Could these anomalous computers have an old location mapping somehow?

[MatthewL]

If you have PaperCut you could add a script to said printer that checks IP of client is in allowed range, probably could do it based on name too, any other jobs delete.

[forkies]

How are the other computers (the ones that shouldn’t be printing to it) getting that printer listed? Are you deploying it to all computers or are you doing deployment on a user basis?

 

We deploy printers using GPo deployment from the print management server for staff per machine, but for the student computers we deploy them using gpo per user and then use a targeting by ou to deploy the printers to only computers in each room.

 

Users cannot add their own printers so we have to deploy them via print server for this to work. We also use papercut mf.