Windows Picture & Fax Viewer + Printer

[Chuckster]

Just recently I have discovered a problem that could be a security loophole.

 

Basically I have disabled all our students from adding/deleting/searching in the 'Printer and Faxes' for printers through GPO. However, this goes right out of the window because students can easily add a printer using the Windows Picture & Fax viewer.

 

They simply open up a picture, click on the print icon, click next and it's from here they can then click 'Install Printer' and search for printers across the network.

 

Is there any way I can prevent students from doing this? I'm having a problem whereby they are adding most of the SMT printers and printing to them. On one occasion someone sent 700 copies of a nude Pamela Anderson to the principal's printer. Thankfully he was out on a meeting all day.

[elsiegee40]

The way I have got round this may be slow and painfiul if you have many printers that you don't want the students to print to.

 

I have used the security tab for the banned printers and only allowed staff and administrators permission to use the printers... removing all mention of pupils. Having inadvertently removed my own permissions for said printers I have discovered you definitely can't add them by any means to use them.

 

EDIT

 

If they're local printers, you'll have to logon with admin rights to the appropriate PC, I think

If they are network printers, you can use Papercut, Print Manager Plus or similar to block their use by students

Edited December 10, 2008 by elsiegee40

[webman]

If your printers are shared from the servers, can't you just set the appropriate security per-printer to ensure students don't have the rights to print to them?

 

EDIT: ^ ^ What she said

[broc]

Our print management software is set up to throw away any printout that comes from Picture and Fax viewer....... or anything that has http in the document title... saves a fortune in printing costs.

[Chuckster]

The way I have got round this may be slow and painfiul if you have many printers that you don't want the students to print to.

 

I have used the security tab for the banned printers and only allowed staff and administrators permission to use the printers... removing all mention of pupils. Having inadvertently removed my own permissions for said printers I have discovered you definitely can't add them by any means to use them.

 

EDIT

 

If they're local printers, you'll have to logon with admin rights to the appropriate PC, I think

If they are network printers, you can use Papercut, Print Manager Plus or similar to block their use by students

 

I've done this to all the printers in the school now. Created a security group and put in the students to prevent them from doing this to all standalone printers. Especially the SMT printers.

 

However, I would still like these students to print to other printers when they're in a particular classroom. For example, students are in classroom 1 and print to classroom 2 printer. You ban them from printing to that printer using a security group, but what happens afterwards? They go to classroom 2 and then find they can't print to it. Is there some other way to do this?

[Chuckster]

Our print management software is set up to throw away any printout that comes from Picture and Fax viewer....... or anything that has http in the document title... saves a fortune in printing costs.

 

What print management software are you using?

[broc]

What print management software are you using?

PCounter for Windows.

 

We bought it after we caught a student who had just finished printing enough A4 colour images to paper her bedroom walls ......

[broc]

We run a VBS script which deletes all non-local printers from student systems at startup and adds new ones based upon an environment variable we set up called 'LOCATION' (I think the script was downloaded from Edugeek & modified locally).

 

The first time the script runs the drivers get copied from the print server.

 

We then run the same script when the students log on, this adds the printers to their sessions. As the drivers are already loaded they don't need permission to install printers. GPO prevents students using Add/Remove printer to change our selection.

 

This process means students only get printers local to where they are working.

 

I an sure this is/was described elsewhere on Edugeek; I claim no credit, I certainly didn't invent it!

[elsiegee40]

This thread has the script Broc's talking about. It uses the computer name to work out which room the user is in.

 

http://www.edugeek.net/forums/scripts/394-printer-script.html