Restricting access to a printer to specific PCs

[BatchFile]

Is is possible, using bog standard Windows 2003, to restrict printing to a shared printer to jobs sent from certain PCs?

 

In the security setting for the printer I've tried removing the "everyone: print" permission, then adding the computers with print access, but it doesn't seem to work... you just get "access denied" when you try and open the printer.

[BatchFile]

bump bump

[SC-UK]

How do you assign your printers to your workstations?

 

If it is done via script then it can be done several ways, based on the name of the machine, or by an environmental variable added to the machines that you want to have access to the printer.

Doing it this way means that the machines you don't want to have access to the printers wont even have it as an option to print to for your students, provided that you have restricted them adding their own printers.

 

Tom

[BatchFile]

@SC-UK:

 

it's pretty flexible really - the default printer is set by a VB script at login (detecting the start of the machine name and then choosing and setting as appropriate), but all the printers are browseable and I've created a set of batch files (rundll,PruntUi )to set their default printer to any other, should they need to.

 

All I need to do is stop a particular printer being used by people outside a certain room (hence restricting print jobs to those coming from certain PCs)

Edited February 26, 2009 by BatchFile

[penfold]

Why dont you just add the appropriate printers only(as you have via vbs) and then remove the option of adding new printers?

 

That way you allow anybody to print to any printer but they only see the ones you specify for the room they are in.

Edited February 26, 2009 by penfold

[BatchFile]

Why dont you just add the appropriate printers only(as you have via vbs) and then remove the option of adding new printers?

 

It's desirable, normally, that they can change their printers - there aren't that many colour printers around and if someone is in a room without a printer, or without a colour printer, or where the printer is on the blink, it's better if they can send it somewhere else if needs be.

 

I suppose I could add a line to explicitly remove the printer in question... but it would still be browsable

[penfold]

The problem with that is your saying that pupils need to be able to send files to printers in another room in case there is a problem. But then you are wanting to put a restriction in place that stops this?

 

The way that I have done it in the past is to set only the printers for each room to be available (by checking the name) and restricting the add new printer option. Only printers you want them to see are there and users cannot add new ones. Where we had problems with printing, I changed the print script so it added an extra printer based in another room as a temporary solution. As soon as the printer was fixed this line was removed. This was in cases such as waiting for replacement parts.

 

I found that adding extra printers "just in case" caused a lot more wasted printing with pupils sending out multiple copies to a different room and then forgetting to pick them up.

Edited February 26, 2009 by penfold

[ricki]

HI

 

Can you not set the security permissions on the printer and deny the people or group that you do not want to use that printer on the printserver.

 

Richard

[BatchFile]

The problem with that is your saying that pupils need to be able to send files to printers in another room in case there is a problem. But then you are wanting to put a restriction in place that stops this?

 

Just for one printer, yes. A department has bought their own printer (identical model to others in school - they DID consult me first), but only want users from their own room to be able to print to it as they've paid for it themselves.

 

I found that adding extra printers "just in case" caused a lot more wasted printing with pupils sending out multiple copies to a different room and then forgetting to pick them up.

 

Agreed, and I'm looking at print quota-ing to promote responsible printing from September - I'd rather not go for the "screwed down" approach in this case

Edited February 26, 2009 by BatchFile

[BatchFile]

HI

 

Can you not set the security permissions on the printer and deny the people or group that you do not want to use that printer on the printserver.

 

Richard

 

People, yes, no problem, that's not the issue - what I need is for anyone to be able to print to the printer as long as they're printing from one of the PCs that's allowed to print to it

[penfold]

People, yes, no problem, that's not the issue - what I need is for anyone to be able to print to the printer as long as they're printing from one of the PCs that's allowed to print to it

 

Follow the method as stated by SC-UK at the top and only install the printer on computers in that room. Restricting the no of printers available cuts down on paper/toner and support calls from people who dont know where to print.

[teejay]

You would have to create a secuirty group and put all machines NOT in the room as members of that security group and then set deny print on the printer permissions to that security group.

[AngryTechnician]

I do this using Group Policy Preferences to delete the printer mapping from the user's profile if they are not at one of the designated PCs, and use the same to re-add it automatically when they sit at one that should have access.

 

You can use GPP on a Windows 2003 domain, but you will need at least one Vista or Server 2008 install to configure them.

[IrritableTech]

I've been throwing together a vbs script which assigns a printer based on the OU the computer is in. Would that be of any use?

[srochford]

You would have to create a secuirty group and put all machines NOT in the room as members of that security group and then set deny print on the printer permissions to that security group.

 

Pretty sure it won't work - the connection is made in the security context of the user, not the printer.

 

could the machines and printer in in that 1 room go on a different subnet? I think you could then use IPSec to only allow communication on that subnet to the printer (although I've never done anything like that, I think it could work!)

[mac_shinobi]

Pretty sure it won't work - the connection is made in the security context of the user, not the printer.

 

could the machines and printer in in that 1 room go on a different subnet? I think you could then use IPSec to only allow communication on that subnet to the printer (although I've never done anything like that, I think it could work!)

 

I was just thinking the same thing or a VLAN or something ?

[BatchFile]

I've been throwing together a vbs script which assigns a printer based on the OU the computer is in. Would that be of any use?

 

It sure would - that'd be great! I may well be able to chop lumps out of it and use it!

 

Pretty sure it won't work - the connection is made in the security context of the user, not the printer.

 

It doesn't I tried. I suppose that's schematically almost identical to my first attempt using the security tab

 

could the machines and printer in in that 1 room go on a different subnet? I think you could then use IPSec to only allow communication on that subnet to the printer (although I've never done anything like that, I think it could work!)

 

Wow, now that is thinking outside the box! I could, I suppose give that a go (I've never tried anything like that either)... but I'll try terrorvis's script first methinks as the "alternative subnet" would also entail putting another server in to host the printer (25 workstations so I can't do it from a workstation) and allsorts of fun getting them to see their network drives etc.!

 

Sincerely, thanks to all for your ideas and contributions to this - I can't help thinking it shouldn't be this hard!!