Stopping Users from USB Printing

[tech_guy]

We've got an issue that has started to become a bit of a problem.

 

Staff and students are sneakliy bringing their own USB cables in and using them to connect to various printers with their laptops so that they can bypass PaperCut on the networked printers and print to their hearts content.

 

Is there anyway to block the USB connector on the printers other than by disconnecting the port inside the machine which is what one manufacturer has told us to do?!

 

I know there are USB port blocking keys sold by Lindy but they are for the actual USB ports on PCs and not the USB port on a printer. Is there something similar?

 

We tried supergluing a small piece of cut perspex over them but they just pull it off.

 

Help and advice much appreciated.

[steve]

In the web interface on many HP colour lasers you can disable local printing.

 

Failing that, fill the port with hot glue?

 

Would it be possible to SNMP monitor the printer for usage via USB (I'm not an SNMP expert so not sure).

[FN-GM]

You can use GFI endpoint security and specify what types of USB devices you want to block. Its not free though.

 

Can you not restrict them from installing drivers in group policy? I think there is something in there for it.

[tech_guy]

This is to stop staff and students who bring in their own laptops from being naughty.

[plexer]

If you have proof then this is a school policy/discipline issue to be solved rather than pure technical.

 

Ben

[plexer]

Seems to be several products to block type A usb ports but nothing for type B i.e printer ports.

 

I would take a usb B cable and cut the connector off then plug this in and cover it with loads of hot glue, you should still be able to remove it yourself with a bit of work but will stop casual removal.

 

Ben

[morganw]

I've seen numerous examples of chewing gum disabling USB ports.

[FN-GM]

This is to stop staff and students who bring in their own laptops from being naughty.

 

Even more sneaky, im a little surprised to be honest.

[pete]

If the printer's smart enough, tell it to ignore usb print jobs.

 

If it's too dumb for that, and you're really quite certain you don't need USB........

 

Paint the contacts on the usb port with something transparent but robust and non-conductive (say couple of coats of matt nail varnish). That way there's no obvious "aha, I see what tech_guy has done to prevent me printing". It just doesn't work.

 

Bonus points for doing it so their laptop sees something on the cable, but can't actually use it and they're sat their for hours trying to make it work.

[bossman]

@tech_guy:

 

You say that they are their own laptops which I would presume are not built onto the network?

 

If this is the case then could you not through each printer properties in the security tab take out the everyone can print and set up groups through the AD i.e. staff and student groups which would only allow network printing?

 

if you have already thought of this then I apologies for wasting your time.

 

We have this done this at our school so that only the staff from each subject can print from the subject printers in their classrooms.

 

I don't know if this will work for your situation but it is worth a try.

 

Let me know what you think and if it works for you.

[FN-GM]

If this is the case then could you not through each printer properties in the security tab take out the everyone can print and set up groups through the AD i.e. staff and student groups which would only allow network printing?

 

That wouldnt work as they are plugging directly in via USB on there own laptops. Its like setting up a new pc at home and plugging in a USB printer. There will be no permissions set or anything.

[p858snake]

Move the printers into common areas where others can see them? doubt most staff or students would try it then.

[MatthewL]

Most printers can have this disabled in the interface as already stated as I have done this before.

[bossman]

That wouldnt work as they are plugging directly in via USB on there own laptops. Its like setting up a new pc at home and plugging in a USB printer. There will be no permissions set or anything.

 

Yeah you right @FN-GM having a late night enema last night hehe! :0