Secure print jobs at the printer while they're waiting to be printed
The Spool File Encryption feature keeps spool files (print jobs) secure at the printer while they are waiting to be printed. This feature works in conjunction with printers set up for Secure print release, and works in Windows environments.
PaperCut MF 20.1 or later
Print ProviderA Print Provider is a monitoring service installed on a secondary print server to allow PaperCut to control and track printers. This monitoring component intercepts the local printing and reports the use back to the primary Application Server. 105.0.0 or later running on Windows—at least Windows Server 2012
Print Provider versions prior to 105.0.0 do not support encryption, so enabling Spool File Encryption on the server will not affect the actual print jobs.
Summary of setup steps
You can enable Print ArchivingPaperCut's Print Archiving stores an historic record of all printed content. This allows approved administrators to browse and review the content of past print jobs within their environment. or Spool File Encryption, but not at the same time. That’s because Print Archiving requires access to unencrypted spool files.
Log in to the PaperCut Admin web interface.
Click Options, then under the General tab select Enable Spool File Encryption.
If you have multiple primary and site servers, repeat steps 1 and 2 for each.
Configure printers and devices to hold a print job until the user authenticates at the device.
Follow the procedure in Configure Secure Print Release.
Repeat the procedure for each printer you want to set up for encryption.
To block spool files (print jobs) from being released when a printer or device is in error, follow the appropriate procedure below for your environment.
You can’t block jobs from a Fast ReleaseFast Release is a print release (Secure/Find-Me Printing) solution that uses off-the-shelf card readers available from multiple manufacturers. A Fast Release terminal is connected to the network (not the printer) allowing it to be used with any printer. A USB card reader is connected to the the Fast Release terminal and users use their proximity card to authenticate. PaperCut releases the users held print jobs to the printer assosiated with the Fast Release terminal. terminal. Make sure to check the link for a list of devices that supports blocking jobs for printers in error.
You can configure the directory used for Spool File Encryption.
Navigate to <PaperCut MF directory>\providers\print\win
Open the Print Provider configuration file print-provider.conf and locate the EncryptedSpoolDir configuration key.
By default it is set to to:
<PaperCut MF directory>\providers\print\win\spool\encrypted
Set the key to your target location, for example:
Windows path: EncryptedSpoolDir=D:\print\encryptedspools
UNC path: EncryptedSpoolDir=\\print-server\encryptedspools
Notes on downgrading a Print Provider version > or = 105.0.0 to a prior version
There are some rare occasions where you might want to downgrade the version of Print Provider. For example, you want to upgrade PaperCut NG/MF to use new functionality, but you want to keep your current version of Print Provider for stability.
Before you downgrade, if you have already enabled Spool File Encryption, you must release or cancel all current encrypted print jobs. If you don’t, the:
print job will remain in the print queueA print queue displays information about documents that are waiting to be printed, such as the printing status, document owner, and number of pages to print. You can use the print queue to view, pause, resume, restart, and cancel print jobs. but because prior versions of Print Provider (version < 105.0.0) don't support encryption, it will send a zero-byte spool fileA print spool file is generated when a user sends a document to a printer. The print spool stores the print job information, and sits in a print queue until it is retrieved and printed by a printer. to the printer when a job is released. These empty files are ignored by most printers, but can cause errors on those printers that don’t ignore them.
encrypted spool files will remain in the encrypted folder until they are manually deleted.