This section discusses printer configuration on Mac OS X workstation in environments systems where the print queues are hosted on a Windows operating system. See the section called “Mac hosted print queues for OS 10.8+” if your print queues are hosted on Mac OS 10.8+.
When a printer from a Windows environment is shared and added to a Mac system, Print and Scan requests printer access credentials in the form of username and password. Any user that prints to this printer uses these supplied credentials. This means that the administrator that added the printer to the workstation will be the owner of all documents printed from the workstation irrespective of the current logged in user.
The ideal solutions will vary from network to network and will depend on factors including:
Your existing network configuration
The mix and makeup of operating systems used on the network
The underlying directory technologies (Active Directory, LDAP, etc.) if used
Whether Macs are used by a single owner or multiple users
The following sections outline common set up scenarios and their pros and cons. Your solution may fit one of these scenarios or may be composed of a combination.
Many networks, particularly those in a business environment, have a dedicated desktop system for each user. This allows the desktop system's global settings to be customized for the user. Common examples include:
Dedicated computers used in a business
Staff laptops or desktops used in education
Printers hosted and shared from a Windows or Linux server.
Mac systems used by a single user (or small group of known users).
Each user has a domain account and password.
The username associated with the account on the Mac matches the domain username (either the account used to login, or the account set up as the automatic log in account).
Running Mac OS X 10.8 or higher.
Check the user account information:
Start up the Mac, login as the local administrator, and ensure the system is connected to the network.
Select System Preferences...
Depending on your Mac OS version, select Accounts or Users and Groups.
Click MyAccount. (This step can be skipped in Mac OS 10.8 and 10.9)
Ensure that the Short name associated with the account matches the user's domain account username. If not, create a new working account as appropriate.
Navigate to System Preferences -> Print and Scan.
Click the button to add a new printer.
Control-Click on the Toolbar and select .
Drag the Advanced icon onto the bar, then click the newly added Advanced button
Select the Windows printer via spoolss device type.
Enter a Device URL, such as:
smb://username:password@server_name/printer_nameTip: server_name is the name of the server hosting the printer, and printer_name is the printer's share name
You may need to include the port in the DeviceURL:
smb://server_name:139/printer_nameOS X can struggle with printer share names containing spaces. We recommend a share name without spaces
In Name field, enter a friendly and informative printer name.
Choose a driver for this printer by pulling down the drop-down box and selecting Select Software...
Click the button.
Test print and ensure jobs are logged in PaperCut NG as the correct user.
Open Finder and select Go -> Connect to Server....
Enter
smb://servername/pcclientwhereservernameis the name of the server hosting PaperCut NG. If you are prompted for a username and password, this will be a username that has access to connect to the SMB share on your Windows server.Drag the
PCClientapplication across to the local Applications directory.Open System Preferences...
Select Users & Groups.
Slect the Login items tab.
Click the button and select the newly installed
PCClientapplication. Ensure to tick the PCClient option once it appears.Restart the system and ensure the client starts upon login.
Get the user to log into the Mac. Verify that the
PCClientprogram starts automatically and shows the user’s balance.Print to the newly set up printer. On the server's print queue, ensure that the job appears under the correct username.
Ensure that the print job successfully reaches the printer and that the user gets charged in PaperCut.
Check that the balance has changed to reflect the new balance in the
PCClientprogram.
Schools and universities often have Macs available for student use in dedicated computer labs. In these environments the Macs are shared by many users and Scenario One is not appropriate. Larger Mac networks already using LDAP or Active Directory authentication, or planning on doing so, may wish to consider Scenario Three explained in the next section.
Scenario Two uses a popup authentication model. This is discussed in detail in the section called “Popup Authentication” and discussed further below:
The end-user's perspective:
The user sees the
PCClientprogram running.When the user prints a job, the client pops up a window requesting the user to enter a username and password. See the section called “Popup Authentication”.
The user enters a domain username and password.
If the credentials are valid, the job is charged to the user account.
The explanation:
The print event is performed as a generic user - for example "
macuser", "student", etc.In PaperCut NG, the "macuser" account is set up to use popup authentication by enabling the option Unauthenticated user. See the section called “Popup Authentication” for further details.
The popup requests the user to enter a username and password.
The password is authenticated and printing is charged against the supplied account.
Printers are hosted and shared off a Windows, Mac or Linux server.
The Mac systems are set up to login under a generic account name. (e.g. macuser, student, etc.)
The domain contains a user account matching the generic account.
Domain account set up:
Log onto the print server or the domain controller as a domain administrator.
Open Active Directory Users and Computers (or equivalent user management tool) from Start -> Administrative Tools.
Add a new domain user called
macuser.Define a password for
macuserand set the password to never expire.
Mac account set up
Start up the Mac, login as the local administrator, and ensure the system is connected to the network.
Select System Preferences...
Depending on your Mac OS version, select Accounts or Users and Groups.
Create an account called
macuser. Ensure the account's short name ismacuser.Set this account as the automatic login account, or alternatively make the password known to all users.
Set up the printers that the user requires access to:
Navigate to System Preferences -> Print and Scan.
Click the button to add a new printer.
Control-Click on the Toolbar and select .
Drag the icon onto the bar, then click the newly added button.
Select the Windows printer via spoolss device type.
Enter a Device URL, such as:
smb://username:password@server_name/printer_nameTip: server_name is the name of the server hosting the printer, and printer_name is the printer's share name
You may need to include the port in the DeviceURL:
smb://server_name:139/printer_nameOS X can struggle with printer share names containing spaces. We recommend a share name without spaces
In Name field, enter a friendly and informative printer name.
Choose a driver for this printer by pulling down the drop-down box and selecting Select Software...
Click the button.
Test print and ensure jobs are logged in PaperCut NG as the correct user.
Open Finder and select Go -> Connect to Server....
Enter
smb://servername/pcclientwhereservernameis the name of the server hosting PaperCut NG. If you are prompted for a username and password, this will be a username that has access to connect to the SMB share on your Windows server.Enter account details for an account able to connect to the SMB share if requested
Drag the
PCClientapplication across to the local Applications directory.Command-click on the newly copied
PCClientapplication in the Applications directory. Select Open Package Contents.Navigate to
Contents/Resources/.Double-click on the
install-login-hook.commandscript.Restart the system and ensure the client starts upon login.
Log on to the PaperCut NG administration interface as built-in admin user.
Select the
macuseraccount from Users.On the
macuser'sdetails screen, set the account balance to zero.Ensure the user is set to Restricted.
Check the Unauthenticated option and save the changes.
Click the Apply button to save the changes.
If users login to the Mac using their AD/LDAP username then it's possible to eliminate the authentication popup by configuring the client as described in the section called “Popup Authentication”.
Get the user to log into the Mac. Verify that the
PCClientprogram starts automatically.Print to the newly set up printer. On the server's print queue, ensure that the job appears under the correct username.
An authentication popup should display on the Mac. Enter a valid domain username and password.
The corresponding user should be charged for the job. Also check that the balance has changed to reflect the new balance in the
PCClientprogram.
Larger networks often run the Macs in a domain environment either authenticating with an Active Directory or an LDAP network. In an authenticated domain environment, the identity of the user (the user's username) is known and verified at the time of login. With the help of the TCP/IP Printing Services for Microsoft Windows, and the LPR/LPD support on the Mac, print jobs can be identified on the server and associated with the user's login name. This avoids the need for the popup authentication used in Scenario Two.
LPR is a legacy protocol developed for UNIX that clients use to send print jobs to print servers. Microsoft has supported this protocol for a number of years via an add-on module called Print Services for UNIX (PSfU). Under certain conditions Windows LPD printers can cause issues when using PaperCut hold/release print queues. The information included here is to help customers understand the issue and document suggested workarounds.
The mechanism used by the Windows PSfU subsystem to accept LPR and IPP print jobs is different from other implementations in Windows such native SMB based printers. In SMB the event notification to applications such as PaperCut is well behaved and reliable. Event notification for LPR and IPP based printing does not use the same set of underlying APIs and under some conditions the PaperCut print monitoring layer receives notification after the print job has started. This means that some print jobs may start to print before the hold instruction is issued. This job is then suspended in a Paused Printing state (i.e. both paused and printing) and this results in all other jobs on that queue being held up by the paused job.
The information we have from customers who have experienced this problem shows that the symptoms are generally not consistent, suggesting an underlying race condition bug in Windows. Things that can affect the problem include:
Running the print server on a virtual machine
The number of processors/cores
The current load on the print server
The version and patch level of Windows
Because the issue is in the underlying Windows print subsystem it not possible for PaperCut to quickly implement a reliable solution and we do not expect Microsoft to implement a fix to this legacy subsystem. If a site does experience this issue there are some steps that can help alleviate or fix the issue.
Use the SMB protocol for Windows based print server queues. Note that using SMB may place some constraints on how users authenticate and how anonymous users are able to print at your site. This is the recommended approach.
Use two print queues. Queue A is virtual and queue B is the real queue attached to the physical printer. Users print to A using LPR and PaperCut can always place a hold on the print job. PaperCut then redirects the job to B on release. Managing virtual print queues is documented in section Chapter 14, Find Me Printing and Printer Load Balancing. Queue A should be configured to use a port with no printer (e.g.
LPT1:), it should be permanently paused ( → ), and the virtual queue configuration for A in PaperCut should forward jobs to B (setting Jobs may be forwarded to these queues).If queue A is un-paused then the job will error, however it can still be re-directed as needed.
Macs set up in multi-user mode authenticating off a domain. Either Active Directory or LDAP.
Printers hosted on a Windows print server.
The server needs the TCP Printing Services installed (also known as Print Services for Unix).
On the server hosting the printers, setup TCP/IP Printing:
Log into the server as a system
administrator.Select Control Panel -> Add Remove Programs.
Click on .
Select Other Network File and Print Services.
Click and ensure Print Services for Unix is selected.
Click to complete the installation.
Some systems running firewall software may block LPD printing. On systems running firewall software, ensure that incoming connections from the local network are allowed on port 515.
On each Mac, add the required printers:
Open the Printer Setup Utility from Applications -> Utilities.
Click the button to add a new printer.
Click the tab at the top toolbar.
From the Protocol dropdown, select Line Printer Daemon - LPD.
Enter the IP address of the server hosting the printers in the Address field.
Enter the printer's share name in the Queue field.
Define a user friendly name in the Name field and select the printer type.
Click the button.
Repeat for other printers as necessary.
Open Finder and select Go -> Connect to Server....
Enter
smb://servername/pcclientwhereservernameis the name of the server hosting PaperCut NG. If you are promted for a username and password, this will be a username that has access to connect to the SMB share on your Windows server.Enter account details for an account able to connect to the SMB share if requested
Drag the
PCClientapplication across to the local Applications directory.Command-click on the newly copied
PCClientapplication in the Applications directory. Select Open Package Contents.Navigate to
Contents/Resources/.Double-click on the
install-login-hook.commandscript.Restart the system and ensure the client starts upon login.
Restart the system and ensure the
PCClientapplication starts on login and lists the user's account balance.Ensure print jobs correctly show in the PaperCut job logs under the user's PaperCut account.
The corresponding user should be charged for the job. Also check that the balance has changed to reflect the new balance in the
PCClientprogram.
The client install process is also covered in the section called “User Client”. After the first Mac is set up and the printing process is tested, the simplified client install notes covered in the section called “Deployment on Mac OS X” may be appropriate to provider to end-users or other system administrators.
The PCClient client can accept command line options as explained at
Table A.2, “User Client command-line options” If the client is started via the login hook,
the command-line options can be defined in the file:
/Applications/PCClient.app/Contents/Resources/login-hook-start
Look for the line starting with client_args and the associated comments above.