TweetFollow Us on Twitter

MacEnterprise: Printing with Leopard in the Enterprise

Volume Number: 24 (2008)
Issue Number: 06
Column Tag: MacEnterprise

MacEnterprise: Printing with Leopard in the Enterprise

Changes for Mac Administrators

By Greg Neagle, MacEnterprise.org

Introduction

Mac OS X 10.5 "Leopard" continues the trend of enhancements and modifications to printing on the Mac. Changes in the CUPS configuration and in the printing utilities in Leopard have the potential to simplify or complicate your environment. With a few simple changes, you can customize printing behavior in Leopard to more closely match its behavior in Tiger, and ease the transition for your users and support staff.

More Security, More Support

Printing in Leopard largely behaves as it did in Tiger. One particular change, however, might be of interest to Mac administrators: for the first time since Mac OS X was introduced, a user must be an administrator to add and remove printers.

Presumably, Apple made this change to improve security – Leopard has many changes to increase the security of Apple's OS. For most home users, where at least one user's account is an admin account, this change really doesn't affect the user experience much. But in an enterprise environment, this change can be more problematic.

In many enterprise settings, most users do not have administrative privileges. They cannot install or remove software, and cannot make many configuration changes. This provides a more stable and secure platform for enterprise users and administrators, and makes support of these machines easier. Restricting the addition of printers to admins has the potential to increase support costs, since any time a user needs to print to a new or different printer they have to contact support.

For some organizations, making the addition of printers an administrator-only function might be a good thing, especially if you tightly control printer usage. But if in your organization, the pre-Leopard behavior is a better fit, there is a way to allow non-admin users to add printers and reduce the burden on support.

CUPS configuration

To allow non-admins to add printers, we'll need to edit the cupsd configuration file, located at /private/etc/cups/cupsd.conf. You'll need to use sudo, and your favorite text editor. Look for this section:

  # All administration operations require an administrator to authenticate...
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer¬
CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default> AuthType Default Require user @SYSTEM Order deny,allow </Limit>

Remove or comment out this section and replace it with:

# Allow non-admin users to add printers
 <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer ¬
CUPS-Add-Modify-Class CUPS-Delete-Class ¬
CUPS-Set-Default> Require valid-user Order allow, deny Allow all </Limit>

Now look for this section, which should be directly below the section you just modified:

  # All printer operations require a printer operator to authenticate...
  <Limit Pause-Printer Resume-Printer Enable-Printer ¬
Disable-Printer Pause-Printer-After-Current-Job ¬
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer¬
Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer ¬
Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> AuthType Default Require user @AUTHKEY(system.print.admin) @admin @lpadmin Order deny,allow </Limit> \

Change it to:

# Allow non-admin users to pause and resume printers
  <Limit Pause-Printer Resume-Printer¬
Enable-Printer Disable-Printer Pause-Printer-After-Current-Job¬
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer¬
Restart-Printer Shutdown-Printer ¬
Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs> Require valid-user Order allow, deny Allow all </Limit>

These changes allow any authenticated user perform the CUPS actions defined – the key actions we are interested in are adding printers and the ability to pause or resume printers. In many cases, the changes to the section to allow pause/resume may not be needed, because by default, any user who is a member of the lpadmin group can perform these functions, and all local users are automatically added to the lpadmin group when they are created. You might need this change in an environment with network accounts, where network users are not members of the lpadmin group.

Now test the changes. Login as a non-admin user and open a document. Choose Print from the File menu. The standard Print dialog will open. In the Printer pop-up menu, select Add Printer... You should be able to add a printer without being prompted for an admin password. Note that using the Print and Fax preferences pane in System Preferences still requires an admin password, so tell your users to add printers using the method described above (from the Print menu), or make the additional change described below to provide another way to add printers. Additionally, as the Print menu does not offer an option to delete printers, there is no user-friendly way to remove printers without allowing access in the preference pane.

If you want to revert your changes, you can simply copy /etc/cups/cupsd.conf.default to /etc/cups/cupsd.conf to restore the CUPS configuration to Apple's default settings.

Replacing Printer Setup Utility

Prior to Leopard, there were at least three ways to add a printer: using the Print and Fax preference pane, using the Printer Setup Utility in /Applications/Utilites, and by choosing Add Printer... from the Print dialog in any application (which then opens the Printer Browser in the Printer Setup Utility).

In Leopard, Apple has simplified matters somewhat by removing the Printer Setup Utility. This may confuse your users who you've upgraded from Tiger. If they are not admin users, the Print and Fax preference pane will be of no use to them, either. You can of course tell them to use the Add Printer... item in the Print dialog. But you may want to increase the chances they'll figure things out for themselves by partially restoring the missing Printer Setup Utility.

We'll do this by creating a symlink in /Applications/Utilities named "Printer Setup Utility.app" that links to the AddPrinter application in /System/Library/CoreServices:

sudo ln -s /System/Library/CoreServices/AddPrinter.app \
/Applications/Utilities/Printer\ Setup\ Utility.app

Now when you users go looking for a tool in the Utilities folder to help them add a printer, they'll find one.


AddPrinter.app

This isn't a perfect solution. AddPrinter doesn't act like a standard application, since it wasn't designed to be one. It doesn't have a menu bar, it doesn't appear in the Dock, and it doesn't automatically come to the front when opened. This may confuse your users. You may want to decide whether or not making it available in this way will lessen your support burden or increase it.

Conclusion

If Leopard's printing changes have caused support issues in your environment, you now have a few tools to use to help your users help themselves!


Greg Neagle is a member of the steering committee of the Mac OS X Enterprise Project (macenterprise.org) and is a senior systems engineer at a large animation studio. Greg has been working with the Mac since 1984, and with OS X since its release. He can be reached at gregneagle@mac.com.

The MacEnterprise project is a community of IT professionals sharing information and solutions to support Macs in an enterprise. We collaborate on the deployment, management, and integration of Mac OS X client and server computers into multi-platform computing environments.

 

Community Search:
MacTech Search:

Software Updates via MacUpdate

NetNewsWire 5.1 - RSS and Atom news read...
NetNewsWire is the best way to keep up with the sites and authors you read most regularly. Let NetNewsWire pull down the latest articles, and read them in a distraction-free and Mac-like way. Native... Read more
FontExplorer X Pro 7.1.3 - Font manageme...
FontExplorer X Pro is optimized for professional use; it's the solution that gives you the power you need to manage all your fonts. Now you can more easily manage, activate and organize your... Read more
DiskCatalogMaker 8.2.5 - Catalog your di...
DiskCatalogMaker is a simple disk management tool which catalogs disks. Simple, light-weight, and fast Finder-like intuitive look and feel Super-fast search algorithm Can compress catalog data for... Read more
Skim 1.5.12 - PDF reader and note-taker...
Skim is a PDF reader and note-taker for OS X. It is designed to help you read and annotate scientific papers in PDF, but is also great for viewing any PDF file. Skim includes many features and has a... Read more
rekordbox 6.1.0.0030 - Professional DJ m...
rekordbox is the best way of preparing and managing your tracks, be it at home, in the studio, or even on the plane! It allows you to import music from other music-management software using the... Read more
iExplorer 4.4.0 - View and transfer file...
iExplorer is an iPhone browser for Mac lets you view the files on your iOS device. By using a drag and drop interface, you can quickly copy files and folders between your Mac and your iPhone or... Read more
OmniGraffle 7.17.5 - Create diagrams, fl...
OmniGraffle helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use Graffle to... Read more
Apple Configurator 2.13.1 - Configure an...
Apple Configurator makes it easy to deploy iPad, iPhone, iPod touch, and Apple TV devices in your school or business. Use Apple Configurator to quickly configure large numbers of devices connected to... Read more
OmniGraffle Pro 7.17.5 - Create diagrams...
OmniGraffle Pro helps you draw beautiful diagrams, family trees, flow charts, org charts, layouts, and (mathematically speaking) any other directed or non-directed graphs. We've had people use... Read more
FoldersSynchronizer 5.1.6 - Synchronize...
FoldersSynchronizer is a popular and useful utility that synchronizes and backs-up files, folders, disks and boot disks. On each session you can apply special options like Timers, Multiple Folders,... Read more

Latest Forum Discussions

See All

Steam Link Spotlight - Hades
Steam Link Spotlight is a feature where we look at PC games that play exceptionally well using the Steam Link app. Our last entry was on Disco Elysium. Read about how it plays using Steam Link over here. | Read more »
Microsoft has acquired ZeniMax Media and...
In the latest of a series of blockbuster moves, Microsoft has now acquired Zenimax Media and its subsidiary, Bethesda Softworks, for $7.5 billion. [Read more] | Read more »
Infinity Mechs is an upcoming idle game...
Indie developer SkullStar studio has announced an upcoming idle mech game called Infinity Mechs. It draws inspiration from the mobile game Iron Saga and has been officially licensed by Game Duchy. It's set to launch for both iOS and Android on... | Read more »
PUBG Mobile Lite's latest update se...
PUBG Mobile Lite, the streamlined version of the popular battle royale that's designed to work on less powerful devices, sees the return of a popular game variant today, Survive Till Dawn mode. It arrives as part of the 0.19.0 content update. [... | Read more »
Matchy Catch, Jyamma Games’ new hyper-ca...
Matchy Catch is a new hyper-casual puzzler from Jyamma Games, the Italian studio behind the Pong-inspired puzzle-adventure Hi-Ball Rush. It’s only the developer’s second game for iOS and Android devices, but it promises to be every bit as fun and... | Read more »
Among Us! Imposter Guide - How to be a s...
Among Us! continues to be getting a lot of play in these parts, and since our first guide we've learned a thing or two about the game. This is especially true regarding the imposter role, as its a relatively rare opportunity that we've now put... | Read more »
Paladin's Story is an upcoming fant...
Paladin's Story is an upcoming fantasy RPG with an off-kilter sense of humour that's heading for iOS and Android. It will officially launch for both on September 16th though the game is already available on Google Play in Early Access. [Read more... | Read more »
Among Us! Guide - Tips for the uninitiat...
| Read more »
A Pretty Odd Bunny is a stealth-platform...
A Pretty Odd Bunny is a stealth-platformer from two-man team AJ Ordaz and René Rivera. It follows the story of a red-eyed rabbit who is allergic to carrots and instead has a penchant for devouring pigs. It's available now for Android devices. [... | Read more »
Apple Arcade: Ranked - Top 25 [Updated 9...
In case you missed it, I am on a quest to rank every Apple Arcade game there is. [Read more] | Read more »

Price Scanner via MacPrices.net

The cheapest Macs are back in stock today at...
Apple has restocked clearance, previous-generation, Certified Refurbished Mac minis starting at only $599. Each mini comes with free shipping plus Apple’s standard one-year warranty. These are the... Read more
Sale! Amazon has 2020 13″ 2.0GHz MacBook Pros...
Amazon has 2020 13″ MacBook Pros with 10th generation Intel CPUs back in stock on sale again today for $150-$200 off Apple’s MSRP. Shipping is free. Be sure to purchase the MacBook Pro from Amazon,... Read more
Base 13″ 1.4GHz Apple MacBook Pros on sale fo...
Apple reseller Expercom is offering a $65-$75 discount on new 2020 13″ 1.4GHz MacBook Pros, depending on configuration. Shipping is free. Expercom estimates shipping in 3-5 days, as stock of Apple’s... Read more
Price drop! Get a 44mm Apple Watch Series 5 G...
Amazon has dropped their price on the 44mm Apple Watch Series 5 GPS + Cellular by $100 to $429 shipped. That’s $100 off Apple’s original MSRP for this model. For the latest prices and sales, see our... Read more
Verizon offers $200 discount on new Apple Wat...
Verizon will take up to $200 off the purchase of a new GPS + Cellular Apple Watch Series 6 or Apple Watch SE with select trade-in and the purchase of a new iPhone with service. The fine print: “Get... Read more
Verizon offers $250 discount on new 8th gener...
Verizon will take up to $250 off the price of an 8th generation 2020 Apple Cellular iPad with select trade-ins and a new iPhone purchase. Plus get Apple News+ free for 6 months. The fine print: “Save... Read more
Apple’s Implementation Of COVID-19 Exposure...
NEWS: 09.18.20 – The latest effort by Apple to embed exposure notifications for COVID-19 contact tracing right into its mobile operating system has some iPhone users weary of being exposed to... Read more
Here’s how to get a 16″ MacBook Pro for $300...
B&H Photo has new 16″ MacBook Pros on sale today for $250-$300 off Apple’s MSRP, starting at $2099. Expedited shipping is free to many addresses in the US: – 2019 16″ 2.6GHz 6-Core MacBook Pro... Read more
Apple has Certified Refurbished 16″ MacBook P...
Apple has Certified Refurbished 2019 16″ MacBook Pros available for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-... Read more
Price drops! Apple reseller B&H drops App...
B&H Photo has dropped prices on Apple Watch Series 5 models by $50-$70 off Apple’s original MSRP. Shipping is free. These are the same Apple Watch models sold by Apple in their retail and online... Read more

Jobs Board

Security Officer ($23.00/Hourly) - *Apple*...
**Security Officer \($23\.00/Hourly\) \- Apple Store** **Description** About NMS Built on a culture of safety and integrity, NMSdelivers award\-winning, integrated Read more
Security Officer ($23.00/Hourly) - *Apple*...
**Security Officer \($23\.00/Hourly\) \- Apple Store** **Description** About NMS Built on a culture of safety and integrity, NMSdelivers award\-winning, integrated Read more
Platform - Workplace Eng - *Apple* Enterpri...
MORE ABOUT THIS JOB We are looking for an Apple Platform Engineer who will bring a unique engineering skill set, support, clarity, organization and above all else, Read more
*Apple* Certified Repair Technician - Utah S...
…selected candidate will work in the USU Campus Store Tech Department as an Apple Certified Repair Technician and floor associate. This position is for both summer Read more
Senior Data Engineer - *Apple* - Theorem, L...
Job Summary Apple is seeking an experienced, detail-minded data engineeringconsultant to join our worldwide business development and strategy team. If you are Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.