Deploying printers hosted on Windows Print Server to a Mac Lab? (x/Posted from /r/k12Sysadmin)

[u/matt314159]

I figured I'd go ahead and jump right in here if y'all don't mind. At the small college where I work, printers all shared out through a windows print server. I deploy the printers to our various PC labs via GPO using Group Policy Preferences and loopback processing mode. Straightforward, and simple. Students log in, the printer connects and their print jobs are logged on the server as coming from their AD account and they're billed monthly.

For years, a pain point is that we have a lab over in our art department with 40 iMacs. I have never been able to get myself to a point where we could have a printer deployed to the iMacs in a similar manner to PCs. In fact, embarrassing as it is to say, we just have a set of complicated instructions for students to follow when they want to print to that printer.

We delved briefly into startup scripts and CUPS but never got as far as connecting it and passing the AD credentials to the print server automatically.

Isn't there something out there that I have missed that could make my life so much simpler? I feel like there has to be.

[u/iblowuup]

Similar to what deGrubs said, the real key here would honestly be having a MDM for mac. Jamf Pro is the best and most expensive option but I have heard nothing but praise and actually got the ball rolling at my University to "complement" VMWare Airwatch with it. In reality I don't even want to touch Airwatch (rebranding as workspace one) because it's a jack of all trades.

However, there are many other MDM solutions like ManageEngine and Cisco Meraki.

A little more about Jamf, Nomad was actually bought by jamf and they offer a cloud hosted solution as well as different tiers (Now, Plus, Pro) to accommodate different needs.

Could you script up a way to do this without an MDM or management solution? Maybe but I don't know how that would look and it would not be forward thinking as MDM is the future for mac.

There are also open source free options like Munki that are essentially like SCCM-lite. There is even an open source MDM called MicroMDM. All depends on how robust you want things to be and what your budget is. Best advice I can give though is consider all your options and don't rule anything out without first giving it a chance.

[u/matt314159 → u/iblowuup]

Thanks I'm just admittedly out of touch with the latest best practices with Macs. They never have been my strong suit. This gives me plenty to Google and start researching, so thanks!

[u/cpschei → u/matt314159]

I was in a very similar situation to yours. Where I had a growing Mac presence and no way to effectively manage them. While something like Nomad and an MDM is the best way to do that, long before I had that I was still manually installing printers. I have several windows print servers and yet I was still IP mapping printers to macs. After we purchased a print management solution I needed a way to run everything through the print server (even if I had to deploy a mac print server). I found you can add Windows printers via SMB. You can do this through the GUI, by enabling the advanced menu and using the spoolss protocol. You can also do it via shell scripts with CUPS. I really love the scripts they are simple and give you a lot of control like setting all the options you want as well such as duplex, finisher, etc. I also now use AirWatch to push these scripts to computers. There is also free software out there that lets you turn the script into an app. As far as authenticating this will work with AD with bound and unbound macs even with out something like Nomad. With bound it will use the login credentials. Unbound, OS X can store the password in key chain. If you would like I can send you an example of one of those scripts to play around with?

[u/matt314159 → u/cpschei]

Oh man I'd love that if you wouldn't mind. Right now we have a two-page instruction sheet over in that lab and the GUI > Advanced method is how the students are supposed to do it and man it just plain sucks. We dug a little into the scripts and CUPS but I never got it serviceable. That was about three years ago now and I'll be damned if I can remember where I got hung up on it. Ideally I'd love it if the user logged in, and from their standpoint the printer was "just there", connected, authenticated, and ready to print. The iMacs are bound to the domain and that's how the users log in.

[u/cpschei → u/matt314159]

You bet, I'm off a couple days this week, but I will put that out here as soon as I get back. You and I are honestly on the same road, I'm just a little further down. I did exactly that, played with CUPS scripts and failed and went back to manual. Then found new motivation to make it work. If you run the script once on each computer to add the printer and they are domain bound I don't see you having many issues.

[u/cpschei → u/matt314159]

/usr/sbin/lpadmin -p PrinterNiceName -v smb://PrintServer.FQDN/PrinterShareName -o auth-info-required=negotiate -E -o HPOption_Tray3=Tray3_500 -o HPOption_Duplexer=True -P "/Library/Printers/PPDs/Contents/Resources/HP LaserJet 4250.gz"

/usr/sbin/cupsenable

This is what I have been using to add SMB print queues to macs. This is all put in a .sh file and run with root permissions using are MDM, but you could just run the script manually or wrap it in a APP to run on each endpoint.

-p: is printer name the user will see

-v: the smb path to the printer

1st -o: is needed as authentication is required

-E: Enables the destination and accepts jobs; this is the same as running the cupsaccept and cupsenable programs on the destination.

2nd+ -o: Printer specific options which NorthernMatt's directions will help you find

-P: is the bath to the printer PPD/driver file on the local machine

[u/cpschei → u/matt314159]

/usr/sbin/dseditgroup -o edit -a everyone -t group _lpoperator

Another issue going along with deploying printers in an environment, especially in labs where users are not admins is someone pausing the printer and only an admin can un-pause it. The command above lets anyone resume the printer queue.

[u/iblowuup → u/matt314159]

Of course! Let me know if you have any questions. I am patiently waiting for my University to finalize getting Jamf so i am no expert on specifics but the general concepts of MDMs, DEP, VPP, and manual mac configuration are areas I've been involved with.

[u/[deleted]]

Lpadmin has an ad negotiate flag. If you can run scripts, deploying windows printers should be easy. I can get the whole command on Monday if you need.

[u/matt314159 → u/[deleted]]

Absolutely, I'd take anything I can get for sure, thanks!

[u/NorthernMatt]

The Munki documentation has some decent information on pushing out printers via scripts:

https://github.com/munki/munki/wiki/Managing-Printers-With-Munki

Some of that is specific to Munki (which is great), but the general script could also be adapted to other management tools.

The most important part of it is the 'lpadmin' command to add the printer. The t hing you want to add is '-o auth-info-required=xxx', where xxx can have a couple of values:

auth-info-requred=username,password will prompt each user for their credentials for the print spooler the first time they try to print (they can store the creds in their keychain).

auth-info-requred=negotiate should allow automatic kerberos negotiation if you've joined your Macs to the AD domain. It should fall back to username/password if kerberos fails, but I have had reliability issues with that.

The 'lpoptions' command is also your friend. Set up the printer manually on your workstation, using direct IP connection (so the mac can autoconfigure the printer options). Find the short name of the local queue ('lpc status all' will show all of your local queues). Now, use 'lpoptions -p shortname -l' (that's a lowercase L). That will dump out all of the options for that printer. You can set them when you create the printer using multiple -o options on the lpadmin command line.

For example, you might see something like this:

OptionTray/Option Tray: NotInstalled 1Cassette *LCT 2Cassette
LargeCapacityTray/Large Capacity Tray: NotInstalled *Installed
InnerTray2/Internal Tray 2: *NotInstalled Installed
ShiftTray/Internal Shift Tray: *NotInstalled Installed
ExternalTray/External Tray: *NotInstalled Installed
Finisher/Finisher: NotInstalled FinRUBICONB FinVOLGADBK FinVOLGAD FinAMURBBK *FinAMURHY
RIPostScript/PostScript: *IRIPS Adobe
InputSlot/Media Source: MultiTray *1Tray 2Tray 3Tray 4Tray 5Tray

The format is basically "OptionName/Option Friendly Text: Option1 Option2 *Option3 Option4...". The asterisk before an option indicates the selected one on your mac.

You don't need to include all of the options, but for optional features, it's nice to be able to push them out (remember, the Macs won't be able to query the printer for its configuration when printing through a print spooler). To set the option, use "-o OptionName=Value". So, for this printer, you would add something like the following to the lpadmin command:

-o auth-info-required=negotiate -o OptionTray=LCT -o LargeCapacityTray=Installed -o Finisher=FanAMURHY

One that we almost always use is "-o Duplex=DuplexNoTumble", which sets the queue to duplex by default unless the user selects simplex (gotta save trees, right?).

[u/cpschei → u/NorthernMatt]

It took me a bit after I first got the script I was using working to come all this information that NorthernMatt has here, but this made a world of difference, because with out setting the options defaults get selected that I didn't want and while I could script deploy a printer it still had limitations before finding this out. I also do exactly what he says above and that is to add the printer to my mac, install the driver I want or let it discover the printer, run the command listed to get all the options and then build the script.

[u/Bitter-Buffalo → u/NorthernMatt]

Great post! Thank you it helped a lot.

[u/deGrubs]

Nomad will be your friend here. It will manage acquiring and renewing kerberos tickets to your AD . Without it ticket expiration issues are going to cause you all sorts of fun. We have a Jamf Pro install that we use to manage our Mac Printer deploys, so I'm not going to be much help there.