Deploy Mobility Print queues to Groups

“Help! We’re migrating from another print enablement solution and we’re used to pushing out print queues to end-user’s devices depending on Group Membership. How does that work with Mobility Print and PaperCut?”

So you’ve started rolling out PaperCut Mobility Print to get your end-user’s devices printing. It’s working fantastic so far, and users can see all the printers. The only problem is that they see all of the printers, and that might be a few too many…

This is an especially common question we hear from customers who are used to OU-based printer management in Google Cloud Print.

One obvious solution would be to set up a separate Mobility Print server for each group of users. Mobility Print is 100% free, so the only cost to your organization would be server licenses and hardware. Still, what if you need a solution that doesn’t require adding tens or hundreds of servers?

Thankfully with PaperCut there are a few different ways to limit the number of printers that end-users see or are able to print to. Read on and decide which solution is right for your organization.

Here’s a table comparing ways to limit which printers users are able to print to:

A: Configure Mobility Print to restrict printer access per subnet

Okay, okay, we admit the following solution is not Group/OU-based deployment, but instead printers are published to a range of IP addresses. We think this is worth mentioning though.

Built into PaperCut Mobility is a hidden option to restrict a user’s access to printers depending on what subnet they are connecting from. This feature is officially called “Restrict printer access per subnet” and is nicknamed “Subnet Filtering” for short. If the sites or buildings at your organization are segmented into separate subnets (for example the subnet for the High School is 10.0.0.0/24, but the subnet for the Middle School is 10.0.1.0/24) then this might be an ideal solution.

When implemented, here’s how this would look in the web interface of the Mobility Print server:

When this works best…

• This is a great solution if your network is subnetted geographically.
• Works with PaperCut Mobility Print alone. Unlike some of the other solutions mentioned here, PaperCut NG/MF is not required.
• This is not compatible with the new Cloud Printing solution in Mobility Print.
• You feel comfortable using a text editor to modify configuration files.

How to get this working…

Follow the instructions to restrict printer access per subnet.

B: Push printers to groups of users with Print Deploy

Print Deploy is another PaperCut print enablement solution designed for enterprise environments that allows you to create “zones” and push specific print queues to certain groups of users. One lesser-known feature of Print Deploy is that it can be used to push out Mobility Print queues as well with the ability to manage what queues users see depending on group membership.

When this works best…

• If you already have PaperCut NG/MF this option is the simplest to implement and manage.
• At the time of this writing, creating multiple zones in Print Deploy requires the Advanced Enablement Pack which is an add-on to your PaperCut license. Please contact your PaperCut Partner or our Customer Care team for details.
• This option is not compatible with the new Cloud Printing option in Mobility Print and is best suited to a local area network.
• In regard to ChromeBooks, this solution requires being able to push out the Mobility Chrome app with a configuration file, so it will only work with user accounts that are managed in Google Chrome Enterprise Administration.

How to get this working…

To get started, simply log into PaperCut NG/MF, choose Enable Printing, on the Print Deploy tab click the + icon to add print queues, select Import BYOD-friendly print queues, and then simply follow the prompts to assign printers to a group of users. You also need to ensure that the Mobility application is pushed to Chromebooks with the correct policy for Print Deploy, following these steps.

C: Deploy a single Find-Me Printer instead

One of the best features of PaperCut NG/MF is Find-Me Printing. In this solution, users only need to see a single print queue but can “release” jobs at any printer or copier by signing into a PaperCut release station, swiping their badge at a copier, or scanning a QR code with their phone.

Most PaperCut MF customers already have this solution in place, and using it in tandem with Mobility Print can save administrators bucket-loads of time.

When this works best…

• PaperCut MF offers the smoothest experience for end-users, but this is also possible to set up in some form with PaperCut NG.
• If your organization isn’t already using Find-Me Printing, this requires some work to set up and educate users. However, once you’ve done that you can sit back and enjoy the benefits of secure print release.

How to get this working…

For more information on how to set up a Find-Me Printer reach out to your PaperCut Partner for assistance or see our article, The end-to-end guide on setting up Find-Me Printing.

D: Configure Restrictions PaperCut NG/MF

There’s another way to restrict access to printers using the Filters & Restrictions tab for a given printer in PaperCut NG/MF. The downside to this method is that users will see the printer as an option, but when they select it they will see an error message, Printer access denied by group restriction.

When this works best…

• This solution is ideal when there are maybe a dozen or so printers, and less ideal if there are several hundred.
• This solution requires PaperCut NG/MF

How to get this working…

In PaperCut MF, you can set the permissions for each of those printers to restrict access by Group. To do this click Printers > select the printer > Filters & Restriction > then check the box Only allow the following groups to print and select the group.

This way if a student attempts to print to a staff printer, they will see an error message like Printer access denied by group restriction, like so:

Wait a minute, you say. If users can see all the printers how are they going to know which ones they are allowed to print to?

Fortunately it’s easy to add a label to each printer (like “Staff” or “Student”) to make it evident who is supposed to use what. To do so, you simply need to follow the instructions in this article to https://www.papercut.com/kb/Main/HowToChangeTheMobilityPrintServerNameInTheClientConnectionString .

An end user will see the STAFF ONLY label when trying to select a printer, like in the example below:

Still have questions?

Let us know! We love chatting about what’s going on under the hood. Feel free to leave a comment below or visit our Support Portal for further assistance.