Deploy print queues using Kandji and Print Deploy

Kandji is the Apple device management and security platform that empowers secure and productive global work. With Kandji’s Device Management, Apple devices transform themselves into enterprise-ready endpoints, with all the right apps, settings, and security controls in place.

This topic explains how to deploy the PaperCut Print Deploy client to a macOS client managed by Kandji.

At a high level, the Print Deploy client deployed by Kandji will be configured via a configuration profile to communicate with the PaperCut Application Server to deploy the appropriate print queues with appropriate print drivers.

Before you start

This topic is for the following minimum software versions:

• Kandji
• PaperCut NG/MF: 19.1.0
• Kandji supports macOS 11.0 (Big Sur) or higher

You need to be a Kandji administrator (or have relevant permissions), and should already have Mac clients managed by Kandji.

You’re also a PaperCut NG/MF administrator (or have relevant permissions), and have already:

• made sure that the PaperCut NG/MF Application Server is accessible via TCP 9191, 9192, 9195, 9174 from the targeted client machines—preferably by a FQDN (Fully Qualified Domain Name) rather than an IP address
• set up your PaperCut Print Deploy Reference computer
• deployed and manually tested at least one print queue.

This guide uses the Documents folder as an example working folder on your Mac computer.

Steps

To deploy the Print Deploy client using Kandji:

1. (Optional) Customize the user login popup .
2. Download and extract the Print Deploy client .
3. Add the .pkg file to Kandji using a Kandji Custom App Library Item .
4. (Optional) Create a Kandji Login & Background Items Library Item for macOS 13 Ventura client .
5. Create a configuration file in the form of a .mobileconfig file .
   • Option A: Download and use iMazing Profile Editor to create the .mobileconfig file .
   • Option B: Use command-line tools and Plist2MobileConfig.zsh to create the .mobileconfig file .
6. Add the .mobileconfig file to Kandji using a Kandji Custom Profile Library Item .
7. Verify the PaperCut Print Deploy client .​​​​​

Step 1: (Optional) Customize the user login popup

Depending on the method you’ve chosen to determine the user’s identity , users might be presented with a one-off user login popup for authentication. For details on how to customize the branding and text on the popup, go to Customize the Print Deploy user login popup branding and text .

Step 2: Download and extract the Print Deploy client

1. Sign in to your PaperCut NG/MF server, for example, https://print-server.company.lan:9192/admin
2. Click Enable Printing > Print Deploy. The Print Deploy page is displayed.
3. At the bottom of the page, next to Download clients click the macOS button.
4. Save the .dmg file to your Documents folder.
5. Look at the filename and check that the hostname between the square brackets is correct, for example, ‘pc-print-deploy-client[print-server.company.lan].dmg’
6. Double-click the .dmg file and copy PaperCut Print Deploy Client.pkg to your Documents folder or the Desktop.

Step 3: Add the .pkg file to Kandji using a Kandji Custom Apps Library Item

This section also includes optional steps 15 - 18 to add a Preinstall Script to install Rosetta for a Mac with Apple silicon.

1. Sign in to your Kandji instance, for example, https://your-company.kandji.io or https://your-company.eu.kandji.io .
2. In the sidebar, select Library.
3. In the upper-right corner, click Add new.
4. Select Custom Apps.
5. Click Add & Configure.
6. Enter a name such as PaperCut Print Deploy Client.
7. In the Assignment section, click Select Blueprint, then select the Blueprint or Blueprints to assign this Custom Profile to. (You can always change the Blueprint selection later.)
8. (Optional) Next to the Rules section, click Add, add one or more Assignment Rules, then click Confirm.
   Assignment Rules limit which devices within the Blueprint will be assigned this Library Item.
9. In the Installation section, click the menu to determine how this item should be installed. Choose one of two methods to install and continuously enforce, or choose to install on-demand from Self Service.
10. (Optional) Configure the Self Service section.
11. In the Install details section, click the click to upload link.
12. In the Choose Files to Upload window, navigate to the folder that contains your .pkg file.
13. Select the PaperCut Print Deploy Client.pkg file.
14. Click Upload.
15. Above the package you just uploaded, click Add Preinstall Script.
16. In a different web browser tab, visit the page that contains Kandi’s script that installs Rosetta if it’s not already installed: https://github.com/kandji-inc/support/blob/main/Scripts/InstallRosetta2.sh
17. Click the Copy raw contents button, which looks like two squares, and is displayed to the left of the Trash button.
18. In the Custom Apps Library Item that you are working on in Kandji, in the Preinstall Script field, paste the script you just copied.
19. Click Save.

Step 4: (Optional) Create a Kandji Login and Background Items Library Item for macOS 13 Ventura clients

Use this optional step to accomplish two things at once on a Mac with macOS 13 Ventura or newer:

• Prevent users from disabling the PaperCut Print Deploy client.
• Prevent macOS from displaying the following alert: “Background Items Added. Software from “PaperCut Software International Pty Ltd” added items that can run in the background."

You can manage this in Login Items Settings. For more details, see Kandji’s support article at:

https://support.kandji.io/support/solutions/articles/72000578621-about-the-login-background-items-library-item

1. Sign in to your Kandji instance, for example, https://your-company.kandji.io or https://your-company.eu.kandji.io .
2. In the sidebar, select Library.
3. In the upper-right corner, click Add new.
4. Select Login & Background Items.
5. Click Add & Configure.
6. Enter a name such as PaperCut Print Deploy Client.
7. In the Assignment section, click Select Blueprint, then select the Blueprint or Blueprints to assign this Custom Profile to. (You can always change the Blueprint selection later.)
8. (Optional) Next to the Rules section, click Add, add one or more Assignment Rules, then click Confirm. 
   Assignment Rules limit which devices within the Blueprint will be assigned this Library Item.
9. Click Add Background Item.
10. Click the menu for Identifier Type and select Team Identifier.
11. In the Identifier field, enter B5N3YV5P2H and verify what you’ve entered.
12. Click Save.

Step 5: Create a configuration file in the form of a .mobileconfig file

Kandji uses the .mobileconfig file to send a configuration profile to a Mac client. The PaperCut Print Deploy Client uses the information from the configuration profile to configure itself.

Option A: Download and use iMazing Profile Editor to create the .mobileconfig file

iMazing Profile Editor lets you create and edit Apple configuration profiles (among other features). iMazing Profile Editor is a free app that you can install on your Mac from the Mac App Store or download directly from its developer.

Download and Install iMazing Profile Editor:

1. Navigate to https://imazing.com/profile-editor .
2. Click Free Download, or download from the Mac App Store.
3. If downloaded directly, open the iMazingProfileEditorMac.dmg and drag iMazing Profile Editor to your Applications folder.
4. Open iMazing Profile Editor.

Create your PaperCut configuration profile:

1. If the Preference Manifest Updates window doesn’t automatically appear with a list of newly updated preference manifests, then choose iMazing Profile Editor > Check for Manifest Repository Updates. This ensures that you’re using the configuration information available.
2. Close the Preference Manifest Updates window.
3. Choose File > New, just to be sure that you’re working with any newly available manifests.
4. In the upper right-hand Search field, type PaperCut. If there are no results in the sidebar, try quitting iMazing Profile Editor and then repeating this step.
5. In the sidebar, select PaperCut Print Deploy. Click Add Configuration Payload.
6. In the Server Host field, enter the FQDN that’s inside the square brackets in the file name of the client .dmg file you downloaded from your PaperCut server.
7. Click the menu for Server Scheme and select HTTPS.
8. Unless you know you need to configure other settings, just leave them at their defaults.
   For example, if you leave the Server Port blank, PaperCut will use the default port of 9174. You don’t need to specify this in your configuration profile.
9. In the upper-right Search field, click the X to clear the field.
10. In the left sidebar, select the General domain.
11. Set Name to whatever you would like the profile name to be, such as PaperCut Print Deploy Settings.
12. In the Identifier field, ensure that the value is a unique string and reflects the name of your organization.
    Note: the only real requirement is that this has a string that’s unique from any other configuration profile.
13. In the Organization field, enter your organization’s name.
14. In the Payload Description field, enter a description of the profile’s purpose, like “Configuration for PaperCut Print Deploy”.
15. Leave the Profile Signing menu set to Do not sign.
16. Click the Payload Scope menu and select System.
17. Leave the other settings at their defaults, unless you have a specific reason not to.
18. Click File > Save.
19. Select a save location.
    Note: You can leave the Sign profile with menu set to Do not sign. When you deploy this configuration profile using Kandji, there is no need to sign the profile, because  Kandji will sign it when it is deployed.
20. Click Save to save your profile.
21. Quit iMazing Profile Editor.

Option B: Use command-line tools and Plist2MobileConfig.zsh to create a .mobileconfig file

Use this option if you are not able to download and use the free tool from the previous section.

This is a two-part procedure:

• First, use a tool that comes with macOS to create a file in the .plist format.
• Then download and use a script to convert the file from the .plist format to the .mobileconfig format.

Create the .plist file:

1. Open the Terminal and issue the following command: defaults write ~/Documents/com.papercut.printdeploy.client server_host hostname
2. If you see the dialog that “Terminal” would like to access files in your Documents folder, click OK.
3. If you are concerned about the security implications of granting Terminal access to your Documents folder, you can click Don’t Allow, then use a location other than your Documents or Downloads folder. OR, click OK then when you are done, navigate to Privacy & Security settings > Privacy > Files and Folders > Terminal, then turn off Documents Folder.
4. Replace the hostname with the FQDN from the ‘.dmg’, for example, print-server.company.lan

Download the script to convert a file from the .plist format to the .mobileconfig format:

1. Using a web browser, open https://github.com/kandji-inc/support/tree/main/Plist2MobileConfig and review the brief instructions.
2. Select the Plist2MobileConfig.zsh file.
3. Download the script to the Documents folder on your Mac.
   1. Click the Copy raw contents button, which looks like two squares, and is displayed to the left of the Trash button.
   2. Paste the contents into a new text file using an editor such as BBEdit; then save the file in your Documents folder, with the file name Plist2MobileConfig.zsh).
4. Use the Plist2MobileConfig.zshscript to convert the .plist file to a .mobileconfig file.
5. Open the Terminal and issue the following commands:

cd ~/Documents

zsh /print-deploy/Plist2MobileConfig.zsh /print-deploy/com.papercut.printdeploy.client.plist

Step 6: Add the .mobileconfig file to Kandji using a Kandji Custom Profile Library Item

1. Sign in to your Kandji instance, for example, https://your-company.kandji.io or https://your-company.eu.kandji.io .
2. In the sidebar, select Library.
3. In the upper-right corner, click Add new.
4. Select Custom Profile.
5. Click Add & Configure.
6. Enter a name such as PaperCut PrintDeploy profile.
7. In the Assignment section, click Select Blueprint, then select the Blueprint or Blueprints to assign this Custom Profile to. (You can always change the Blueprint selection later.)
8. (Optional) Next to the Rules section, click Add, add one or more Assignment Rules, then click Confirm. ** ** 
   Assignment Rules limit which devices within the Blueprint will be assigned this Library Item.
9. In the Profile section, click the click to upload link.
10. In the Choose Files to Upload window, navigate to the folder where your .mobileconfig file is. If you used the Plist2MobileConfig script in Step 2, Option B above, it’s in your Documents folder.
11. Select the .mobileconfig file then click Upload.
12. Click Save.

Step 7: Verify the PaperCut Print Deploy client

1. Log in to a Mac that is in a Blueprint that contains the Custom Profile Library Item and the Custom Apps Library Item that you just configured.
   Note: The Custom Profile Library Item should be automatically deployed as soon as you create and save the Library Item.
2. (Optional) Open System Settings > Profiles (for macOS 13 Ventura or newer) or System Preferences > Profiles (for macOS 12 Monterey or earlier) to confirm the profile is displayed.
3. The Custom Apps Library Item should be automatically deployed within 15 minutes, and available in Self Service if you’ve configured it to be available in Self Service.
4. Optional: to force the Kandji Agent to check in and install the Custom App Library Item immediately, use the following steps:
   1. Open the Kandji Self Service app.
   2. In the sidebar click Device Info.
   3. Click Sync
5. Open the Applications folder and confirm that the PaperCut Print Deploy Client is displayed.
6. In the menu bar, confirm that the PaperCut menu bar item appears in the menu bar (looks like a printer).
7. Click the PaperCut menu bar item and choose View my printers.
8. Follow the usual procedure for PaperCut to authenticate and add printers.
9. Open System Settings (for macOS 13 Ventura or newer) or System Preferences (for macOS 12 Monterey or earlier), then open Printers & Scanners.
10. Confirm that all applicable PaperCut printer queues are displayed.
    Note: If enabled, the CUPS web interface appears.

Some environments will present the logged-in user with a username and password prompt.

A note about the default printer

As of v1.3 of Print Deploy, you can now set one print queue in each zone as the default by selecting “Set as default” on the print queue’s options button (⋯) within the zone.

As of v1.6 of Print Deploy, we will no longer set variations of “Find-me” as a default printer. You must use the above method.

However, if Windows has been set up to manage the default printer for users, then the client honors this setting. Disable this setting if you intend the client to honor the default print queue from the server.