Print Operator Dialog Box

Getting rid of and adding back the printer was what fixed it for me.

In combination with the link above and some others I think I have a solution that works for me.

First there are two places that you can handle printer settings. One is with the /etc/cups/cupsd.conf file and the other is with the /etc/authorization file.

I know that there are some articles out there that say that every user is added to the the lpadmin group which controls printing. I don't think that is true. You can see what groups a user belongs to by using the id username command in terminal. Every user (network or local) is added to the staff group. You can use this to your advantage when changing something you want all users to be able to do.

My situation is not uncommon. We have several laptops that our students take home as part of a 1:1 program, but none of those students have administrative access. Simple things like installing printers becomes a problem. We also had some kids whose printers would pause and they had to bring them to the tech department just to resume printing. Until we installed Snow Leopard I didn't have a problem allowing all users to add an delete printers through the print/fax system preferences pane (even with the lock engaged).

The solution I came up with might be overkill but what I changed is in bold below. I am not quite sure why just changing the cupsd.conf file didn't work and I did not test only changing the authorization file.

*Be sure to make a backup of these files before you change anything. I use a program called Text Wrangler to make the changes so I don't have to mess with the rich text issues in Text Edit.*

/etc/cups/cupsd.conf

# All administration operations require an administrator to authenticate...
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
*#Require user @SYSTEM*
*Require valid-user*
Order deny,allow
</Limit>

# All printer operations require a printer operator to authenticate...
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
*#Require user @AUTHKEY(system.print.operator) @admin @lpadmin*
*Require valid-user*
Order deny,allow
</Limit>

/etc/authorization
+The system.print.operator key is new to Snow Leopard and seems to control resuming and pausing a printer queue among other things.+

<key>system.print.admin</key>
<dict>
<key>allow-root</key>
<true/>
<key>class</key>
<string>user</string>
<key>group</key>
<string>staff</string>
<key>shared</key>
<true/>
</dict>
<key>system.print.operator</key>
<dict>
<key>allow-root</key>
<true/>
<key>class</key>
<string>user</string>
<key>group</key>
<string>staff</string>
<key>shared</key>
<true/>
</dict>

We also have this issue and our users do not have admin logins. Having someone from IT stop by and authenticate for them isn't really a solution.

Surely there must be a workaround for this?

Any thoughts or suggestions would be gratefully received!

Cheers,
-Darren

You can avoid the issue by adding the users to the print operator group. For each user, you have to execute the following command:

dseditgroup -o edit -u admin_name -p -a user_name -t user _lpadmin

"dseditgroup" adds the user_name to a group (in this case, _lpadmin).
And admin_name is the name of your administrator's account.

I am having the same issue and before I try some of the information here I would like to know if this would be a possible solution for MacOS that is on a domain where there are no local users on the computer itself.

We recently upgraded all of our Mac Clients to snow leopard and joined them to the domain as they were not in the past. This was done for a variety of reasons so that the Mac Clients can receive web filtering policies based on domain credentials and a few other management items that we will try and work out later to provide access to some network resources. So far the biggest complaints have been this printing thing where the teacher can no longer manage print jobs and the fact that no one can install any updates to the MacOS or to any of the software on the computer.

Have no more energy for this. Since Apple MacBook Pro was purchased September 4 this month, am returning the computer to Apple and getting credit on my card. Apple/HP need to deal with this problem. I am going back to my OLD Mac Pro/MacBook Pro and will be setting them up to run like they used to.

I think the problem is with HP and Apple's Snow Leopard OS, and when they figure out the glitch, will again purchase from Apple, but for me now...NO MORE!

I'm on server 10.6.4, and I'm having this problem still. My client machines (80 students) are getting the school's printers from the server. I am having to visit about 5 staff/student machines a day that are paused that they can't un-pause. Is there a non-magical, not-extensively coded, reliable, user-friendly way to make that not happen? Is there a real solution here yet?

Also, despite the fact that I've checked the box "allow user to modify the printer list", they still can't add their own home printers without an admin password. I don't understand at all.

Bump. Have same issue and can't figure out the solution.

Message was edited by: Brian Kolling

You can authenticate in that dialog with any administrative user.

I've seen this on most of my 10.6.2 iMacs.

I tried as you said and I'm told Failed to set credentials. I then tried again and got Group not found.

I got this command to work. Now the user I added cannot pause printing at all without a password. Before this they could pause but not resume.

There is a good discussion of this problem here:

http://blog.macadmincorner.com/allow-non-admin-users-to-manage-printers/

Maybe it will help.

Chris,

I tried as your link suggests. Still no change for me under 10.6.4.

Brad

in the username can't you type "everyone" and that would add everyone to the print group?