printtool wants permission to modify printer settings

Question

Level 1

16 points

printtool wants permission to modify printer settings

Since updating client computers to 10.11.1 from 10.10.5 we are getting admin password request every time a guest, network or mobile user prints a document.

print tool is trying to modify the printer settings. Type the name and password of a user in the "Print Administrators" group to allow this. [Cancel | Modify Settings]

Canceling this dialogue 3 times will allow the user to print the current document.

The dialogue will be back next time they print even if a administrator has previously provided authorisation.

I thought a quick solution maybe:

sudo dseditgroup -o edit -n /Local/Default -u localadmin -p -a networkuser -t user _lpadmin

But it doesn't like networkuser. I don't want to do it for guest anyway.

A user should be able to print with out permission to modify printer settings.

Any idea how I can tell what settings print tool is trying to change?

Thanks

Posted on Nov 17, 2015 4:58 PM

Reply

Answer 1

Best reply

John Lockwood

Level 6

13,685 points

Nov 18, 2015 4:12 PM in response to dane

I have not seen this particular problem but a far more common one is the fact that non-admin level users cannot resume paused print queues. It maybe that the solution to that will help you in this case as well. I use the following two commands to allow all users to resume paused print queues.

/usr/bin/security authorizationdb write system.print.operator allow

/usr/sbin/dseditgroup -o edit -n /Local/Default -a everyone -t group lpadmin

The following would be an alternative format for the second command

/usr/sbin/dseditgroup -o edit -n /Local/Default -a 'Domain Users' -t group lpadmin

where 'Domain Users' represents a name of a group in Open Directory or Active Directory. The everyone entry is a special auto-maintained group that contains all users.

If I remember correctly, the first command maybe to allow non-admin users to auto download drivers from Apple in order to add new printers, this applies to those makes Apple themselves provide drivers for e.g. Canon, Epson, HP, but not Konica-Minolta. I do however also have a workflow step in my DeployStudio setup to pre-install the drivers we use. I use Munki and Apple Software Update Server to push updated drivers as they become available.

Reply

Answer 2

dane Author

Level 1

16 points

Nov 18, 2015 5:08 PM in response to John Lockwood

Thanks John, That helped. I had an incorrect understanding of what I wanted to achieve. I was trying to add a user not a group.

/usr/sbin/dseditgroup -o edit -n /Local/Default -a everyone -t group lpadmin

appears to resolve the problem so far.

I did not need to run the first command (/usr/bin/security authorizationdb write system.print.operator allow)

Adding the sub group netaccounts instead of everybody fixes the network users but obviously not the local standard users or guest.

Does this create much of a security problem?

Reply

Answer 3

Nov 18, 2015 6:31 PM in response to dane

dane wrote:

Does this create much of a security problem?

I don't think so, other than that they could accidentally delete a print queue.

Reply