Prevent users from bypassing PaperCut

KB Home   |   Prevent users from bypassing PaperCut

Main.PreventUsersBypassingPaperCut History

Hide minor edits - Show changes to output

November 01, 2018, at 04:22 AM by 139.130.165.134 - Added additional search keywords "restricting, restriction, printer, MFD, MFP, Access"
Changed line 26 from:
[-Keywords: direct, ip, block, layer3, subnets, bypass, mapping, map-]
to:
[-Keywords: direct, restricting, restriction, printer, MFD, MFP, Access, ip, block, layer3, subnets, bypass, mapping, map-]
October 30, 2018, at 01:57 PM by Jack Lawless - Removed the brackets around the screenshots.
Changed lines 19-27 from:
[Attach:Disable_WSD3.png]

[
Attach:Disable_Bonjour2.png]





to:
Attach:Disable_WSD3.png

Attach:Disable_Bonjour2.png
Changed lines 19-21 from:
[Attach:Disable_WSD2.png]
to:
[Attach:Disable_WSD3.png]

[Attach:Disable_Bonjour2
.png]
October 29, 2018, at 10:02 PM by Alan Morris - added screenshots
Changed lines 19-21 from:


[Attach:Disable_Bonjour.png]
to:
[Attach:Disable_WSD2.png]
October 29, 2018, at 10:00 PM by Alan Morris - added screenshots
Changed line 19 from:
[Attach:Disable_WSD2.png]
to:
October 29, 2018, at 09:59 PM by Alan Morris - added screenshots
Added lines 17-18:
With WSD disabled, Windows cannot discovery and automatically add the printer.  With Bonjour disabled, Mac and iOS devices cannot locate the device broadcast.
Added line 20:
Deleted line 24:
With WSD disabled, Windows cannot discovery and automatically add the printer.  With Bonjour disabled, Mac and iOS devices cannot locate the device broadcast.
Added lines 16-18:

[Attach:Disable_WSD2.png]
[Attach:Disable_Bonjour.png]
October 29, 2018, at 09:46 PM by Alan Morris - Added a section on WSD and Bonjour since these protocols seem to impact the most customers
Added lines 13-21:

!!Disable protocols which are not used by the print server
WSD and Bonjour are protocols designed to make printer discovery easy on local subnets.  Disable these protocols within the device administrative Network configuration setting.



With WSD disabled, Windows cannot discovery and automatically add the printer.  With Bonjour disabled, Mac and iOS devices cannot locate the device broadcast.

Changed line 12 from:
This step is essential along with one or both of the above approaches to ensure users cannot print directly. You will need to disable functionality such as support for USB, Infrared, Bluetooth, onboard direct-WiFi printing, and any other direct connection that the device may support. You can either disable these modules within the printer's configuration interface, or talk with your device vendor to discuss possibilities on how to control these.
to:
This step is essential along with one or both of the above approaches to ensure users cannot print directly. You will need to disable functionality such as support for USB, Infrared, Bluetooth, onboard direct-`WiFi printing, and any other direct connection that the device may support. You can either disable these modules within the printer's configuration interface, or talk with your device vendor to discuss possibilities on how to control these.
May 22, 2016, at 10:03 PM by josh - Added WiFi as another printing method after support ticket came in.
Changed line 12 from:
This step is essential along with one or both of the above approaches to ensure users cannot print directly. You will need to disable functionality such as support for USB, Infrared, Bluetooth, and any other direct connection that the device may support. You can either disable these modules within the printer's configuration interface, or talk with your device vendor to discuss possibilities on how to control these.
to:
This step is essential along with one or both of the above approaches to ensure users cannot print directly. You will need to disable functionality such as support for USB, Infrared, Bluetooth, onboard direct-WiFi printing, and any other direct connection that the device may support. You can either disable these modules within the printer's configuration interface, or talk with your device vendor to discuss possibilities on how to control these.
March 15, 2016, at 11:59 PM by 203.222.91.204 -
Changed lines 1-3 from:
(:title Preventing the bypass of PaperCut:)

A common query we receive is regarding how to prevent users from bypassing the PaperCut software. Users are finding ways to allow themselves to print for free by connecting to the printer directly from their workstation or laptop. The following steps can be taken to limit or prevent this from happening.
to:
(:title Prevent users from bypassing PaperCut:)

A common query we receive is what measures can be taken to prevent users from bypassing PaperCut NG and PaperCut MF. In such situations, users allow themselves to print for free by connecting to printers directly from their workstation or laptop. The following steps can be taken to limit or prevent this from happening.
Changed line 1 from:
(:title Preventing the Bypass of PaperCut:)
to:
(:title Preventing the bypass of PaperCut:)
Changed line 1 from:
(:title Preventing Direct Printing:)
to:
(:title Preventing the Bypass of PaperCut:)
Deleted lines 13-14:
TODO link your page here: https://www.papercut.com/kb/Main/Miscellaneous
Changed line 17 from:
''Categories:'' [[Category.Security]], [[Category.Administration]]
to:
''Categories:'' [[Category.Security|+]], [[Category.Administration|+]]
Changed line 17 from:
''Categories:'' [[Security]], [[Administration]]
to:
''Categories:'' [[Category.Security]], [[Category.Administration]]
Changed line 17 from:
''Categories:'' [[Security]]
to:
''Categories:'' [[Security]], [[Administration]]
Changed lines 3-4 from:
A popular query we have is how to prevent users from bypassing the PaperCut Software. Users are finding ways to allow themselves to print for free by mapping the printer directly to their workstation. The following steps can be done to limit or prevent this from happening.
to:
A common query we receive is regarding how to prevent users from bypassing the PaperCut software. Users are finding ways to allow themselves to print for free by connecting to the printer directly from their workstation or laptop. The following steps can be taken to limit or prevent this from happening.
Changed lines 6-7 from:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses under the web interface, usually in the Security section. You should be able to allow only the Print Server IP address to be able to print and block all other unauthorized access. This ensures users cannot map the printer directly from their computers and will be required to use the PaperCut print server in order to print.
to:
Most modern print devices will allow an administrator to block or allow a certain range of IP addresses under the web interface, usually in the Security section. You should be able to "white-list" the Print Server IP address, authorizing printing to the device from just those addresses. All other IPs would be blocked, and this ensures users cannot print to this device directly and will be required to connect through the authorized and PaperCut-managed print server in order to print.
Changed lines 9-13 from:
If the above is not possible, a Network Administrator with the use of VLAN, MPLS, Subnetting or Layer 3 can set a routing rule to block all IP's from seeing the printer except for the Print Server. This will ensure that all direct connections to the printer are not possible, yet users will still have no problems printing via the PaperCut Print Server.

!!Disable Physical Printing
This
step is essential along with one or both of the above steps to ensure users cannot print directly. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer that the device may have. You can either disable these modules within the printers interface, or talk with your device vendor to discuss possibilities on how to prevent this.
to:
If the above is not possible, a Network Administrator with the use of appropriate VLAN, MPLS, Subnetting or Layer 3 network configuration can set a routing rule to block all IPs from seeing the printer except for the Print Server. This will ensure that all direct connections to the printer are blocked, but users will still be able to print via the PaperCut Print Server.

!!Disable Physical Printing
This step is essential along with one or both of the above approaches to ensure users cannot print directly. You will need to disable functionality such as support for USB, Infrared, Bluetooth, and any other direct connection that the device may support. You can either disable these modules within the printer's configuration interface, or talk with your device vendor to discuss possibilities on how to control these.
Changed lines 3-4 from:
A popular query we have is how to prevent users from bypassing the PaperCut Software. Users are finding ways to allow themselves to print for free by mapping the printer directly. The following steps can be done to limit or prevent this from happening.
to:
A popular query we have is how to prevent users from bypassing the PaperCut Software. Users are finding ways to allow themselves to print for free by mapping the printer directly to their workstation. The following steps can be done to limit or prevent this from happening.
Changed lines 6-8 from:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses. Under the web interface, usually in the Security section, you can allow only the Print Server IP address to be able to print and block all other unauthorized access. This ensures users cannot map the printer directly from their computers and will be required to use the PaperCut print server in order to print.

to:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses under the web interface, usually in the Security section. You should be able to allow only the Print Server IP address to be able to print and block all other unauthorized access. This ensures users cannot map the printer directly from their computers and will be required to use the PaperCut print server in order to print.
Changed lines 9-11 from:
If the above is not possible, a Network Administrator with the use of VLAN, MPLS, Subnetting or Layer 3 can set a routing rule to block all IP's except for the Print Server. This will ensure that all direct connections to the printer are not possible, yet users will still have no problems printing via the PaperCut Print Server.

to:
If the above is not possible, a Network Administrator with the use of VLAN, MPLS, Subnetting or Layer 3 can set a routing rule to block all IP's from seeing the printer except for the Print Server. This will ensure that all direct connections to the printer are not possible, yet users will still have no problems printing via the PaperCut Print Server.
Changed lines 12-13 from:
This step is essential along with one or both of the above steps to ensure users cannot print directly. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer that the device may have. To disable these devices, you can either disable it within the printers interface, or talk with your device vendor to discuss possibilities on how to prevent this.
to:
This step is essential along with one or both of the above steps to ensure users cannot print directly. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer that the device may have. You can either disable these modules within the printers interface, or talk with your device vendor to discuss possibilities on how to prevent this.
Changed line 19 from:
[-Keywords: **-]
to:
[-Keywords: direct, ip, block, layer3, subnets, bypass, mapping, map-]
Changed lines 3-4 from:
A popular query we have is how to prevent users from bypassing the PaperCut Software, allowing themselves to print for free by mapping the printer directly. The following steps can be done to limit or prevent this from happening.
to:
A popular query we have is how to prevent users from bypassing the PaperCut Software. Users are finding ways to allow themselves to print for free by mapping the printer directly. The following steps can be done to limit or prevent this from happening.
Changed lines 6-8 from:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses. Under the web interface, usually in the Security section, you can allow only the Print Server IP address to be able to print, and block all other unauthorized access. This ensures users cannot map the printer directly from their computers and bypass PaperCut.

to:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses. Under the web interface, usually in the Security section, you can allow only the Print Server IP address to be able to print and block all other unauthorized access. This ensures users cannot map the printer directly from their computers and will be required to use the PaperCut print server in order to print.

Changed lines 10-12 from:
If the above is not possible, it can be done by a Network Administrator with the use of network configuration. Setting up a block on all IP's except for the Print Server will again ensure that all direct connections to the printer are not possible, yet users will still have no problems printing via the PaperCut Print Server.

to:
If the above is not possible, a Network Administrator with the use of VLAN, MPLS, Subnetting or Layer 3 can set a routing rule to block all IP's except for the Print Server. This will ensure that all direct connections to the printer are not possible, yet users will still have no problems printing via the PaperCut Print Server.

Changed lines 14-15 from:
To ensure users cannot print directly, this step is essential along with one or both of the above steps. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer that the device may have.
to:
This step is essential along with one or both of the above steps to ensure users cannot print directly. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer that the device may have. To disable these devices, you can either disable it within the printers interface, or talk with your device vendor to discuss possibilities on how to prevent this.
Changed lines 3-4 from:
A popular request from our customers is having users bypass the PaperCut software, allowing themselves to print for free by mapping the printer directly. The following steps can be done to limit or prevent this from happening.
to:
A popular query we have is how to prevent users from bypassing the PaperCut Software, allowing themselves to print for free by mapping the printer directly. The following steps can be done to limit or prevent this from happening.
Changed lines 3-4 from:
A popular request from our customers is users bypassing the PaperCut software to print directly, effectively allowing themselves to print for free. The following steps can be done to limit or prevent this from happening.
to:
A popular request from our customers is having users bypass the PaperCut software, allowing themselves to print for free by mapping the printer directly. The following steps can be done to limit or prevent this from happening.
Changed lines 6-8 from:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses. Under the web interface, usually in the Security section, you can allow only the Print Server IP address to be able to print, and block all other unauthorised access. This ensures users cannot map the printer directly from their computers and bypass PaperCut.

to:
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses. Under the web interface, usually in the Security section, you can allow only the Print Server IP address to be able to print, and block all other unauthorized access. This ensures users cannot map the printer directly from their computers and bypass PaperCut.

Changed lines 3-4 from:
A popular request from our customers is users bypassing the PaperCut software to print directly, effectively allowing themselves to print for free.
to:
A popular request from our customers is users bypassing the PaperCut software to print directly, effectively allowing themselves to print for free. The following steps can be done to limit or prevent this from happening.
Changed lines 14-15 from:
To ensure users cannot print directly, this step is essential. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer in order for the above steps to be effective.
to:
To ensure users cannot print directly, this step is essential along with one or both of the above steps. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer that the device may have.
Changed lines 3-4 from:
A more recent request as of late from our customers is users bypassing the PaperCut software to print directly, effectively allowing themselves to print for free.
to:
A popular request from our customers is users bypassing the PaperCut software to print directly, effectively allowing themselves to print for free.
Changed lines 3-8 from:
TODO page content here.

!!Subheading
!!Subheading
!!Subheading
to:
A more recent request as of late from our customers is users bypassing the PaperCut software to print directly, effectively allowing themselves to print for free.

!!Printer Configuration
Most modern corporate print devices will allow an administrator to block or allow a certain range of IP addresses. Under the web interface, usually in the Security section, you can allow only the Print Server IP address to be able to print, and block all other unauthorised access. This ensures users cannot map the printer directly from their computers and bypass PaperCut.


!!VLAN / MPLS / Subnet / Layer 3
If the above is not possible, it can be done by a Network Administrator with the use of network configuration. Setting up a block on all IP's except for the Print Server will again ensure that all direct connections to the printer are not possible, yet users will still have no problems printing via the PaperCut Print Server.


!!Disable Physical Printing
To ensure users cannot print directly, this step is essential. You will need to disable items such as USB, Infrared, Bluetooth, and any other direct connection with the printer in order for the above steps to be effective.

Changed line 21 from:
[-Keywords: TODO keywords here if needed-]
to:
[-Keywords: **-]
Added lines 1-14:
(:title Preventing Direct Printing:)

TODO page content here.

!!Subheading
!!Subheading
!!Subheading

TODO link your page here: https://www.papercut.com/kb/Main/Miscellaneous

----
''Categories:'' [[Security]]
----
[-Keywords: TODO keywords here if needed-]

Comments

Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.

Article last modified on November 01, 2018, at 04:22 AM
Printable View   |   Article History   |   Edit Article