Print enablement & management in distributed working environments

At PaperCut we understand the challenges and considerations faced when moving to a distributed working environment and we have assisted many organizations successfully adapt to a remote way of working. We would like to share some of the more common configurations that are helping people track their printing in this newer approach to working. Scenario A - Printing to a shared printer without a VPN connection VPN is not an option for remote users so your users cannot access your organization’s printers in the traditional way. Here we explore some of the off-networking printing features of PaperCut. You are unable to provide access to your organization’s private network over VPN, which means your users cannot access the server queues and need an alternative printing solution. Scenario B - Printing to a shared printer via a VPN connection This scenario explores printing remotely to your organization’s existing shared queues, whether direct printing or using hold/release, and the considerations for each. You have provided access to your organization’s private network over VPN This means the majority of your office resources are accessible, everything from shared files and folders to network print queues can be utilized from remote locations. Scenario C - Printing to a home printer In this example, we will consider… How to track printing when your users are printing to a printer at home, or remote location, using the PaperCut Direct Print Monitor How to set up shared account selection or client billing where required The use of RDS or VDI connections over VPN, where a home printer is a redirected printing option in the session Your workforce is working remotely but their need to print is still very real, so how can you track and report on this usage? How do I charge this expense back to client account codes in PaperCut? Printing to a shared printer without a VPN connection If your users are unable to connect to the organization’s network and still require use of your server based printers, there are at least three PaperCut features that can be utilized to achieve this, as well as an exciting new feature in development. Convenient printing over the internet via PaperCut Mobility Print Now available on Chromebooks and Windows clients - coming soon on Mac! Cloud Print is Mobility Print’s newest feature that enables users to print over the internet remotely, making it a like-for-like alternative to Google Cloud Print. For more information on how to set this up, check out the Setting up Cloud Print for Mobility Print section of the help center. Web Print Web Print is a driverless printing feature that allows users to print by uploading documents through a web browser without the need for the user client or print queue installation. To configure and implement, check out our Web Print section. In order to utilize this feature, users will require access to the User Web Interface. When it comes to accessing the web portal, you can make the PaperCut server accessible externally by creating a public DNS entry for when users are not connected to the same network as your PaperCut Application server. And you need to set up port forwarding or put the PaperCut server behind a Web application firewall (WAF), and install a trusted SSL certificate. Security Notes: Making the URL publicly facing is a network level function, not something which is configured within PaperCut. We highly recommend only opening the HTTPS port 9192 to the Internet (the TLS port) rather than the plain text port 9191. Restricting the administrator-level access to only local IP addresses/subnets is something we would recommend when allowing external access to PaperCut. Options - Advanced - Allowed admin IP addresses For more information take a look at restricting access to the Application Server by SysAdmins. Assigning print costs to a shared account (Client billing) When using a Web Print, where each print job needs to be billed back to an account, shared account selection is available when submitting jobs through the User Web Interface. Email to print Email to Print allows users to print by emailing their documents to a predefined email address. No client software or drivers are required, providing a simple way for your organization to print from any device. Users require nothing more than an internet connection and the ability to send an email. By default, email to print supports PDF and picture file attachments. Additional support for Microsoft Office attachments is available when a Web Print Sandbox is configured. How do users submit a print job via Email to Print? Each printer has a unique email address e.g. printing1@example.org Users compose an email, attach a printable document(s), and email to the printer’s address PaperCut receives the email and prints the attachment on behalf of the user To configure and implement, check out our Email to Print section. Assigning print costs to a shared account (Client billing) Account Selection at the MFD The only method for account selection when using Google Cloud print, would be assigning the print job at the MFD. Please note that not all devices or PaperCut application versions are supported, for more information please take a look at the system requirements. To enable users with the ability to assign an account (personal or shared) to a print job (at the printing device and/or via the User Client), you must configure them with the relevant Account Selection options. Email to Print - Limitations & considerations All print options are locked to the print queue defaults The User Client is not an option for account selection You can use Email to Print in conjunction with Find-Me printing and printer load balancing. You can use Email to Print in conjunction with internal (users managed by PaperCut NG/MF) or guest users Google Cloud Print through PaperCut Please note that Google has announced GCP will no longer be supported from December 31, 2020. (GCP) is a cloud-based printing service from Google that lets people print anywhere from any device over the internet. When combined with PaperCut, it offers a powerful mobile printing solution for any size organization. Once configured, GCP will allow users to print from their distributed working environment to your existing server shared printers. Check out our Google Cloud Print Help Centre page for implementation guidance. Assigning print costs to a shared account (Client billing) Account Selection at the MFD The only method for account selection when using Google Cloud print, would be assigning the print job at the MFD. Please note that not all devices or PaperCut application versions are supported, for more information please take a look at the system requirements To enable users with the ability to assign an account (personal or shared) to a print job (at the printing device and/or via the User Client), you must configure them with the relevant Account Selection options. Google Cloud Print - Limitations & considerations The User Client is not an option for account selection Consider removing Account Selection popups from GCP hosted print queues : Printers - Printer Name - Summary - Advanced Configuration - Override user-level settings Printing to a shared printer via a VPN connection When a workstation has connectivity via VPN to shared printers, printing should continue to work as normal. You may find it prudent to configure direct print queues for hold/release, in order to ensure documents are not left unattended on printers. This will be useful for environments where there is intermittent access to collect print jobs. Things to consider… If using a hold/release queue as part of the secure print release feature, jobs can then be released at an MFD, release station or the user web summary page By default print jobs are deleted if not released after 120 minutes. Therefore it might be worth considering an extension of the timeout period if jobs are to be released at a later point, whilst someone is on-site at the device or release station Should someone on-site be collecting these print jobs on behalf of another user, there will be a requirement to configure Delegated Print Release. This option provides the permissions for specific users to release print jobs sent by selected users or groups of users Assigning print costs to a shared account (Client billing) When using a shared printer, where each print job needs to be billed back to an account, shared account selection is available using either of these two options: User Client tool Install the User Client to the user’s workstation in order to assign jobs to a shared account or unauthenticated user via the user pop up at the point of sending the print job. Account Selection at the MFD When there is access to the physical network printer on site, the simplest account selection method might be to allocate the print job at the point of release. Please note that not all devices or PaperCut application versions are supported, for more information please take a look at the system requirements. To enable users with the ability to assign an account (personal or shared) to a print job (at the printing device and/or via the User Client), you must configure them with the relevant Account Selection options. Printing to a home printer This section offers guidance for when there is a requirement to track print jobs being sent by users to locally installed home printers. Please note for these options to work in real-time, a connection to the application server will be required over VPN. For users that are not connected to their office infrastructure over a VPN, the Direct Print monitor can be configured to save a history of all print jobs. Once back at the office, these transactions will be sent to the PaperCut MF server. Track printing using the Direct Print Monitor For installations running PaperCut Version 16 and above, the Direct Print Monitor can be installed on the user’s workstations to track any printing done locally (that is, directly to a printer over USB, ethernet or AirPrint). How does it work? The Direct Print Monitor (DPM) tracks print jobs sent directly from a user’s computer to a printer, without an intervening print server. Each computer printing directly requires the following components: A print queue that sends jobs directly to a printer rather than to a shared print server queue A small PaperCut monitoring component, known as a Direct Print Monitor, which reports printing metadata to the PaperCut Server When users connect via VPN to the PaperCut server, the DPM’s will report in and upload print usage. When installing the Direct Print Monitor at home, ensure that the Template Printer Failure Mode setting is configured. Failure Mode will allow new jobs to print and log after reconnection. (Failure to do this will result in the loss of print tracking should the VPN go down and you continue to print. To configure this, see behaviour on server connection failures). Once connected to the PaperCut server, you will be able to configure the remote printer in the dashboard to set up charging and any other required settings. Although this may not be required if only print volume tracking is required. For more information on direct printing, including how to install the Direct Print Monitor, please follow the instructions here. Considerations for large environments when installing DPM Assigning print costs to a shared account (Client billing) When using a DPM, and where each print job needs to be billed back to an account, shared account selection is available using the User Client tool. Install the User Client to the user’s workstation in order to assign jobs to a shared account or unauthenticated user via the user pop up at the point of sending the print job. Direct Print Monitor - Limitations & Considerations Users could potentially uninstall the DPM Print Archiving is not supported Connection to PaperCut server (possibly over VPN) is required With account selection configured the User Client must be installed Printing to a redirected home printer Your users are connecting to your organization’s environment via a Remote Desktop Services (RDS) session or through a Virtual Desktop Infrastructure (VDI) environment and their home printer is available to print to as a redirected printer within that session. In this scenario, it will be necessary to install either a secondary print server / Direct Print Monitor on the workstation in the office, when the printer that needs tracking is both: Locally installed Redirected in the session In order to track redirected printers, the following additional line needs to be added to the print-provider.conf file. IgnoreTerminalServerPrinters=off Install the Papercut Secondary Server or DPM on the host workstation and configure. Open the following file in a text editor such as Notepad: [app-path]\providers\print\win\print-provider.conf Add the line IgnoreTerminalServerPrinters=off Open Group Policy Editor and navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Printer Redirection Disable the Use Remote Desktop Easy Print driver first policy. Restart the PaperCut Print Provider service and we will now track jobs sent to the redirected printer. Still have questions? Let us know! We love chatting about what’s going on under the hood. Feel free to leave a comment below or visit our Support Portal for further assistance.