How to Secure your Web Print Sandbox server

With many thanks to Rhett from Portland State University for this one! When setting up a PaperCut Web Print Sandbox server we recommend that the machine is physically secure as it is required to be logged in at all times. This can easily be secured by the use of virtual machine software such as VMWare or Virtual Box, to name a couple. Rhett however emailed in with a very elegant solution using inbuilt Microsoft Windows functionality. “The system locks so fast that one does not have time to even see a desktop, let alone do anything else, except unlock the desktop.” Installation instructions Copy the below batch file contents into your favorite text editor Save the script to a location on the local machine such as: C:\Windows\System32\GroupPolicy\User\Scripts\Logon Then use a (Local) GPO to tell the server (workstation) to run the script on logon. At the moment, after each upgrade of the PaperCut Web Print software I have to go to the start-up folder and remove Web Print shortcut (as the below script will run it for me). Batch file contents ::####################################################################### ::# # ::# This program requires one to keep a workstation logged in # ::# and so this batch file was designed to lock the workstation, # ::# give the profile time to map its drive, # ::# and then automatically start PaperCut’s Web Print (sandbox) # ::# program. # ::# # ::# The best way to read this batch file is to use Notepad++ # ::# # ::####################################################################### ::# # ::# Last modified Jun 19, 2011 # ::# # ::# Added Comments to make it easier to read and figure out # ::# what each part does. # ::# # ::#######################################################################       @ECHO OFF       ::####################################################################### ::# # ::# This section section below will automaticall lock # ::# the desktop at login. # ::# # ::#######################################################################       \system32\rundll32.exe user32.dll,LockWorkStation       ::####################################################################### ::# # ::# The section below will give the profile time to map its # ::# Hot Folder (W:) drive to the PaperCut application server. # ::# # ::# The 180 below is the number of seconds the system will wait # ::# before going on to the next task. One can change this number # ::# to increase or decrease the time as they see fit. Through # ::# trial and error 180 seconds proved to be a good time. # ::# # ::#######################################################################       ping 127.0.0.1 -n 180 -w 1000 > nul       ::####################################################################### ::# # ::# The section below starts PaperCut’s Web Printing application # ::# # ::#######################################################################       “C:\Program Files\PaperCut NG\providers\web-print\win\pc-web-print.exe”       ::####################################################################### ::# # ::# This batch file has come to the end! # ::# # ::#######################################################################       Exit