Configuring Printers & Printer Policies

[dstranathan]

Im using a Policy to manage my printers. I have a simple environment regarding printers. All printers are HP and all PPDs are in the Apple/HP installer package.

Each Department gets (1) printer. Should be failry clean. I tend to manage computers over suers because my users and computers are fairly static tied to a simple primary department. People rarely move around and nobody shares computers.

Questions on printer best practices:

1) It looks like the JSS wants to use "generic" PPDs. Do I really need to upload every single PPD to the JSS that corresponds with my printers?

2) My Printer Policy Payload is shown below. Does it look good?

I have (1) Policy per Department (24 printer policies total)
Trigger = Reoccurring Check-in
Frequency = Ongoing
Maintenenece = Update Inventory
Scope = Specific Computers, Specific Users Target = (Department)

Im not sure if I fully understand the scope. In theory I get it, but not in practice. Does the scope above mean that ALL USERS & ALL COMPUTERs in a specific department will get the printer? This logic is a bit odd to me.

3) Do you suggest Static or Smart Computer Groups for printers? My computers/users dont move around much, so I rarely see "I have the wrong printer" problems.

Thoughts?

[davidacland]

Hi, you don't need to upload the ppd in the JSS. You just have to untick the "use generic" checkbox and add the path to the correct ppd file.

The policy options sound like the printer will repeatedly re-install itself. If you use ongoing for the execution frequency you will want to target a smart group with "missing printer" and "is in this dept" as options.

[dstranathan]

Thanks David.

When I path to the correct PPD file from the JSS, do I path to the CUPS PPD in /etc/cups/ppd/printer.ppd or to the /Library/Printers/PPDs/Contents/Resources/printer_ppd.zip archive?

[davidacland]

The one in /Library/Printers

[dstranathan]

If the Department has (2) printers, would adding an "And" operator to the Scope be sufficient for making sure both printers are mapped? Or do I need a smart group for each printer?

[dstranathan]

Does the PPD path have to be "friendly" (escape spaces etc)?

/Library/Printers/PPDs/Contents/Resources/HP LaserJet 500 MFP M525.gz

Versus

/Library/Printers/PPDs/Contents/Resources/HP LaserJet 500 MFP M525.gz

?

[dstranathan]

Totally confused here.

At first I thought I needed to upload a PPD from /etc/cups/ppd (based on anpther older JAMF Nation post I saw). After doing this, my gut feeling was that this might be the wrong move. So I posted this discussion to get clarity....

So then I maunally set the path to each PPD, per Davids suggestion. That looked better to me. But...

Now I cant get rid of the original PPD from the JSS or from Casper Admin!

Am I totally screwed here?

[mpermann]

@dstranathan you might want to consider using the lpadmin command to setup printers on your systems. There are many threads on JAMF Nation discussing this process. Here is an example of setting up a printer using the lpadmin command that I use:

lpadmin -p 'Queue_Name' -v 'lpd://10.0.0.1/' -D 'Printer Name' -L 'Optional Location' -P '/Library/Printers/PPDs/Contents/Resources/HP LaserJet 600 M601 M602 M603.gz' -E -o printer-is-shared=false -o HPOption_Duplexer=True

You can either put the command in a script or do as I am doing and put the command in the Execute Command in the Files and Processes payload. If you have any questions let me know.

[dstranathan]

Thanks @ mpermann. Ill give it a try and play around with it.

So, if I understand correctly, you dont have any printers in your JSS?

That "Execute Command" field is tiny! I guess you carve-out the script logic elsewhere (vi, pico, BBEdit etc) and paste it into the "Execute Command" field?

What kind of Trigger and Frequency have you set for printers?

I was told by JAMF sales that managing printers in Casper (via Policy) was awesome. I'm already scripting a lot of my printers now (messy combination of OD/MCX and bash). My CIO will ask "What's the point of spending a lot of $ on JAMF if your not using the most basic (yet importatnt) tools in Capser such as printer resources?" Which is a valid point. Not knocking Capser at all (powerful & dynamic delivery vehicle for almost anything) Thus, I must do my due diligence in terms of exploring all my options - including the "baked-in" printer management tools.

[mpermann]

You are correct. I have used it in the past, but I didn't use the built-in printer mapping feature in my most recent update to Self Service. We have around 50 print devices in our organization. There are only around 8 different model devices that I have to worry about for printer drivers. I always deploy the printer drivers at imaging time so I don't deploy them with the policy that adds the printer.

I have a Google Sheets document with all the printer networking information in it and I have simply stored that lpadmin command in the spreadsheet along with the rest of the information. Then I create a policy and copy and paste the lpadmin command from my spreadsheet to my policy. It's a little tedious but I only have to create the printers once. Using Self Service to deploy the printers guarantees that everyone has the printer setup the same exact way will all the options set the way we want them.

When you are adding the printers to Casper using the built-in functionality are you using the Casper Admin application to add the devices or are you doing the adding through the JSS web interface?

I can appreciate you wanting to use the built-in Casper tools to do as much as you can. But not all of the JAMF supplied tools are the best tools for the job. Take Composer for instance. While you can use it to capture a base OS, many folks choose to use the AutoDMG application to build a base OS. You'll find many opinions on the topic and ultimately you need to do what works best in your environment. If you have other questions let me know.

[dstranathan]

Yes, I am setting up the printers via Casper Admin. I mapped all my printers on my MAc admin workstation and then used Casper Admin to upload them to the JSS. Of course, they all showed up as "generic" (and thus the reason for this discussion post in the first place - Im not sure I have them configured properly)

To clarify - you dont have any kind of Trigger and Frequency set for your printer policies?

I'm looking to manage Printers in such a way that if a printer were to be deleted or umnapped accidently that Capser would add it back in a timely fashion (login, check-in or some other trigger). Im looking for advice on how that type of policy should look.

Right now I have a test Mac client thats in a policy and a Smart group for printer xxx is unmapped. But I cant get the policy to map the printer. The JSS thinks the Mac client ALREADY has the printer, and I cant seem to tell the JSS that the Mac does NOT have it. Is this common?

Im not going to roll-out Self Servce for a while. Its a huge value-add, indeed, but my main goals are to get JAMF implements for imaging, push out the JAMF agent and get all Macs enrolled, and then extract the Macs from my legacy OD/MCX/WGM and then Ill start adding icing on to the cake.

[mpermann]

@dstranathan the Self Service policy is set to ongoing to allow my end users the flexibility to re-install the printers should they accidentally delete it. Our end users have local admin level accounts on their computers. Most of our systems are laptops and they move amongst many different locations. But they don't all have the same printing needs so I don't attempt to automatically setup printers on their devices for them. I give them the ability to easily and reliably add the printer using Self Service and leave it at that.

As far as I know, Smart Groups are only updated upon an Inventory Update. So if your inventory update only happens 1 per week then a device could theoretically be without a specific printer for a week before Casper will notice it. You could change your update inventory policy to daily and that will limit the amount of time a device is without a printer. But for a more immediate action you will probably need something else to detect and remediate the accidental deletion of a printer.

To test whether your smart groups are working or not you can do a sudo jamf recon on the test system after you remove the printer and it should then fall into the appropriate smart group and reinstall the printer.

[Kumarasinghe]

FYI:
Printers adding via Casper Admin has the Generic PPD issue. Have a look here for the fix:
https://jamfnation.jamfsoftware.com/discussion.html?id=13432#responseChild79808