Printer Admins

[jlepain]

Does anyone have a script they use with success to add local non-admin accounts to the lpadmin group? I am having an issue where students are clogging up the printer queues and the printers are pausing. They then can't unpause the printer since they aren't admins. I could manually reconfigure the CUPS conf file but I don't want to have to do that for every lab machine.

[nessts · Accepted solution]

Usage: dseditgroup [-pqv] -o edit [-n nodename] [-u username] [-P password] [-r realname] [-c comment] [-s ttl] [-k keyword] [-i gid] [-g uuid] [-S sid] [-a addmember] [-d deletemember] [-t membertype] [-T grouptype] [-L] groupname

so assuming all regular users are in AD and domain users i would do something like
dseditgroup -o edit -t group -a "Domain Users" _lpadmiin

[nessts · Accepted solution]

Usage: dseditgroup [-pqv] -o edit [-n nodename] [-u username] [-P password] [-r realname] [-c comment] [-s ttl] [-k keyword] [-i gid] [-g uuid] [-S sid] [-a addmember] [-d deletemember] [-t membertype] [-T grouptype] [-L] groupname

so assuming all regular users are in AD and domain users i would do something like
dseditgroup -o edit -t group -a "Domain Users" _lpadmiin

[jlepain]

Thanks for the response. What if we aren't using AD just local user accounts?

[mm2270]

You can still use dseditgroup for that. It can work on changing group memberships on the local domain. The primary difference is that you'll either need to add a different group in that the accounts are part of, or just add in each account individually to the lpadmin group.

[nessts · Accepted solution]

-a staff most likely.

[mm2270]

@nessts wrote:

-a staff most likely.

Yep, staff should work since its a default group for local accounts. There's also a group in OS X called "local accounts" which as you might expect, contains any local accounts in them.

$ dscl . read /Groups/localaccounts Comment
Comment:
 Group membership calculated by system
 Accounts from the local directory database or /etc files

[dstutz]

If you don't want to add them to the lpadmin group but want them to be able to unpause printers, you can edit the cupsd.conf file to change the level of access required to unpause printers. The cupsd.conf file is located at /etc/cups/cupsd.conf and the option that it's limiting for unpausing is referred to as Resume-Printer. It will be in the <Limit > section two lines above the line Require user @AUTHKEY(system.print.operator)

[waderobson]

Add staff or everyone to the _lpadmin group

/usr/sbin/dseditgroup -o edit -n /Local/Default -a everyone -t group _lpadmin

or

/usr/sbin/dseditgroup -o edit -n /Local/Default -a staff -t group _lpadmin

run as root. or make sandwiches
http://imgs.xkcd.com/comics/sandwich.png

[Chris_Hafner]

For various reasons we have a small group who isn't allowd to be part of the lpadmin group so I found this script somewhere long ago, that un-pauses all print queues and put it up on self-service. Works like a charm if you even need such a thing.

#!/bin/bash
printer=`lpstat -p | grep "disabled" | awk '{print $2}'`
cupsenable $printer
exit 0

EDIT somehow, the posting doesn't show the ' ' around lpstat -p | grep "disabled" | awk '{print $2}' in my above script. They are there... but it apparently just makes the posting red if I don't mark it as a script as I have now done.

[jlepain]

Thanks for the all the responses!

[cscsit]

I know this was posted a few years ago, but is there anyway of making this work with El Capitan? Seems as if Apple changed some things from Mac OS 10.10 to 10.12.

It would be great if the script below would work:

#!/bin/bash
printer=lpstat -p | grep "disabled" | awk '{print $2}'
cupsenable $printer
exit 0

When I try to run this, I get the error of:

"-bash: -p: command not found"

Thanks!

The idea is, I need a quick and easy way of letting students and staff unpause printers when necessary. I don't necessarily want to give everyone access rights to lpadmin.

[stevewood]

@cscsit the script you posted is missing some important parts. Namely the grave ticks that mark the executable portion of the script:

#!/bin/bash
printer=`lpstat -p | grep "disabled" | awk '{print $2}'`
cupsenable $printer
exit 0

That should fix the script. Without the back ticks on the printer= line, the system thinks you are trying to pass "printer" as the command.

[cscsit]

@stevewood Thanks! That at least made it run. Now I'll wait for a paused printer and see if it resolves the issue.

Thanks again! If it doesn't work, I may post back for more feedback.

[cbd4s]

Unfortunately the script still didn't work for my testing