Restrict printing by AD security group membership

[imperatives]

Is it possible to restrict printing to a particular printer using AD security groups without adding them to a Windows printer server? I've been experimenting with CUPS allow groups, but have thus far been unsuccessful in restricting print access. In other instances we have configured default settings for printers in the local CUPS interface, captured it with Casper Admin, and deployed it seamlessly. This request has got me stumped. Any assistance would be greatly appreciated.

Thanks!

[imperatives · Accepted solution]

I had an issue with my syntax. You need to prefix groups with @ when you add them to the CUPS Allow list.
Example:
/usr/sbin/lpadmin -p printername -u allow:@adgroupname