If this works, does it follow that removing "CUPS-Add-Modify-Printer" from the block below will allow anyone to add a printer?

[code]# All administration operations require an administrator to authenticate...
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
AuthType Default
Require user @SYSTEM
Order deny,allow
</Limit>
[/code]

I've been to that site, but it advocates a sledgehammer approach rather than a scalpel approach. If you want to go from totally locked down to totally open, then that's the way to go. I do not want to go to totally open. I want to selectively grant rights.

My question was, would simply removing the one item from the <limit> tag allow non-admins to add printers? The logic would seem to follow, if this hint is correct and functions as described.

I ghave not seen this to be the case. I have several mbps that I create a 10.5.2 image for and have never seen this. The users are all standard users. Also they have been upgraded to 10.5.5 and still no issues with pausing and resuming. They are not bound to AD. Is this a AD issue? I actually just verified this to see if I was crazy or not.

:)

Yes, it does mean that you can grant them add/remove rights. The caveat is that your users will still not have the ability to unlock system preferences, so they cannot add printers via the print and fax prefpane. They will have to add them via the "Add Printer" pulldown in the print dialog pane, or you can create an alias to /System/Library/CoreServices/AddPrinter.app in their dock/desktop/apps/whatnot.

This hint is invaluable, it's been causing me a world of grief since I updated the systems I manage to 10.5.

Is this a AD things only? I have about 20 mbp's all have 10.5.2 and all users are normal users not admins. I had no trouble pausing and resuming printing on any of them I tested.

I have not seen this to be the case. I have several MBPs that I created a 10.5.2 image for and have never seen this. The users are all standard users. Also they have been upgraded to 10.5.5 and still no issues with pausing and resuming. They are not bound to AD. Is this a AD issue? I actually just verified this to see if I was crazy or not.

:)

It affects me, with network home users (middle school students) on 10.5.4 client with 10.5.4 server-based print queues. Using OD/LDAP. Can't wait to try this fix!

---
--Abe

This problem has been plaguing us ever since we upgraded this summer. I was very excited to publish printers using OD, but found early on that the printers would randomly pause themselves and the above stated problem would ensue for my users. I've been tracking it for quite some time and I think it's because the PPDs, as configured on the server, aren't sent out to the workstations by OD. I can set all the necessary printing preferences on the server (ie: set the printer to duplex), but when I go back to a workstation, they're all set to the defaults. The default error policy for all printers is to stop printing. Creating the printer locally and changing the options seems to work, but if the printer is coming down from the directory, BAM!--problems.

This is a great workaround, but I still think it's just that and not a true solution. Anyone know if Apple has addressed this issue in versions later than 10.5.4 (Client and Server)?

Still not fixed in 10.5.6. Also, we recently updated our HP drivers for another type of printer, and for some reason, HP changed the default config for one of their PPDs. Now, the PPD in questions that comes down via MCX has the default tray set to the letter feed instead of the tray underneath. Because the clients aren't honoring the printer options set in CUPS, I have no way to fix this.

What a mess. I think I'm going to just bite the bullet and ditch MCX printer management--I've got better things to spend my time on, rather than fielding calls every five minutes because of another stupid printer error. Apple better get their $h17 together, ASAP...

I am getting ready to try this at our school. Has this been addressed at all in 10.5.6?

Thanks

I'm working on a school lab as well - our imacs have the same as above listed on line 110, 77, 40

<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After Cancel-Jobs CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
Require user @AUTHKEY(system.print.operator) @admin @lpadmin
Order deny,allow
</Limit>

Im having trouble telling why its in there three times - anyone know? I really want to enable the user to pause and resume printing.