Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Unable to resume a paused printer with a standard Mac OS X level account?

7,027 views
Skip to first unread message

Ant

unread,
Feb 17, 2013, 2:08:39 AM2/17/13
to
Hello again.

Tonight, my client ran into an interesting problem with his HP DeskJet
F4280 USB printer. It refused to print because it was in paused mode.
Resuming it failed because it wanted administrator access since he is
using a standard Mac OS X 10.8.2 account (did not want to give full
administrator account since he is a type of person to mess up his
computer).

How does one fix this? IIRC, pausing and resuming should not require
administrator acccess? :(

Thank you in advance. :)
--
Quote of the Week: "I think the ants are waking up -- they need to start
farming so..." --Erin from The Office (U.S.) S7E18 (Todd Packer).
/\___/\ Ant(Dude) @ http://antfarm.home.dhs.org (Personal Web Site)
/ /\ /\ \ Ant's Quality Foraged Links: http://aqfl.net
| |o o| |
\ _ / Please nuke ANT if replying by e-mail. If crediting,
( ) then please kindly use Ant nickname and AQFL URL/link.

David Empson

unread,
Feb 17, 2013, 3:09:09 AM2/17/13
to
Ant <ANT...@zimage.com> wrote:

> Hello again.
>
> Tonight, my client ran into an interesting problem with his HP DeskJet
> F4280 USB printer. It refused to print because it was in paused mode.
> Resuming it failed because it wanted administrator access since he is
> using a standard Mac OS X 10.8.2 account (did not want to give full
> administrator account since he is a type of person to mess up his
> computer).
>
> How does one fix this? IIRC, pausing and resuming should not require
> administrator acccess? :(

Didn't you already ask a similar question a few weeks ago and get
several answers which explained the reasoning for this behaviour?

Pausing a print queue on OS X is an operation which can only be done by
a user account with admin privileges. A standard privilege user should
not be allowed to pause a print queue, because that would interfere with
printing from other accounts. An admin user is assumed to have a good
reason for pausing a print queue and should understand the effect this
will have on other user accounts.

Similarly, unpausing a printer is an operation that only an admin user
should do, because the printer may have been deliberately paused by the
admin to prevent anyone using a particular printer due to a temporary
problem (for example).

Standard user accounts in OS X can delete or pause their own individual
print jobs, just not the entire queue.

Having said that, if the computer and and printers are only used by one
person, it is possible to grant printing system admin rights to certain
user accounts without giving them full administration of the computer.

You can set this up by logging in as an admin user, running Terminal and
entering a command in the following form (which is sensitive to case,
spacing and punctuation):

sudo dscl . -append /Groups/_lpoperator GroupMembership ACCNAME

Subsitute ACCNAME with the short name of the user's account, i.e. their
home folder name. For example, if their home folder name is "jim"
(/Users/jim) then the full command would be:

sudo dscl . -append /Groups/_lpoperator GroupMembership jim

(The sudo command will prompt you for a password: enter the password of
the admin account under which you are logged in.)

If you want to remove this special privilege later, this is the
corresponding command:

sudo dscl . -delete /Groups/_lpoperator GroupMembership ACCNAME

--
David Empson
dem...@actrix.gen.nz
Message has been deleted
Message has been deleted

Ant

unread,
Feb 17, 2013, 9:17:40 AM2/17/13
to
On 2/17/2013 12:09 AM PT, David Empson typed:

> Pausing a print queue on OS X is an operation which can only be done by
> a user account with admin privileges. A standard privilege user should
> not be allowed to pause a print queue, because that would interfere with
> printing from other accounts. An admin user is assumed to have a good
> reason for pausing a print queue and should understand the effect this
> will have on other user accounts.

How did it get paused then if no administrator access?


> Similarly, unpausing a printer is an operation that only an admin user
> should do, because the printer may have been deliberately paused by the
> admin to prevent anyone using a particular printer due to a temporary
> problem (for example).
>
> Standard user accounts in OS X can delete or pause their own individual
> print jobs, just not the entire queue.

If he can pause, then how come no resume? It was his print jobs.


> Having said that, if the computer and and printers are only used by one
> person, it is possible to grant printing system admin rights to certain
> user accounts without giving them full administration of the computer.
>
> You can set this up by logging in as an admin user, running Terminal and
> entering a command in the following form (which is sensitive to case,
> spacing and punctuation):
>
> sudo dscl . -append /Groups/_lpoperator GroupMembership ACCNAME
>
> Subsitute ACCNAME with the short name of the user's account, i.e. their
> home folder name. For example, if their home folder name is "jim"
> (/Users/jim) then the full command would be:
>
> sudo dscl . -append /Groups/_lpoperator GroupMembership jim
>
> (The sudo command will prompt you for a password: enter the password of
> the admin account under which you are logged in.)
>
> If you want to remove this special privilege later, this is the
> corresponding command:
>
> sudo dscl . -delete /Groups/_lpoperator GroupMembership ACCNAME

Thanks. Or maybe I should give him full admin access. Hmm.
--
"The foreign policy aim of ants can be summed up as follows: restless
aggression, territorial conquest, and genocidal annihilation of
neighboring colonies whenever possible. If ants had nuclear weapons,
they would probably end the world in a week." --Journey to the Ants,
page 59. Bert Holldobler & Edward O. Wilson
/\___/\ Ant(Dude) @ http://antfarm.ma.cx (Personal Web Site)
/ /\ /\ \ Ant's Quality Foraged Links: http://aqfl.net
| |o o| |
\ _ / If crediting, then use Ant nickname and AQFL URL/link.
( ) If e-mailing, then axe ANT from its address if needed.
Ant is currently not listening to any songs on this computer.

JF Mezei

unread,
Feb 17, 2013, 12:30:29 PM2/17/13
to
On 13-02-17 09:17, Ant wrote:

> How did it get paused then if no administrator access?

I have seen printers get paused due to some problems printing jobs (job
getting stuck etc).

Is there a way to do the equivalent of chmod on a print queue ? to give
world access to pause/resume function ?


David Empson

unread,
Feb 17, 2013, 2:00:30 PM2/17/13
to
Ant <a...@zimage.comANT> wrote:

> On 2/17/2013 12:09 AM PT, David Empson typed:
>
> > Pausing a print queue on OS X is an operation which can only be done by
> > a user account with admin privileges. A standard privilege user should
> > not be allowed to pause a print queue, because that would interfere with
> > printing from other accounts. An admin user is assumed to have a good
> > reason for pausing a print queue and should understand the effect this
> > will have on other user accounts.
>
> How did it get paused then if no administrator access?

I've seen print queues pause themselves automatically when there is a
problem communicating with the printer, or perhaps a bug in the driver,
or perhaps something triggered by data in a particular print job (which
will never successfully print on that printer).

Examining logs might provide some clues. There are some cups logs in
/var/log/cups (which you can look at using Console).

The person who uses the computer really does need admin access to deal
with this. If you've set things up so they normally use a standard
account, they should also have access to an admin account which only
gets used when required for doing admin tasks. If you really can't trust
this user with access to an admin account, then giving them printer
admin rights (as I described) is the best solution.

> > Similarly, unpausing a printer is an operation that only an admin user
> > should do, because the printer may have been deliberately paused by the
> > admin to prevent anyone using a particular printer due to a temporary
> > problem (for example).
> >
> > Standard user accounts in OS X can delete or pause their own individual
> > print jobs, just not the entire queue.
>
> If he can pause, then how come no resume?

If you (as admin) didn't pause the printer, then the system must have
done it automatically.

> It was his print jobs.

That isn't relevant. The system decided there was a problem with printer
or print queue, so it paused the print queue and expects an
administrator to deal with the problem.

> > Having said that, if the computer and and printers are only used by one
> > person, it is possible to grant printing system admin rights to certain
> > user accounts without giving them full administration of the computer.
> >
> > You can set this up by logging in as an admin user, running Terminal and
> > entering a command in the following form (which is sensitive to case,
> > spacing and punctuation):
> >
> > sudo dscl . -append /Groups/_lpoperator GroupMembership ACCNAME
> >
> > Subsitute ACCNAME with the short name of the user's account, i.e. their
> > home folder name. For example, if their home folder name is "jim"
> > (/Users/jim) then the full command would be:
> >
> > sudo dscl . -append /Groups/_lpoperator GroupMembership jim
> >
> > (The sudo command will prompt you for a password: enter the password of
> > the admin account under which you are logged in.)
> >
> > If you want to remove this special privilege later, this is the
> > corresponding command:
> >
> > sudo dscl . -delete /Groups/_lpoperator GroupMembership ACCNAME
>
> Thanks. Or maybe I should give him full admin access. Hmm.


--
David Empson
dem...@actrix.gen.nz

dorayme

unread,
Feb 17, 2013, 5:17:08 PM2/17/13
to
In article <512113b6$0$52219$c3e8da3$92d0...@news.astraweb.com>,
JF Mezei <jfmezei...@vaxination.ca> wrote:

> I have seen printers get paused due to some problems printing jobs (job
> getting stuck etc).

It happens nearly every time I print anything on my HP bubblejet
Photosmart. This printer is too smart for its own good and mine. For
al sorts of mysterious reasons. For the last year, if it fails to
detect an HP ink cartridge (because there's a generic or alternative),
it sometimes says, sometimes doesn't (but that is what is what is
probably worrying it), it pauses the queue. One has so often to
interfere. I look back with fondness to my 4/600 Apple Personal Laser
I ran on my QS 933.

--
dorayme

Jolly Roger

unread,
Feb 17, 2013, 6:17:46 PM2/17/13
to
In article <FNmdnVY_FpZqHL3M...@earthlink.com>,
ANT...@zimage.com (Ant) wrote:

> Hello again.
>
> Tonight, my client ran into an interesting problem with his HP DeskJet
> F4280 USB printer. It refused to print because it was in paused mode.
> Resuming it failed because it wanted administrator access since he is
> using a standard Mac OS X 10.8.2 account (did not want to give full
> administrator account since he is a type of person to mess up his
> computer).
>
> How does one fix this? IIRC, pausing and resuming should not require
> administrator acccess? :(
>
> Thank you in advance. :)

Didn't you (or someone else) just post this exact same question like
last week?! Sheesh! What's up with that?

--
Send responses to the relevant news group rather than email to me.
E-mail sent to this address may be devoured by my very hungry SPAM
filter. Due to Google's refusal to prevent spammers from posting
messages through their servers, I often ignore posts from Google
Groups. Use a real news client if you want me to see your posts.

JR

Richard Maine

unread,
Feb 17, 2013, 7:25:22 PM2/17/13
to
Jolly Roger <jolly...@pobox.com> wrote:

> In article <FNmdnVY_FpZqHL3M...@earthlink.com>,
> ANT...@zimage.com (Ant) wrote:

> > Tonight, my client ran into an interesting problem with his HP DeskJet
> > F4280 USB printer. It refused to print because it was in paused mode.
> > Resuming it failed because it wanted administrator access since he is
> > using a standard Mac OS X 10.8.2 account (did not want to give full
> > administrator account since he is a type of person to mess up his
> > computer).
> >
> > How does one fix this? IIRC, pausing and resuming should not require
> > administrator acccess? :(
> >
> > Thank you in advance. :)
>
> Didn't you (or someone else) just post this exact same question like
> last week?! Sheesh! What's up with that?

I was wondering the same thing, so I checked. Yes, it was him. But I
can't answer the "what's up with that?" part. Maybe hoping that asking
the same question again will somehow get a different answer? If it were
my 82-year-old mother-in-law, I'd understand completely forgetting about
the same conversation from a few weeks ago; that happens with her fairly
often. But she doesn't try to help other people with their systems.

--
Richard Maine | Good judgment comes from experience;
email: last name at domain . net | experience comes from bad judgment.
domain: summertriangle | -- Mark Twain

JF Mezei

unread,
Feb 17, 2013, 7:54:20 PM2/17/13
to
On 13-02-17 18:17, Jolly Roger wrote:

> Didn't you (or someone else) just post this exact same question like
> last week?! Sheesh! What's up with that?

Obviously a very common problem on OS-X which people started
experiencing a couple weeks ago :-)

Message has been deleted

Ant

unread,
Feb 17, 2013, 10:59:28 PM2/17/13
to
On 2/17/2013 9:30 AM PT, JF Mezei typed:

>> How did it get paused then if no administrator access?
>
> I have seen printers get paused due to some problems printing jobs (job
> getting stuck etc).

OK, that probably what happened. Ugh. Annoying! :(
--
"We're all ants. I'm a glittery little ant." --Alanis Morissette
/\___/\ Ant(Dude) @ http://antfarm.ma.cx (Personal Web Site)
/ /\ /\ \ Ant's Quality Foraged Links: http://aqfl.net
| |o o| |
\ _ / If crediting, then use Ant nickname and AQFL URL/link.
( ) If e-mailing, then axe ANT from its address if needed.
A song is/was playing on this computer: Atomic Kitten - Locomotion

Ant

unread,
Feb 17, 2013, 11:03:44 PM2/17/13
to
>> How did it get paused then if no administrator access?
>
> I've seen print queues pause themselves automatically when there is a
> problem communicating with the printer, or perhaps a bug in the driver,
> or perhaps something triggered by data in a particular print job (which
> will never successfully print on that printer).
>
> Examining logs might provide some clues. There are some cups logs in
> /var/log/cups (which you can look at using Console).
>
> The person who uses the computer really does need admin access to deal
> with this. If you've set things up so they normally use a standard
> account, they should also have access to an admin account which only
> gets used when required for doing admin tasks. If you really can't trust
> this user with access to an admin account, then giving them printer
> admin rights (as I described) is the best solution.

I looked at CUPS' webadmin thing. The only option I saw was to be able
to "Allow users to cancel any job (not just their own". I checked this,
but can't pause and resume.


>>> Similarly, unpausing a printer is an operation that only an admin user
>>> should do, because the printer may have been deliberately paused by the
>>> admin to prevent anyone using a particular printer due to a temporary
>>> problem (for example).
>>>
>>> Standard user accounts in OS X can delete or pause their own individual
>>> print jobs, just not the entire queue.
>>
>> If he can pause, then how come no resume?
>
> If you (as admin) didn't pause the printer, then the system must have
> done it automatically.

That is probably what happened.


>> It was his print jobs.
>
> That isn't relevant. The system decided there was a problem with printer
> or print queue, so it paused the print queue and expects an
> administrator to deal with the problem.
>
>>> Having said that, if the computer and and printers are only used by one
>>> person, it is possible to grant printing system admin rights to certain
>>> user accounts without giving them full administration of the computer.
>>>
>>> You can set this up by logging in as an admin user, running Terminal and
>>> entering a command in the following form (which is sensitive to case,
>>> spacing and punctuation):
>>>
>>> sudo dscl . -append /Groups/_lpoperator GroupMembership ACCNAME
>>>
>>> Subsitute ACCNAME with the short name of the user's account, i.e. their
>>> home folder name. For example, if their home folder name is "jim"
>>> (/Users/jim) then the full command would be:
>>>
>>> sudo dscl . -append /Groups/_lpoperator GroupMembership jim
>>>
>>> (The sudo command will prompt you for a password: enter the password of
>>> the admin account under which you are logged in.)
>>>
>>> If you want to remove this special privilege later, this is the
>>> corresponding command:
>>>
>>> sudo dscl . -delete /Groups/_lpoperator GroupMembership ACCNAME

Is this in CUPS web admin pages that I missed? I prefer to do it with GUI.
--
"An ant is a wise creature for itself, but it is a shrewd thing in an
orchard or garden." --Francis Bacon

David Empson

unread,
Feb 18, 2013, 12:51:18 AM2/18/13
to
Ant <a...@zimage.comANT> wrote:

> >>> Having said that, if the computer and and printers are only used by one
> >>> person, it is possible to grant printing system admin rights to certain
> >>> user accounts without giving them full administration of the computer.
> >>>
> >>> You can set this up by logging in as an admin user, running Terminal and
> >>> entering a command in the following form (which is sensitive to case,
> >>> spacing and punctuation):
> >>>
> >>> sudo dscl . -append /Groups/_lpoperator GroupMembership ACCNAME
> >>>
> >>> Subsitute ACCNAME with the short name of the user's account, i.e. their
> >>> home folder name. For example, if their home folder name is "jim"
> >>> (/Users/jim) then the full command would be:
> >>>
> >>> sudo dscl . -append /Groups/_lpoperator GroupMembership jim
> >>>
> >>> (The sudo command will prompt you for a password: enter the password of
> >>> the admin account under which you are logged in.)
> >>>
> >>> If you want to remove this special privilege later, this is the
> >>> corresponding command:
> >>>
> >>> sudo dscl . -delete /Groups/_lpoperator GroupMembership ACCNAME
>
> Is this in CUPS web admin pages that I missed? I prefer to do it with GUI.

No, it is a user account setting (Directory Services, or Users &
Groups), not a CUPS setting.

You can do it via the UI in System Preferences, if you first enable
System Preferences to display system groups. _That_ requires the command
line or a third party utility.

TinkerTool is a free utility which lets you enable this setting, on a
per-account basis (do it within your admin account).

In TinkerTool, go to the Applications section, and near the bottom is
"Group accounts: Show all user groups in Users & Groups pane of System
Preferences".

Once you turn that on, go into System Preferences, choose Users &
Groups, click the padlock to make changes, enter your admin credentials.

You will see a "Groups" heading in the list on the left side, with a
collapse/expand triangle. Click the triangle to expand the list.

The group you want is "Print Operator". Click on that, then on the right
you can choose individual accounts to include in the Print Operator
group. Only bother marking standard accounts - you don't need to add
individual admin accounts to this group as any account with admin
privileges is automatically in this group (because the "Print
Administrators" group is included in "Print Operators", and the
"Administrators" group is included in "Print Administrators".

I'm not sure offhand if it would be helpful to put your client into the
Print Administrators group (_lpadmin) instead of the Print Operator
group (_lpoperator). The Print Operator group is sufficient to allow
pausing an unpausing the print queue, but I expect it doesn't let them
go as far as adding and deleting printers, or changing settings in CUPS.


Footnote: I should point out that both these sets of instructions apply
to Mountain Lion (10.8.x), and I expect they are the same on Lion
(10.7.x) and Snow Leopard (10.6.x) apart from minor details like the
name of the preference pane ("Accounts"), but I haven't tested them
there or confirmed the other details are the same.

Leopard (10.5.x) probably supports the same method via the command line,
but I don't know offhand if its System Preferences supports showing all
the groups.

This method will definitely not work for Tiger (10.4.x) or earlier,
since Directory Services doesn't exist on those systems (older OS X
verisons use NetInfo to manage users and groups, and System Preferences
doesn't have the group editing feature, as far as I know).

--
David Empson
dem...@actrix.gen.nz
Message has been deleted

Király

unread,
Feb 18, 2013, 9:48:27 AM2/18/13
to
In comp.sys.mac.apps David Empson <dem...@actrix.gen.nz> wrote:
> No, it is a user account setting (Directory Services, or Users &
> Groups), not a CUPS setting.
>
> You can do it via the UI in System Preferences, if you first enable
> System Preferences to display system groups. _That_ requires the command
> line or a third party utility.

Workgroup Manager (free download from Apple) will do the trick too.

--
K.

Lang may your lum reek.

George Kerby

unread,
Feb 18, 2013, 10:12:09 AM2/18/13
to



On 2/18/13 7:51 AM, in article elmop-247F6B.08512018022013@[78.46.70.116],
"Elmo P. Shagnasty" <el...@nastydesigns.com> wrote:

> In article <51217bbd$0$7620$c3e8da3$12bc...@news.astraweb.com>,
> no, it was Ant.
>
> Ant is, to put it mildly, retarded.

And you seem to follow him around in various Groups, pointing that out.

Do you not anything better to do with your time?

Having a vision problem is not "retarded", a-hole. Grow a pair, already!

Jolly Roger

unread,
Feb 18, 2013, 10:27:05 AM2/18/13
to
In article <CD47A0E9.98136%ghost_...@hotmail.com>,
Not very nice. Perhaps the guy is simply forgetful. Happens to me all
the time!
Message has been deleted

George Kerby

unread,
Feb 18, 2013, 1:18:14 PM2/18/13
to



On 2/18/13 9:27 AM, in article
jollyroger-A4F5F...@news.individual.net, "Jolly Roger"
<jolly...@pobox.com> wrote:

> In article <CD47A0E9.98136%ghost_...@hotmail.com>,
> George Kerby <ghost_...@hotmail.com> wrote:
>
>> On 2/18/13 7:51 AM, in article elmop-247F6B.08512018022013@[78.46.70.116],
>> "Elmo P. Shagnasty" <el...@nastydesigns.com> wrote:
>>
>>> In article <51217bbd$0$7620$c3e8da3$12bc...@news.astraweb.com>,
>>> JF Mezei <jfmezei...@vaxination.ca> wrote:
>>>
>>>> On 13-02-17 18:17, Jolly Roger wrote:
>>>>
>>>>> Didn't you (or someone else) just post this exact same question like
>>>>> last week?! Sheesh! What's up with that?
>>>>
>>>> Obviously a very common problem on OS-X which people started
>>>> experiencing a couple weeks ago :-)
>>>
>>> no, it was Ant.
>>>
>>> Ant is, to put it mildly, retarded.
>>
>> And you seem to follow him around in various Groups, pointing that out.
>>
>> Do you not anything better to do with your time?
>>
>> Having a vision problem is not "retarded", a-hole. Grow a pair, already!
>
> Not very nice. Perhaps the guy is simply forgetful. Happens to me all
> the time!

JR, "Mr. Nasty" did the same to Ant over in the video.digital-tv group just
awhile back. He knew that Ant has a vision problem. Maybe I got a little
uptight because I have family with severe vision issues, but it just isn't
right...

Jolly Roger

unread,
Feb 18, 2013, 3:42:03 PM2/18/13
to
In article <CD47CC86.98152%ghost_...@hotmail.com>,
I've forgotten about Ant's vision problem myself, actually. : /
Message has been deleted

Jolly Roger

unread,
Feb 18, 2013, 8:56:38 PM2/18/13
to
In article <michelle-142DA2...@news.eternal-september.org>,
Michelle Steiner <mich...@michelle.org> wrote:

> In article <jollyroger-FB14E...@news.individual.net>,
> Jolly Roger <jolly...@pobox.com> wrote:
>
> > I've forgotten about Ant's vision problem myself, actually. : /
>
> I thought it was someone else who had the vision problem, not Ant.

Maybe it was.
Message has been deleted

JF Mezei

unread,
Feb 19, 2013, 1:05:19 PM2/19/13
to
On 13-02-19 06:24, Elmo P. Shagnasty wrote:

> Nevertheless. his behavior has nothing to do with his having a vision
> problem. He continues to shop for answers he wants despite being told
> the facts over and over again.

First time: Sorry it can't be done

Second time: There is a way if you grant your user certain groups that
have rights to manage printer queues.

So in this second round, it appears an answer was found and given and
even I learned from it.

If you remove the unproductive personal attacks, you do find content.
Message has been deleted

Jolly Roger

unread,
Feb 19, 2013, 3:42:59 PM2/19/13
to
In article <michelle-5F9DBE...@news.eternal-september.org>,
Michelle Steiner <mich...@michelle.org> wrote:

> In article <CD47CC86.98152%ghost_...@hotmail.com>,
> George Kerby <ghost_...@hotmail.com> wrote:
>
> > He knew that Ant has a vision problem.
>
> I thought it was Zulu who has the vision problem. I don't recall Ant ever
> saying that he had one.

Oh yeah, Zulu, that's right!
Message has been deleted

George Kerby

unread,
Feb 19, 2013, 8:08:56 PM2/19/13
to



On 2/19/13 1:27 PM, in article
michelle-5F9DBE...@news.eternal-september.org, "Michelle
Steiner" <mich...@michelle.org> wrote:

> In article <CD47CC86.98152%ghost_...@hotmail.com>,
> George Kerby <ghost_...@hotmail.com> wrote:
>
>> He knew that Ant has a vision problem.
>
> I thought it was Zulu who has the vision problem. I don't recall Ant ever
> saying that he had one.

I am aware about Zulu. However, in another group, Ant mentioned that he had
some condition that involved, among other things, vision difficulty. I may
have to go do a Google Groups search or some other method to bring that up
again. In any event, Mister Nasty made another derogatory remark about Ant.

Message has been deleted

Ant

unread,
Mar 2, 2013, 4:15:29 AM3/2/13
to
It is called "Printer Administrator" under Mac OS X 10.5.8 with
TwinkerTool Classic G2 v4.5. I did not see a "Printer Operator". 10.8.2
has both, but it appears that "Printer Operator" had nothing selected
for accounts like "Printer Administrator" so I did not touch it. Are you
sure "Printer Operator" is needed? I am OK for my client to add/remove
printers with his standard accounts.

Anyways, I briefly tested the pause and resume printer options in the
old standard accounts on both MBP (10.8.2 and 10.5.8), and they seems to
work. We'll see how it goes with real usages.

Thanks again. :)
--
"For every 1 person on earth there are 1 million ants." --Factoid for
the video of Adam Ant's "Goody Two Shoes" Pop Up Video

David Empson

unread,
Mar 2, 2013, 4:56:46 PM3/2/13
to
I don't have a 10.5 system handy to check the details there. If you can
only see a "Print Administrator", then CUPS might have split the
privilege set into two levels between the version used in 10.5 and a
later version, or OS X might have added some additional subdivision of
privileges for managing printers.

In 10.8, "Print Operators" grants some privileges to specified user
accounts. From my earlier experiment, that includes the ability to pause
and resume the print queue.

"Print Administrators" gives all the same privileges as "Print
Operators", because the "Print Administrators" group is a member of the
"Print Operators" group. I expect the "Print Administrators" group also
grants further privleges relating to printing, but I don't know offhand
what they might be.

If you aren't too concerned about it then you might as well add your
client to "Print Administrators", rather than adding them to "Print
Operators".

If you are operating on the principle of least privilege necessary to
perform a task (pausing and unpausing the print queue) then adding them
to Print Operators is the best option.

> Anyways, I briefly tested the pause and resume printer options in the
> old standard accounts on both MBP (10.8.2 and 10.5.8), and they seems to
> work. We'll see how it goes with real usages.
>
> Thanks again. :)


--
David Empson
dem...@actrix.gen.nz

Ant

unread,
Mar 3, 2013, 12:43:03 AM3/3/13
to
On 3/2/2013 1:56 PM PT, David Empson typed:
...
> "Print Administrators" gives all the same privileges as "Print
> Operators", because the "Print Administrators" group is a member of the
> "Print Operators" group. I expect the "Print Administrators" group also
> grants further privleges relating to printing, but I don't know offhand
> what they might be.
>
> If you aren't too concerned about it then you might as well add your
> client to "Print Administrators", rather than adding them to "Print
> Operators".
>
> If you are operating on the principle of least privilege necessary to
> perform a task (pausing and unpausing the print queue) then adding them
> to Print Operators is the best option.

OK. So far, so good... We'll see... :O
--
"For example, the tiny ant, a creature of great industry, drags with its
mouth whatever it can, and adds it to the heap which she is piling up,
not unaware nor careless of the future." --Horace, Satires, Book I, I, 33.
0 new messages