How can I grant users the ability to pause/resume printing without a "print operators group" password.

Question

Greetings,
We are running 10.8.5 on 30 machines in an active directory environment (graphics lab). The clients are experiencing a persistant error when pausing or resuming print jobs. Each time something is paused, it requires an administrator password to resume the job. Administrators are not always present so designers are locked out of all of the printers until we come in (or remote in) to authenticate.
I spoke with Apple today and they said they would not support active directory accounts and that the account must be edited by the department that created the account because the restrictions come from the Active Directory account preferences.
On the other hand, I ALSO read that I can edit this in the CUPS interface or modify it with the terminal command below, locally.
dseditgroup -o edit -u admin_name -p -a user_name -t user _lpadmin
"dseditgroup" adds the user_name to a group (in this case, _lpadmin).
And admin_name is the name of your administrator's account.
a) Must this be modified on the Active directory account or CAN I modify this on the local machine via CUPS or terminal?
b) If so, how would I grant users the ability to resume printing without an admin password?
c) If not, exactly what must be modified in the active Directory account to allow pause/resume without an admin password.
I have seen a terminal command that adds users to the print operatiors group (Ipadmin) and I have seen some info on editing the CUPS interface, If i must edit the CUPS interface to allow this, can anyone point to detailed instructions on how to make this change.
I also saw info on editing the CUPS interface but the suggestion lacked details as to how and how to return to default if it does not work.
I also saw a post with these suggestions below but without detail as to how one would carry this out.
/etc/cups/cupsd.conf
# All administration operations require an administrator to authenticate...
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
*#Require user @SYSTEM*
*Require valid-user*
Order deny,allow
</Limit>
# All printer operations require a printer operator to authenticate...
<Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs>
AuthType Default
*#Require user @AUTHKEY(system.print.operator) @admin @lpadmin*
*Require valid-user*
Order deny,allow
</Limit>
/etc/authorization
+The system.print.operator key is new to Snow Leopard and seems to control resuming and pausing a printer queue among other things.+
<key>system.print.admin</key>
<dict>
<key>allow-root</key>
<true/>
<key>class</key>
<string>user</string>
<key>group</key>
<string>staff</string>
<key>shared</key>
<true/>
</dict>
<key>system.print.operator</key>
<dict>
<key>allow-root</key>
<true/>
<key>class</key>
<string>user</string>
<key>group</key>
<string>staff</string>
<key>shared</key>
<true/>
</dict>
I have read all posts on this subject and I still am not clear on how to proceed, please assist.
Thanks in advance,
V

Answer 1

Hello again.  For AD environments you can run the following command on each workstation:
sudo dseditgroup -o edit -n /Local/Default -u localadmin -p -a "Domain Users" -t group _lpadmin
This command assumes you are typing this interactively on the machine.  Obviously change localadmin to the Mac's local admin's name.  When running you will be prompted for password twice.  Once to elevate permissions (sudo) and once to validate you are localadmin.
If you are using Apple Remote Desktop (or JAMF or other management suite), you can push this command out while embedding the localadmin's password. 
sudo dseditgroup -o edit -n /Local/Default -u localadmin -P yourpass -a "Domain Users" -t group _lpadmin
Please note, if your password uses special characters (/-\) this may fail over ARD.
In Mavericks, AD groups are cached once they are referenced.  If you are dealing with a lot mobile users (laptops) you might want to replace Domain Users with everyone
R-
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store