Non-admin Printer Setup?

Question

At my work, none of the 350 users are admins. Before we can deploy Mac OS X 10.5.x, we have to allow them to add/delete their own printer. With Mac OS X 10.4.x, the Printer Setup Utility did not require an administrator name and password, so all was fine. But, I can't have 350 users submitting requests to me to add or delete printers for them 12 hours a day (there would have to me more than two more of me) from five time zones. Since there are remote users in 15 states and a total of 70 different offices, there's no way I can add all the printers someone might use ahead of time. How can I change Mac OS X 10.5.x to allow non-admin users to add printers?
-Doug

Answer 1

Follow up to my previous post.
After some further thought, there are permutations to the procedure I set out before. If you want to open it up for all users to add and administer printers, you can comment out the applicable Policy sections of cupsd.conf. Specifically, the following blocks commented out will allow a Standard user (or any user) to add and administer printers. This can be done through the web interface, command line 'lpadmin', or through *Add Printer* from a print window. With this configuration, no password will be required.
EDIT: No Parental Controls need be set with this method. The user could be Standard or Managed.
<pre style="overflow: auto;font-size:small; font-family: Monaco, 'Courier New', Courier, monospace; color: #222; background: #ddd; padding: .3em .8em .3em .8em; font-size: 9px;"># <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
# AuthType Default
# Require user @SYSTEM
# Order deny,allow
# </Limit>
# <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept-Jobs CUPS-Reject-Jobs>
# AuthType Default
# Require user @AUTHKEY(system.print.admin) @admin @lpadmin
# Order deny,allow
# </Limit></pre>
Obviously, there are policy and security implications with the above. You will have to decide if the new policies are within your overall security limits.
Note that I have left in place the earlier directive to allow only admin (sudoers) to change the cupsd.conf file.
<pre style="overflow: auto;font-size:small; font-family: Monaco, 'Courier New', Courier, monospace; color: #222; background: #ddd; padding: .3em .8em .3em .8em; font-size: 9px;"><Location /admin/conf>
AuthType Default
Require user @SYSTEM
# Restrict access to the configuration files...
Order allow,deny
Allow localhost
</Location></pre>
Matt
Message was edited by: Matt Broughton