Printing w/Leopard & AD-based Windows Print Queues:

Question

For those interested, I have written an overview of printing in Leopard 10.5.0 to Windows print servers (published queues Active Directory). Your mileage may vary. This document contains the good the bad and the ugly.
Objective:
Get Leopard based Macs to print to AD published SMB print queues hosted on Windows 2003 print servers. Sounds easy, huh?
Overview:
Print Servers:
Windows 2003 print servers.
Printers:
All the printers in my test were all new HP network b/w printers or network MFP b/w printers. All of them were less than 2 years old. None of them were consumer-grade home USB printers.
Mac Clients:
My test clients were Intel MacBook Pros and Intel iMacs running 10.5.0 Leopard. All of them had user AD accounts and all Macs were bound to AD using Directory Utility (or dsconfigad)
The AD clients have a unique naming convention at my company. In my environment we use the initials of the person for their login name (SAM). Example:
Real “human” Name: “Stephen Paul Jobs”
Long Active Directory Name: “Steve Jobs”
Short Active Directory Name: “spj”
“Legacy” NT Names: “domain\spj”
Full domain name (used for email etc): “[email protected]”
(you get the idea...)
Note: My Mac clients are not in an Open Directory domain. No “Magic Triangle” in this environment. Pure AD for the sake of this example. I am not managing the Mac clients via MCX in this scenario.
Print Protocols:
All the print queues hosted on the print servers were standard SMB/CIFS print queues. The syntax (UNC) looks like this:
smb://print_server.domain/queue
(This syntax is invisible to most users printing to AD-published printers (or any network based printer really) . Most users will have no idea what protocols are being used.)
Procedures:
Part 1: Set up a new printer from an existing AD-published print queue:
From the Apple menu select “System Preferences...” (or launch it from /Applications). The Printer Setup Utility app no longer exists. Apple has discontinued it fro various reasons.
Click on the Printer & Fax pane.
Click the “+” button on the left. This will launch the Apple Printer Browser (called “AddPrinter”, and lives in /System/Library/CoreServices), which looks similar to the previous browser in Tiger. The Printer Browser by default will usually show network printers vai Directory Services (AD/OD etc) as well as Bonjour printers and Mac OS X based shared printers – if they are shared via IPP and LPR under certain circumstances).
Select the desired AD-published print queue you want to print to by highlighting it in the browser list and clicking the “Add” button. (Note: Print queues published via Active Directory will show up as “Open Directory” printers, even though this is not 100% technically correct.)
Before the queue will be added, you will be prompted to authenticate as a local administrator. If you are not an admin you are screwed. Enter your name and password.
Once the print queue is added, it will show up on your Mac in several ways (barring any bugs – see below). Here are the ways to tell if you have added the print queue successfully:
A The new print queue will now be displayed in the Print & Fax system pref pane (but not always – see below).
B You will see a printer proxy application in ~/Library/Printers/ which corresponds to your new print queue. This is the print monitor app that will show up in your Dock when you print to the queue.
C You can see the new print queue via the CUPS admin page at http://localhost:631/printers.
D You can see your new print queue from the Terminal by typing this command: “lpstat –v” (type “man lpstat” for more info on the lpstat and related commands)
E You can also see your printers by launching an print-enabled application such as TextEdit or Safari and printing a page. You will be presented with Leopard’s new print dialog box (which now includes a print preview pane). From the “Printer” drop-down menu you can see all of your printers. You can add a printer from here too (which takes you to the steps listed above)
(of course, most end users will only use option A listed above. The other options are more abstract and complicated)
Now that the AD print queue has been setup on your Mac, you can print to it (maybe).
Part 2: Printing to an AD-published print queue:
Open a document you want to print.
Choose “Page Setup...” from the File menu if you need to configure the job. (Optional)
Choose “Print” from the File menu.
From the Print dialog box, choose the desired print queue from the Printer menu
Click the Print button.
You will need to authenticate with a valid Active Directory username and password. You don’t have to have administrator credentials, but you have to verify that you are a domain member. In my environment, my Windows print server doesn't require authentication, but for some reason Leopard or CUPS makes you authenticate. (See below). Not only is this a major PIA, but the authentication dialog box itself is formatted to include the wrong credentials format for authentication in the first place.
Volia! Done. Easy huh? Not really. Read on for the ugly stuff.
My Complaints and Caveats:
OK, so here’s where I vent, complain and scratch my head. Join in on the fun.
Sometimes shared print queues don’t show up in the Print & Fax system preference pane after they have been added. I have no idea why. The local CUPS admin page (http://localhost:631) on my Mac test clients can see the connected queues, and the queues show up in ~/Library/Printers. The “lpstat –v” command shows the connect queues too. But for some reason, sometimes network print queues that I have previously setup (and use regularly) don’t show up in the Leopard Print & Fax preference pane. Local USB printers always show up fine for me.
2. When challenged to authenticate a print job to a Windows print server (AD), the Mac’s authentication dialog box pre-populates the AD user’s name in the “Name” field incorrectly. Example:
A user named “Joe Is Cool” (short name “JIC”) prints a job to the print server. The print auth dialog box challenges him for a name and password. It is pre-populated already with the name of “Cool, Joe”. When a valid AD password is entered, the job is rejected (it fails authentication and gets put on hold – which is hard to see this unless you explicitly look at the Printer.app proxy tool in the Dock). However, if the user replaces “Cool, Joe” with his official AD short name of “JIC” and then enters his AD password, the print job is accepted and printed. I wish Apple didn’t try and pre-populate the dialog box! Can this be avoided or prevented?
In my environment, my Windows print server doesn't even require authentication, but for some reason Leopard or CUPS makes you authenticate. I’m working with my Windows administrators to figure this out. It will only accept user names with the short name format. It will not accept long (full) names or NT legacy names.
3) The Printer Setup Utility app, which used to live in /Applications/Utilities, no longer exists. Apple has discontinued it for various reasons. Mainly security and simplicity. I wish it was still available, but the system pref pane works fine (well, usually)
4) Active Directory-based print queues will show up in the OS X Printer Browser as “Open Directory” printers, even though this is not 100% technically correct. Why can’t OS X tell the difference between OD queues and AD queues and label them as such?
5) Leopard has locked down the ability to add network printers. You now must be a local administrator in 10.5 or later. I understand the importance of this security measure in certain environments, but why can’t there be an option in the Security preference pane to “Allow non-admins to add printers”? This would make me very happy.
6) Setting the default printer and resetting the CUPS system now require you to right-click in the left side of the Print & Fax pane. There no longer is a button or menu option to do this.
7) Sometimes after a job has printed the printer proxy app (from ~/Library/Printers) stays in the Dock and won’t go away.
Conclusion
Please chime in on your experiences, bugs, opinions and comments.
Message was edited by: Daniel Stranathan

Answer 1

I have noticed several of the changes in our system when printing to an AD printer from a Leopard client. I have one issue that is pretty odd and I'm not sure what is going on. When printing an Excel worksheet, I get prompted for AD credentials. After submitting the job, the print queue says "Waiting for Authentication", I have to press the Resume button and then the authentication dialog pops up. I successfully authenticate (My auth dialog is populated correctly and the remember to keychain option is selected) and the job prints fine. If I print the same document again (without closing the worksheet or Excel), or any other worksheet, I still have to reauth. I can print just fine to the same printer from Textwriter and I do not need to authenticate. Weird...