How to install Network Printer as IP Based Local Printer
With the new print vulnerabilities, I am considering moving all the printers back to local printers and manage them via Kace. Has anyone done this before and have some suggestions on doing this?
Answers (3)
It looks for devices on the network that you can add to the network printer. You'd be able to add printers from a print server as well. Local printer is a more manual solution that allows you to create network printers. To me, the difference is whether you add the printer manually or automatically check airprinter laser printer reviews. The drivers section is the same in all circumstances (if you have a driver, it will install it or remove it from the device). If you don't have a computer, you can browse the list or browse from your computer).
While doable, this would NOT be fun to manage.
I understand your concern over the vulnerability but this does seem like a bit over a knee jerk reaction, especially if you have Least Privalage Access and network segregation configured in your environment.
Do you have a primary printer manufacturer in your environment? E.G. is everything HP?
At the very least you would want to map the printers by their fully qualified DNS name (Based off serial number) opposed to IP, mapping by IP will generate a lot of nuisance for you if the IP has to be changed for some reason or you replace it with a different system, reuse the IP and some machine still has the old entry there.
Yeah fun is not something I would describe this as. Necessary is probably more accurate. Thank you for the DNS suggestion.
We are also Scripting this via gpo with the replace option so that if we do need to make a change it will replicate out.
Comments:
-
The print nightmare stuff has blown over, but managing printers in this fashion is going to cause you long term headaches, One good example is the recently disclosed print driver vulnerability. This would be 100X easier to remediate if you were centrally managing drivers via a print server opposed to trying to manage driver updates independently on X number of systems and likely play whack a mole with configurations that were unique to a given machine as the settings aren't being handled print server side.
https://www.cisecurity.org/advisory/a-vulnerability-in-hp-xerox-and-samsung-printer-drivers-could-allow-attackers-to-gain-administrator-rights-on-a-system/
From a security standpoint, you also open yourself up more if you are providing workstations with direct port access to printers opposed to having that traffic piped through a print server. As the printers have more exposure it would then be "ideal" to regularly monitor and upgrade their firmware when there is a vulnerability (another unpleasant task) - Kiyolaka 2 years ago