Available in PaperCut NG and PaperCut MF.

Grant access to shared accounts

By default all printing is automatically charged to a user's personal account. However, for a user to be able to select a shared accountA shared account is an account that is shared by multiple users. For example, in business, shared accounts can be used to track printing costs by business unit, project, or client. Organizations like legal firms, engineering firms, or accounting offices often have long lists of accounts, projects, clients, or matters. In a school or university, shared accounts can be used to track printing by departments, classes, or subjects. to charge to, you must:

  • enable them with the relevant Account Selection options (See Account selection), and

  • grant them access to the required shared accounts.

You can control shared accounts access using two methods:

  • PINs (also known as security codes or passwords)

  • Network group membership

Account security using PIN/codes

If an account is allocated a PIN (an alpha-numeric access code) users with knowledge of the PIN can select the account. A PIN based system would be a sensible selection in an organization when PINs are already in use for other systems such as photocopiers or door access codes.

TIP

PINs/codes can also be used when using parent and sub-accounts. To select a specific sub-account from the client software, both the parent and sub-account pins are required. Enter them in the format of: [parentPIN]-[subPIN] (i.e. they are separated by a hypen).

PIN/codes provide a convenient way to select shared accounts. However, this convenience can compromise security when short or guessable PINs are used. For this reason PaperCut NG/MF allows the user/group security to be also applied to PIN/code access. This allows sites to use convenient and short codes with confidence that only authorized users are granted access.

To enforce user/group security for PIN/code access:

  1. Click the Options tab. The General page is displayed.

  2. In the Account Options area, change When using a PIN/code to select an account, users can charge to to only those accounts they have access to.

  3. Click Apply.

With this setting changed, users can select only an account using the PIN/code when they:

  • know the PIN/code; and

  • are in the shared account's user/group security

Account security using network group membership

An alternate method is to delegate access to the shared account via network group membership. One advantage of group based control is that users do not have to remember PINs. Most medium to large organizations already have their network structured into suitable groups representing their position, title, department or work area. Use these existing groups to control access. Access to shared accounts can also be granted on an individual user basis, however, best practice suggests group-based management for medium to large networks.

TIP

In a Windows Active Directory environment, Organization Units are treated as special groups. This means you can also use them to control access to a shared account. Controlling access to shared accounts via group membership rather than individual user accounts is recommended. By using group based control, new users created on the network inherit the correct account access by virtue of their network group membership. This alleviates the need for additional user modification inside PaperCut NG/MF.

To grant access to a shared account for all members in a given network group:

  1. Click the Accounts tab.

    The Shared Account List page is displayed.

  2. Select an account.

    The Account Details page is displayed.

  3. Click Security.

  4. Select the appropriate group from the list.

  5. Click Add.

TIP

To simultaneously change security settings of multiple shared accounts, click the Bulk account actions link on the Accounts tab. For more information, see Bulk user operations.