Help, there’s a Mac on my network (11): the department printer

Episode 11 of the series Help, there’s a Mac on my network.

What happened

Since Monday, Karin has a Mac too. Marieke decided that reception is “the company’s business card”, and a business card should look the part. Karin was fine with it, as long as she could print. She couldn’t.

At ten past nine she was at Ruud’s desk. “The quote for the Jansen family has to go out today. I hit print, it says it worked, and then nothing happens.”

Ruud followed her to the big multifunction printer in the hallway. That machine is the real boss at Bolderman. It prints, copies, scans, staples and folds, and it won’t hand over a single page until you tap your badge or type your PIN. Every print job goes through PRINT01, the print server living in the server cupboard, between the NAS and the mop.

“On Windows this just works,” said Ruud. “You double-click \\PRINT01, pick Hallway-MFP, done. The driver comes along by itself.” He looked at Karin’s Mac. There was no \\PRINT01 to double-click.

He did find the printer on the Mac eventually, through Bonjour, straight on the device’s IP address. Karin printed. Nothing came out. The MFP only accepts jobs that arrive through the print server, with a username and a PIN attached. An anonymous job from an unknown Mac simply vanishes.

By eleven Ruud had found the manufacturer’s driver. The one on PRINT01. From 2014. “For Windows 7 and later,” it said, which sounded very optimistic back in 2014.

Sam wandered by with a cup of tea. “Mind if I have a go?”

What’s really going on

A Windows print server does three jobs at once. It hands out drivers, it decides who’s allowed to print (based on your domain account), and it manages the queue. Windows clients get all of that for free through Point and Print. A Mac gets none of it. You have to tell it which queue, which driver and which account.

The Mac prints through CUPS, the same printing system you’ll find on Linux. CUPS can reach that MFP in three ways:

• Through the Windows print server (SMB). The Mac sends the job to smb://PRINT01/Hallway-MFP. PRINT01 sees a user and can pass the job to the secure print system. But the Mac needs its own driver that knows the MFP’s options, like staples, tray 3 and above all that PIN. A Windows driver from 2014 does nothing for a Mac. Authentication uses your domain account, and if the Mac holds a Kerberos ticket (through Platform SSO or the Kerberos SSO extension) Karin won’t have to keep typing her password.
• Straight to the device over IPP or AirPrint. Almost every MFP from the last ten years speaks IPP and supports AirPrint. No driver needed, the Mac asks the device what it can do. Works fine, except it bypasses the print server, so no username and no secure print. Exactly what went wrong for Karin.
• Through a cloud or follow-me solution. Microsoft Universal Print, or a print management product such as PaperCut. The job lands in a queue that only releases when you tap your badge at the device.

And then there’s the clock. Apple has announced that Rosetta 2 largely goes away after macOS 27 Golden Gate. From macOS 28, expected in autumn 2027, Intel-only software stops running. Printer drivers and scanning utilities are exactly the category that tends to still depend on it. An old Intel driver that just about works today isn’t a fix, it’s a postponement.

How to fix it

1. Pick a route

If you want to keep secure print with badge or PIN (and Karin does, because the payslips go through that printer too), the job has to pass through something that knows who’s printing. That’s the print server, Universal Print or your follow-me product. Plain AirPrint is fine for the small printer in the workshop, not for the hallway.

2. Printing through PRINT01 (SMB)

1. Download the current macOS driver from the MFP manufacturer. Check that it runs natively on Apple silicon (the release notes will say “Universal” or “Apple silicon”). The driver usually comes as a PKG.
2. Open System Settings, Printers & Scanners, click Add Printer. Right-click the toolbar, choose Customize Toolbar and drag in the Advanced button.
3. Under Advanced, set the type to “Windows printer via spoolss” and enter smb://PRINT01/Hallway-MFP as the URL. Under Use, pick the manufacturer’s driver, not “Generic PostScript Printer”.
4. In the printer options (often under Options & Supplies or in the print dialog) switch on secure print with user ID and PIN.

3. Universal Print on the Mac

If your organisation already uses Universal Print, there’s an official Universal Print app in the Mac App Store. According to Microsoft Learn you need macOS Sonoma 14.6.1 or later and a licence that includes Universal Print (many Microsoft 365 plans do). The user signs in with Entra ID and picks the printers themselves. You can deploy the app through Intune, but Microsoft can’t yet push printers to the Mac automatically. Also note that not every printer is “fully supported” on macOS. Microsoft keeps a list, and printers registered through the newer connector work best.

4. Follow-me and secure print

Products like PaperCut, and the solutions MFP vendors ship themselves, nearly all have a Mac client or a dedicated IPP queue for Macs. The idea is the same everywhere: the Mac prints to one virtual queue, the server knows who you are, and the device only releases your job when you tap your badge. Ask your vendor explicitly about the Mac client and whether it runs natively on Apple silicon.

5. Deploying through Intune

• Driver: add the manufacturer’s PKG to Intune as a macOS app (LOB or unmanaged PKG).
• Printer: for AirPrint printers, the Intune Device features profile has an AirPrint section (IP address and path, usually ipp/print). For an SMB queue with a specific driver, use a shell script with lpadmin through Intune Scripts.
• Universal Print: deploy the app from the App Store through Apple Business and Intune.

6. And scanning?

Let the MFP do the work. Scan to email or to a shared folder on the file server, and it no longer matters whether the recipient has a Mac or a PC. The Mac opens that folder through smb:// like any other share. If you scan to email through Microsoft 365, check how the MFP sends: Microsoft is phasing out legacy basic authentication for SMTP, and that’s a classic silent scanning failure. You’ll rarely need a separate scanning app on the Mac, which is one less Intel driver to worry about.

Sam had it working by half past eleven. He didn’t even need the 2014 driver, just the new one from the website, which supports Apple silicon. Karin tapped her badge and the quote rolled out. “How did you get that so fast?” asked Ruud. “My student house had one of these,” said Sam. “With a PIN. Everyone printed their thesis on it.”

Ruud’s lesson

A print server is a lot like reception: everyone walks past it, nobody thinks about it, until someone comes in who doesn’t know the way. The Mac isn’t a difficult guest, it just wants to hear which door, which driver and which badge. Sort that out once in Intune, and throw away that 2014 driver while you’re at it. It’s spent long enough in the server cupboard next to the mop.

Further reading: Printers and scanners on the Mac, The end of Rosetta and Apple Business, Entra ID and Intune.

This is episode 11 of Help, there’s a Mac on my network. Need help with Macs in your organisation? Email frank@analystict.nl.