Tag: Apple

Categories
MacAdmin

SMB Printing on macOS Without Active Directory Binding


The tale of two hostnames

In May 2024, I was assisting a school with setting up a new macOS deployment workflow.

They were previously an all-Windows school and were looking to pilot macOS devices.

Everything went smoothly except for one key issue:

The Mac couldn’t print.

More specifically, the Mac couldn’t print to their SMB printer queues shared/managed by Papercut.

Whilst the official recommendation from Papercut when experiencing SMB issues post PrintNightmare is to use LPD or Mobility Print (IPP/HTTP), sometimes you have to deal with the cards that are dealt 🙂 

https://papercut.com/support/known-issues/?id=PO-522#ng

As described above, the symptom I saw was:

…when printing macOS > Windows over SMB… can result in printers going into a Waiting state indefinitely. You might initially see them go into a Hold for Authentication state - if you click refresh and supply valid credentials, you will end up in the Waiting state.

One of the suggestions in the above thread was to add ?encryption=no to the print queue, which on its own didn’t make any difference.

The baffling part of the issue was that printing WORKED in my initial testing but stopped when I was minting the workflow ready to handover to them.

So what had changed?

I had added a computer naming step to the workflow.

The script used to name the device resembled this:

ScriptRepo/ComputerName-Set-Serial.sh at master · aarondavidpolley/ScriptRepo · GitHub

Changing the computer name in System Settings/Preferences didn’t fix the issue.

Resetting the device, not using the script to name the computer: WORKED!

So why did setting the computer name break it?

If you pay close attention to the script above, macOS has three names:

  • ComputerName
  • HostName
  • LocalHostName

When you use the built-in directory binding plugin (via script or directory utility), the HostName is important to be set before binding as it forms part of the information used in the domain join.

The HostName can be different to the visible name of the computer in Terminal, System Settings, etc., which is why admins have been using scutil for a while to set all three in scripts.

The Jamf binary on a Jamf Pro managed Mac uses the same approach of setting all three names when you use it to set the computer name.

In a world that is ever increasingly free of AD-Bound Macs (to which we rejoice), setting all three computer names is less important and evidently troublesome when trying to print to SMB queues hosted on Windows Server.

Looking at logs, network traffic, and digging around the web, there is evidence that deep in macOS is code that looks for the HostName being set as evidence of an AD-Bound device.

As a result of this confused state of identity, it starts sending RPC signals that AD/Windows Server doesn’t know what to deal with, causing the communication to fail.

Computer: “Hey, I’m this AD-Bound device MAC123, can I print?”

Server: “MAC123 not found in my directory. Go away.”

End of print job attempt.

At the time of this discovery, naming the computer was not an important success criterion.

We skipped naming the device, configured the printer queue install (using a script similar to the one below), that included the ?encryption=no in the queue URI, tested successfully, and off we rode into the sunset.

ScriptRepo/Printers-CUPS-Add-Printer.sh at master · aarondavidpolley/ScriptRepo · GitHub

So why bring this up in September 2025?

I recently visited that same school and helped them revise their macOS deployment workflow. They wanted to expand the pilot to a new set of users and add in any latest tooling/config changes that were appropriate.

Printing came up again.

The papercut environment was largely unchanged, but the queues had stopped working.

After troubleshooting and dusting off old notes (and brain cells), I was able to conclude:

  1. macOS 15.6+ has the same issues as previous versions (including macOS 14, where I had encountered the year prior).
  2. Jamf Setup Manager, which I was now using to set the computer name and therefore using Jamf Pro’s Jamf Binary, was setting all three computer names, repeating the hostname/RPC issue.
  3. Using a script to run scutil --set HostName “” and then rebooting the machine will fix the RPC authentication issue.
  4. The ?encryption=no string now causes the print job to fail and needs to be removed from the printer queue path.
  5. Using a script to only set the LocalHostName and ComputerName via scutil works fine (and is effectively the same as setting the computer name in System Settings).

So in summary:

Symptom: If you can’t print to an SMB printer queue hosted on a Windows Server and it gets stuck waiting or on hold for authentication (even though you’ve provided user auth credentials or have Kerberos tickets).

Check: run scutil --get HostName and see if you get a result.

Fix: if the HostName has been set, run scutil --set HostName “” and then reboot the Mac to fix the RPC authentication issue. 

Hope you find this and it assists your obscure printing issue 😆

Categories
MacAdmin

VPP Redemption Codes & Apple School Manager

Another interesting discussion today on the MacAdmin’s slack revealed a workflow gap created for some schools when Apple deprecated Volume Purchasing (VPP) Redemption Codes.

Essentially, a really horrible process could be used to buy a bunch of licenses for an app, in the form of codes, and give them to end users to redeem.

It was superseded some time ago by Managed Distribution, championed by MDMs, to initially assign licenses to devices, “activated” against their Apple ID. This was later improved again by assigning directing to a device (no Apple ID required).

This evolution saw the decline of ye old redemption codes to the point that Apple chose to sunset it (for EDU only??) and focus on managed distribution. This has left a gap in workflow for some schools.

Some schools were using codes as a lightweight touch to tackle the ever popular adoption of bring your own device (BYOD), gifting apps to students to use on their personal devices (assume wrapping up in school fees). No need to enrol a BYO device into MDM.

With that option now gone, solidified by Apple forcing migration for the legacy volume purchasing portal to Apple School Manager in December 2019, schools are trying to figure out how to replace this workflow. Mass purchase of iTunes cards is being floated.

One option, which does involve MDM, is the new user enrolment MDM channel. I won’t go into detail here, but effectively iOS 13 and macOS 10.15 devices can enrol into your MDM using a managed Apple ID (from ASM) and get a quarantined slice of your device storage to install organisation content (if your MDM supports it). The MDM can’t even see your device serial number… making its new set of limitations a much more comfortable pill to swallow than “letting you install an app gives you access to erase my entire personal device” level of control.

The other option (which will be the most attractive to the redemption code loving crowd) is Apple Configurator 2.

This article points out a nice solution for “If you want to use managed distribution, but don’t have an MDM solution”:

https://support.apple.com/en-au/HT202995

Given you only need initial access to the device and then can revoke later as needed, this might be a nice solution.

To Add: https://support.apple.com/en-gb/guide/apple-configurator-2/cadbf9c811/mac

To Revoke: https://support.apple.com/en-gb/guide/apple-configurator-2/cadeaa4649f2/mac

Let’s see if this approach gets any traction with the BYOD wrangling EDU community.

Categories
MacAdmin

JNUC 2016

Hi All,

As you may have seen I recently altered my web site to be more in line with my real day to day life, not just the music side; I am now “Musician & MacAdmin”. You can see my latest MacAdmin posts on the front page as well as my Music related items and news.

I just got back from JAMF Nation User Conference (JNUC) 2016 in Minnesota and I loved it. It was a great atmosphere for learning  and collaborating with our MacAdmin minds. My employer Max Computing sent me for which I am grateful.

Over the coming days I will try to post a summary of different sessions/events I enjoyed, but here is a top level summary

  1. The opening session(s) featuring CEO Dean Hager – he is an inspiring man and charismatic to say the least. The work he is personally doing in the social justic realm as well as help the JMAF Foundation do is remarkable and not common in corporations
  2. The renaming of the company from JAMF Software to “JAMF” to support product rebranding of Casper Suite and Bushel to JAMF Pro and JAMF Now respectively
  3. JAMF Patch Management – seeing the direction they were going and how it stacked against solutions like Munki
  4. Shopify’s Managing Devices in an Open Culture: great look at how their IT staff took a bunch of tech heads used to being the master of their own machine and convinced them that Mac Management was a good thing for them and the company
  5. The Mac@IBM presentations: truly an inspiring moment to see how they have become an Mac deployment in enterprise flagship
  6. Making Self Service a killer app from Paul Cowan of Waikato University in New Zealand
  7. User configuration framework: a great new tool developed for configuring apps and services at user login AND utilising sign on password for an SSO (single sign on) experience. https://github.com/alex030/UserConfigAgent
  8. Using SWIFT and the JSS API: great session as an early introduction to coding in SWIFT as well as how to do some basic functions for importing machine placeholders into the JSS (JAMF Software Server aka Casper aka JAMF Pro) for automating device enrolment
  9. Profiles: An IT Admins Best Friend; from the boys at dataJAR in the U.K. Hilarious and insightful it gave a great backbone understanding on managed preferences and how they have evolved plus some best practice

Overall it it was a great conference and I hope to share more soon. In the meantime you can check out the discussion links for each session and see if the slides have been posted:

https://www.jamf.com/jamf-nation/events/jnuc/2016/sessions