personal printing (english) - cortado

ThinPrint GmbHAlt-Moabit 91 a10559 BerlinGermany/Alemania

Cortado, Inc.7600 Grandview AvenueSuite 200Denver, Colorado 80002USA/EEUU

Cortado Pty. Ltd.Level 12, Plaza Building, Australia Square95 Pitt StreetNSW 2000 SydneyAustralia

E-Mail: [email protected]: www.thinprint.com

Issued: April 10, 2018 (v221)

Personal Printing

Secure printing (version 4.0)

Manual

mailto:[email protected]

http://www.thinprint.com/

Notes

2 Manual

© CopyrightThis document is the intellectual property of ThinPrint GmbH. This document may be copied in whole or in part, provided this Copyright notice is included in every copy.

® Registered trade marks All hardware and software names mentioned in this document are the registered trademarks of their respective companies or should be regarded as such.

Safety warningPlease note the safety warnings in the technical documentation from your hardware vendor and from the manufacturer of each device and component. Before beginning installation, we recommend closing all windows and applications and deactivating any virus scanner.

© ThinPrint G

mbH

2018

Contents

Manual 3

© T

hinP

rint

Gm

bH 2

01

8

What is Personal Printing? ............................................................................................... 6

Overview of the benefits .................................................................................................. 6

How does Personal Printing work? .................................................................................... 8

What’s needed for installation? ...................................................................................... 10

Technical requirements ................................................................................................. 10

Personal Printing server ............................................................................................ 10Authentication ......................................................................................................... 11

Installation on the server ............................................................................................... 12

User account for installation ...................................................................................... 12Installing Personal Printing ....................................................................................... 12

Authentication methods • Overview ................................................................................ 18

Configuring Personal Printing server ................................................................................ 19

Print Job Storage ..................................................................................................... 20

Setting up target printers ............................................................................................... 22

Local printers .......................................................................................................... 22Network printers ...................................................................................................... 23

ADAM Service Account ................................................................................................. 25

Default user PIN and authentication methods .................................................................. 26

Default user PIN ...................................................................................................... 26Authentication methods ............................................................................................ 27

Setting up users ........................................................................................................... 28

Self-registration by users ........................................................................................... 28Manual setup by the admin ...................................................................................... 28

Release Station • Overview ........................................................................................... 29

Technical requirements ............................................................................................ 29Configuring server and users ..................................................................................... 29Default password ..................................................................................................... 29Intended use ........................................................................................................... 30Safety information .................................................................................................... 30CE and FCC conformities .......................................................................................... 31

Setting up the Release Station ....................................................................................... 31

Finding the device in the network ................................................................................... 32

Web console ................................................................................................................ 32

Open the web console .............................................................................................. 32

Preparing the Release Station and registering users .......................................................... 34

User registration at the Release Station ...................................................................... 35

Contents

4 Manual

© ThinPrint G

mbH

2018

Printing ....................................................................................................................... 35

Importing certificates .................................................................................................... 36

Self-registration ............................................................................................................ 39

JobViewer: Print job overview ........................................................................................ 41

Configuring smartphone users ........................................................................................ 44

Preparing Personal Printing server ............................................................................. 44Preparing printers for smartphone authentication ......................................................... 45Installing apps on smartphones ................................................................................. 47

iOS app ....................................................................................................................... 47

Android app ................................................................................................................. 48

Printing with smartphone authentication ......................................................................... 49

Printing with iOS devices .......................................................................................... 51Printing with Android devices .................................................................................... 53

Authentication with printers • Overview .......................................................................... 55

Configuring server and users ..................................................................................... 55

Configuring Lexmark printers ......................................................................................... 55

Authenticating on the Lexmark printer ........................................................................ 58

Configuring Samsung printers ........................................................................................ 60

Configuration .......................................................................................................... 62Authenticating on the Samsung printer ....................................................................... 63Logging .................................................................................................................. 67

Configuring Konica Minolta printers ................................................................................ 68

Installing the Windows service .................................................................................. 69Preparing the Konica Minolta printer .......................................................................... 70Configuring the Windows service ............................................................................... 74Authenticating on the Konica Minolta printer ............................................................... 80

Licensing ..................................................................................................................... 82

Adding Personal Printers ............................................................................................... 82

Personal Printer for Windows machines ...................................................................... 82Setting up Personal Printers for Mac and Linux machines ............................................. 82Creating additional printer ports ................................................................................ 85

Font management ........................................................................................................ 86

Changing the language of the print dialogue .................................................................... 86

Storing encrypted print jobs ........................................................................................... 87

Certificates .............................................................................................................. 89

Encrypting user data during transmission ........................................................................ 90

Contents

Manual 5

© T

hinP

rint

Gm

bH 2

01

8

Creating a web server certificate for the Personal Printing server .................................... 90Assigning the web server certificate to the Personal Printing server ................................ 94Creating a web server certificate for the Release Station ............................................... 97Assigning the web server certificate to the Release Station .......................................... 105Installing the root certificate and setting up the server URL on the client side ................ 106

Editing instructions for self-registration .......................................................................... 106

Setting up users manually ........................................................................................... 108

Personal Printing, ThinPrint Engine and Tracking ........................................................... 111

Print job tracking ........................................................................................................ 112

How it works ......................................................................................................... 112Tracking Service .................................................................................................... 113Tracking Report Engine .......................................................................................... 113Technical requirements .......................................................................................... 114Installation of Tracking Database ............................................................................. 115Selecting authentication mode ................................................................................. 116Manage Tracking database ..................................................................................... 118Installing the Tracking Report Engine ....................................................................... 121Analyzing tracking data .......................................................................................... 122SQL database ........................................................................................................ 130

Troubleshooting ......................................................................................................... 133

Logging ................................................................................................................ 133Solving issues ....................................................................................................... 136

Unattended installation ............................................................................................... 139

Updating Personal Printing .......................................................................................... 139

Uninstalling Personal Printing ...................................................................................... 140

Acronyms and abbreviations ........................................................................................ 141

6 Manual Introduction.fm

What is Personal Printing?©

ThinPrint Gm

bH 2

018

What is Personal Printing?The safe handling of print output is particularly important for certain branches or for individual departments, for example, in finance and legal or in accounting. However, allocating a separate printer to every employee is not a practical solution for protect-ing documents from unwanted exposure. As an alternative, Personal Printing offers a simple solution to this problem. Personal Printing ensures that printing within the business remains private. It's a solution that offers secure, environmentally friendly and, at the same time, flexible printing.

All sensitive documents remain protected because printing only occurs after indi-vidual authentication, directly at the printer. This authentication can be achieved using an already existing identification card or a smartphone, as well as with PIN entry.

Personal Printing can be used with any printer model in your business and so offers real flexibility. Because the user can always print to the device that is currently avail-able, long waiting times in the print queue are a thing of the past.

Print jobs that turn out to be not required can be deleted from the print server, manually at any time by the user, or automatically after a set time has elapsed. So toner and paper consumption in the business can be reduced and printing costs saved, in an environmentally friendly way.

The solution suits any printing environment, regardless of the hardware manufac-turer. It can be optionally expanded, with functions such as print data compression, bandwidth control of print data transmission or a tracking function.

Personal Printing can be purchased as a product on its own, or integrated as part of Cortado Server.

Overview of the benefitsSecurity More secure printing of confidential information on network printers in public areas.

Before printing, employees must identify themselves at the printers.Since print jobs are always picked up personally, they can’t end up in unauthorized

hands, or be forgotten in the paper tray.

Self-registration Users with an AD account can either be enabled for Personal Printing by the admin-istrator or register themselves:

Save on printing costs

Only those documents that are really needed and which are picked up are printed. No printouts remain lying around in common areas.

Optimal printer efficiency

Users first send their print job from the application and then simply select a printer that is currently free. This eliminates jams in the printer queue and prevents error messages when the printer is turned off or busy.

Introduction.fm Manual 7

Overview of the benefits©

Thi

nPrin

t G

mbH

201

8

Fewer drivers On Windows computers, just one single printer object is sufficient: the Personal Printer. The original drivers are bundled on the Personal Printing server or another print server.

All printers are supported

The solution is independent from the print device. That means that all types of print-ers are supported. You can use Personal Printing with any network printer, e.g., by using the Personal Printing Release Station or printers with embedded Personal Printing Client.

Illus. Personal Printing: example with chip-card authentication

Tracking This gives you an overview of how much has been printed on which printer and with which settings.

JobViewer Each user can use the JobViewer to display their print jobs from any workstation. The document list can be shown using a web browser and individual print jobs can be sorted differently or deleted.

8 Manual Introduction.fm

How does Personal Printing work?©

ThinPrint Gm

bH 2

018

Illus. JobViewer: list of stored print jobs

How does Personal Printing work?

Workstations, terminal servers, virtual desktops

To print from a Windows computer (a workstation, terminal server or virtual desktop) one always selects the same printer object, namely the Personal Printer shared on the Personal Printing server. This is a virtual printer. It allows the creation of device-independent print data which can be used with all printers and independent from the manufacturer – alternatively to universal drivers. But these can also be used, for example for printing from Mac or Linux computers.

Personal Printing server

Firstly, print jobs of the Personal Printer are cached on a user-specified directory on the Personal Printing server and – after authentication by the user – will be printed using the original (native) driver.

At the printer For this purpose, the user goes directly to the network printer and identifies himself. This can be done with the Release Station, with a Personal Printing Client installed on the printer or with a smartphone, and optionally with PIN entry. There all print jobs of this user will be printed or those which have been selected before.

Introduction.fm Manual 9

How does Personal Printing work?©

Thi

nPrin

t G

mbH

201

8

Illus. Personal Printing scenario

10 Manual Installing Personal Printing.fm

What’s needed for installation?©

ThinPrint Gm

bH 2

018

What’s needed for installation?

• The installation program Setup.exe to be installed on the Personal Printing server

• Personal Printing Release Station including NFC cards and card readers• alternatively, the Personal Printing app for iOS1 or Android OS• alternatively, network printers with Personal Printing Client including

NFC cards and card readers

The software contains demo license keys to test the software for 30 days (full func-tionality). Afterwards, enter valid license keys.

For Personal Printing you need the following license keys, which need to be installed on the Personal Printing server:

Technical requirementsPersonal Printing server

Supported operating systems for Personal Printing:

• Microsoft Windows Server 2016• Microsoft Windows Server 2012 R2• Microsoft Windows Server 2012

Note! The server in question must have an up-to-date status of Windows updates.

If there is also a print server with ThinPrint Engine installed it is recommended to install Personal Printing on this print server (see Personal Printing, ThinPrint Engine and Tracking). However, an installation on terminal servers (Remote Desktop Session Hosts), Failover Clusters, domain controllers or Microsoft Windows Server Core is not supported.

1 iPhone, iPad or iPod Touch

License keys For what?

PPPS-xxxx-1PPUS-xxxx-5

Basic license for Personal PrintingUser licenses

Alternative: PLUS-xxxx Personal Printing license in Annual License Model

Installing Personal Printing.fm Manual 11

Technical requirements©

Thi

nPrin

t G

mbH

201

8

Caution! Do not use Personal Printing 4.0 for an update of a Personal Print-ing version included in:

ThinPrint Mobile Print orCortado Server.

Authentication

For authentication you can work with a NFC card or a smartphone (iOS or Android OS). Following you will find authentication examples.

Release Station In the simplest case, equip each printer with a Personal Printing Release Station.

Authentication with smartphone

Authentication with a smartphone (iOS or Android OS) requires no additional hard-ware at the printer. You can generate a barcode with a QR code2 generator (available as freeware on the Internet, e.g. on heise.de or on chip.de), then print it out and attach it to the printer. Alternatively you can configure an NFC tag and attach it to the printer.

The smartphones are configured using a configuration file delivered as an e-mail attachment. For this purpose a mail server is necessary.

Supported smartphones:• iOS devices with firmware 5.0 or later (QR code authentication only)• Android 2.2 or later for QR code authentication• Android 2.3.3 or later for NFC tag authentication

The smartphones must allow access to the camera.

Printers with Personal Printing Client

Some network printers3 (as Lexmark, Samsung or Konica Minolta4) are available with an Personal Printing Client. Thus, an authentication directly at the printer is pos-sible and a Release Station is not required.

2 QR code (quick response): two-dimensional barcode (2D code)

3 The list of ThinPrint certified devices can be found here: www.thinprint.com. Embedded Per-sonal Printing Clients are also available from printer manufacturers that are not certified by us. Contact the manufacturer to enquire further.

4 Please download the client software for Lexmark and Konica Minolta printers here: www.thin-print.com. For Samsung clients, please contact the manufacturer directly.

https://www.thinprint.com/en/resources-support/supported-devices/

https://www.thinprint.com/de/ressourcen-support/software/clientsundtools/

https://www.thinprint.com/de/ressourcen-support/software/clientsundtools/

https://help.thinprint.com/docu/mobile-print/

https://download.cortado.com/docu/CCS/WebHelp/en/Server90/

http://www.heise.de/download/product/portable-qr-code-generator-85046

http://www.chip.de/downloads/Portable-QR-Code-Generator_58170370.html


Installation on the server©

ThinPrint Gm

bH 2

018

Installation on the server

During installation the following prerequisites will be installed, if they’re not already present:

• Microsoft Windows Installer• ADAM instance from ThinPrint• License Manager• Personal Printing Setup and Support Files• Personal Printing

User account for installation

The server on which Personal Printing is installed, must be a member of a domain. For all stages of installation and configuration, you will need a normal domain user account with local administrator’s permissions:

– To install and configure the software, set up a normal user account in the AD (Active Directory). We recommend that you name this PPservice.

– Then give this account local administrator permissions on the Personal Printing server.

Installing Personal Printing

1. Log on to the Personal Printing server with the account described above.

2. Start the program Setup.exe.

Illus. starting the installation program Setup.exe

3. In the next window select a language if desired.



Thi

nPrin

t G

mbH

201

8

Illus. selecting the language

4. If Setup.exe installs prerequisites before the actual installation, you will then be prompted to restart Windows. After the restart, the installation program starts automatically.

Illus. installing prerequisites

5. Click NEXT to confirm the Welcome window.

Illus. Welcome window

6. Read and accept the license agreement, and click NEXT to confirm.



ThinPrint Gm

bH 2

018

Illus. Welcome window

7. In the next dialog you can select the installation path with CHANGE. Click NEXT to confirm.

Illus. selecting the installation path, if necessary



Thi

nPrin

t G

mbH

201

8

8. Personal Printing needs an account for accessing the print jobs. We recommend the AD account PPService used for installation (see User account for installa-tion).

Illus. specifying an account to manage print jobs

9. If you have already received license keys from your supplier or from ThinPrint GmbH, then select ENTER LICENSE KEY(S). Otherwise select DEMO MODE. Click NEXT to confirm.

Illus. selecting the licensing mode

Entering license(s) 10. If you selected ENTER LICENSE KEY(S), then a new menu will open. Copy your license keys into the white field (in the left screenshot) and click on INSTALL LICENSES. Thereupon, one of the red circles with an exclamation mark will change to a green circle with a checkmark (in the right screenshot). Click OK to confirm.



ThinPrint Gm

bH 2

018

Illus. entering license keys: Copy into the white field and click on INSTALL LICENSE(S)

Note! After you enter it, a license key will be valid for 30 days without being activated. For an overview of your licenses and for entering further license keys see Licensing.

11. Click on INSTALL in the next dialog, to start the actual installation process. This may take a few minutes.

Illus. starting the actual installation

12. Finally, click FINISH to close the window. After that, a Windows restart may be required.



Thi

nPrin

t G

mbH

201

8

Illus. finishing the installation

After a successful installation you can find the Personal Printing configuration console in the start menu.

Illus. Personal Printing in the Start menu

18 Manual Configuring Personal Printing server.fm

Authentication methods • Overview©

ThinPrint Gm

bH 2

018

Authentication methods • Overview

To be able to print with Personal Printing, you must make some settings both on the server and on printers and devices. The printer and device settings depend on which method your users will use to authenticate themselves at the printers. The following methods are available:

• authentication via Release Station with NFC card or token

• Smartphone authentication Reading in a QR code or NFR tag attached to the printer. See • iOS app • Android app

• authentication directly on a printer with NFC card or token. See • Configuring Lexmark printers • Configuring Samsung printers • Configuring Konica Minolta printers

An additional authentication by PIN entry is available with each of these methods.

Note! NFC cards (smartcards) or tokens with changing IDs are not supported.

Additional administrators

You may wish that later, several people will be able to configure Personal Printing. During installation the (local) user group PERSONAL PRINTING ADMINISTRATORS was already created on the Personal Printing server. Domain users can be added to this group with local admin rights. They can then manage Personal Printing.

See also section Editing instructions for self-registration.

Configuring Personal Printing server.fm Manual 19

Configuring Personal Printing server©

Thi

nPrin

t G

mbH

201

8

Configuring Personal Printing server

– In the Start menu, open the Personal Printing console.

Illus. Personal Printing in the Start menu

This opens the Microsoft Management Console (MMC) where you can make the set-tings described in the next section.

Illus. Personal Printing configuration console

For settings, go to EDIT SETTINGS. A window opens with the following tabs:

• Print Job Storage• ADAM Service Account:

Here you can change the connection to the ADAM or AD LDS instance that you specified during installation (see ADAM Service Account).

• Authentication (see Default user PIN and authentication methods)• Tracking (see Print job tracking)



ThinPrint Gm

bH 2

018

Print Job StorageThe print jobs of the users are not immediately printed, but buffered in a directory until they are picked up by authorization on the printer. This storage can also be a network drive.

Illus. functional principle of Personal Printing

In the PRINT JOB STORAGE tab you can select the directory in which users’ print jobs will be saved. You also have to specify an account which is used by the Personal Printing software to store or read the users’ print jobs in this folder and its subfolders.

You can also store your print jobs on any other server – assuming that this server is a domain member (= AD member). This directory has to be shared on this server. Additionally a domain user has to be assigned which has full control of this directory (we recommend the use of said PPSERVICE account).

Illus. Personal Printing settings: Print Job Storage (directory: connected drive, account: PPservice, as an example)



Thi

nPrin

t G

mbH

201

8

Directory. Specify a root directory for Personal Printing print jobs. Subfolders for each user will be created automatically in this directory. Use for connected drives the fol-lowing denomination: For connected drives use the following syntax:

driver_letter:\directory_name

and for directories on another server the following UNC path:

\\server_name \share_name

Caution! If you change the path to the print job folder later on, only the new users, who were enabled for Personal Printing after the change, can print in this folder. All the print jobs of users enabled before the change are still saved in the old folder. Therefore, do not delete the old folder.

You can encrypt the directory in which the print jobs are stored. See the section Stor-ing encrypted print jobs.

Access account and password. Specify an account (UPN and password), that has access to the folder with the print jobs. This account requires local administrator per-missions and should be a domain user5. We recommend you use the account that you created earlier (see ADAM Service Account), here: PPservice.

Note: If you change the access account later, it is best to delete the contents of the PERSONAL PRINTING JOBS folder beforehand. This means that you will lose jobs that haven't been printed yet, however all new jobs triggered from then on will print via the new account.

Maximum print job storage time. Print jobs remain in users’ folders until collected at the printer or deleted using JobViewer. To prevent that this data takes up too much space on the hard disk, you can specify a period after which they will be deleted (in minutes). The default value is 0 (zero); this means that print jobs are never deleted.

If the maximum print job storage time limit for a specific print job has expired, then Personal Printing will delete it the next time the user authenticates at one of the printers.

– To enable the maximum print job storage time restart the IIS Admin Service (e.g. with iisrest on the command line).

5 If, on security grounds for example, you don’t want to specify a domain account, you can select a local admin account instead. Note however, that in that case it’s not possible to print to shares, but only to printers created locally on the Personal Printing server.


Setting up target printers©

ThinPrint Gm

bH 2

018

Setting up target printers

– In the Personal Printing console, Click ENABLE PRINTERS.


Decide whether you want to add a printer that is connected to a locally installed printer port (LOCAL PRINTER) or if you want to connect to a shared printer on another server (NETWORK PRINTER).

Illus. selecting printer type

Local printers

Here: printers that were created locally on the Personal Printing server (that will be printed to via Standard-TCP/IP or LPR/LPD). Generally they are physical network printers.

– Select LOCAL PRINTER.



Thi

nPrin

t G

mbH

201

8

– You can select the printers by highlighting them (even several). Do not select a Personal Printer.

Illus. selecting locally installed printers for Personal Printing

Network printers

Here: shared printers listed in the domain/AD To set up network printers, the user account for this purpose must be an AD user account (see Access account and password).

– Select NETWORK PRINTER.

– A window will open, with which you can search in the specified domain for printers; specific criteria can be used. You can highlight several printers simul-taneously.

Illus. selecting shared printers for Personal Printing (example)



ThinPrint Gm

bH 2

018

Result After that, the selected printers can be seen in the MMC where they automatically receive an ID to differentiate between them.

Illus. assigned printer IDs

On the right of the printer list you can change IDs or disable printers:

Change ID. The printers listed here, which you previously selected for Personal Print-ing, receive an ID automatically. If you wish to change this, select CHANGE ID and enter a new one.

Disable Printers. Here you can remove from the list, printers that you selected for Personal Printing. You don’t delete printers with this, but merely disable Personal Printing for these printers.

Printer mapping Set up your environment in such a way that when users log in to a session on their desktops they are connected to a Personal Printer (of the Personal Printing server):

• the Personal Printer if they work with Windows (see Adding Personal Printers)• a Personal Printer with a native driver if they work with Mac OS or Linux (Setting

up Personal Printers for Mac and Linux machines)

This can be done, for example, using a group policy in AD.


ADAM Service Account©

Thi

nPrin

t G

mbH

201

8

ADAM Service Account

– Click EDIT SETTINGS in the Personal Printing configuration console and select the ADAM SERVICE ACCOUNT tab .


An AD account and the LDAP settings have been specified here by the Personal Print-ing installer, with which the Personal Printing server can communicate with Active Directory. The AD account must be the same with which the Personal Printing soft-ware was installed – i.e. the recommended account ppservice.

Illus. Personal Printing: ADAM Service Account


Default user PIN and authentication methods©

ThinPrint Gm

bH 2

018

Default user PIN and authentication methods

– Click EDIT SETTINGS in the Personal Printing configuration console and select the AUTHENTICATION tab.


Here you can set up a DEFAULT USER PIN and the methods of authentication that will be used generally throughout your company.

Default user PIN

The authentication method CARD WITH PRESET ID (NFC card or token) allows users to register themselves. It should be noted that the User PIN in the Personal Printing Clients must match this Default user PIN. Both numbers and letters can be used (maximum 255 digits).

Example You want users to register themselves, so enter 0000 here as the DEFAULT USER PIN. Then enter the same PIN or password:

• in a Personal Printing Release Station as the DEFAULT USER PASSWORD • in the Personal Printing Client on a Lexmark printer as the DEFAULT USER PIN • in the Personal Printing Client on a Samsung printer as the DEFAULT PIN • in the Personal Printing Client on a Konica Minolta printer as the DEFAULT PIN


Default user PIN and authentication methods©

Thi

nPrin

t G

mbH

201

8

Illus. Personal Printing: AUTHENTICATION tab with Default user PIN

Authentication methods

You can use both authentication methods CARD WITH PRESET ID (NFC card or token) and Scan barcode using smartphone in parallel (see screenshot above). That is, some Personal Printing users can authenticate with the smartphone, others with NFC card. It is also possible to assign a user both authentication methods.

Select the authentication method(s), that you want to use throughout your com-pany. Later, in the user configuration (see Configuring smartphone users), only those authentication methods that you have chosen here will be active.

Card with preset ID It’s a card type with a fixed card number, which is used to identify the users.

Scan barcode using smartphone

Select this option, if the users are to authenticate themselves on the printer with their smartphone. So you can send the users the configuration email later, via the Personal Printing server, enter the SMTP address of your mail server (TCP port 25 must be open). To enable users to reach the Personal Printing server from a smartphone, also enter the URL of your Personal Printing server. here.6 This URL is part of the config-uration mail that will be sent to the users later (see Personalize). Make sure as well, that TCP port 80 (and/or 443 with encryption) are open. In addition, you can set whether for all users FORCE PIN ENTRY ON SMARTPHONE should be set as default or switched off.

6 Do you want to encrypt the data transmission? See Encrypting user data during transmission.


Setting up users©

ThinPrint Gm

bH 2

018

Setting up usersSelf-registration by users

The authentication method CARD WITH PRESET ID (NFC card or token) allows users to register themselves. See the section on Self-registration.

Manual setup by the admin

For all authentication methods, the admin can manually register the users. See the section Setting up users manually.

Configuring the Release Station.fm Manual 29

Release Station • Overview©

Thi

nPrin

t G

mbH

201

8

Release Station • OverviewTechnical requirements

You will require the following hardware:

• a server for the Personal Printing installation• Personal Printing Release Station (from firmware version 1.1) • card reader with a USB port (its type depends on the tokens or cards to be used)• NFC token or card (Mifare, FeliCa etc.)

– Connect all the devices, as shown in the illustration. The Release Station is con-nected to the network and located close by to the printer. The printer can either be connected to the network or, via USB, directly to the Release Station.

Illus. NFC card authentication with the Release Station

– A Release Station is required for each printer. The supplied, contactless card reader is connected via USB to the Release Station. It is used with NFC cards (e.g. Mifare). The card reader type depends on the tokens or cards to be used.

Configuring server and users

– Proceed as described in the sections Setting up target printers and Default user PIN and authentication methods.

Default password

If the password for logging on to the web console has not been set, then the default is:

print4life

30 Manual Configuring the Release Station.fm

Release Station • Overview©

ThinPrint Gm

bH 2

018

Intended use

The Release Station is used to collect Personal Printing jobs via authentication from a Personal Printing Server.

Note! Always use the Personal Printing Release Station only according to the intended purpose, as described above. Putting the device to other uses may cause malfunctions in the intended operation, as described in this document.

Safety information

• Only use the Personal Printing Release Station as described in this documenta-tion and according to its intended use. Any improper use, including without being limited hereto, the opening of the casing, expires any and all warranties.

• Install the Release Station within easy reach of a wall outlet.• Be sure to turn off and remove the power supply unit from the wall outlet before

connecting or disconnecting any interface cable to the Release Station. When unplugging the cable, always pull on the plug and not on the cable itself.

• Use shielded and properly grounded interface cables to prevent radio frequency interference.

• Protect the Release Station during thunderstorms by turning it off and discon-necting the power supply unit.

• Do not use the Release Station near water. Never spill liquid of any kind on the Release Station or its power supply. The setup location must not be subject to extreme heat, cold, humidity, or dust. Heat and cold can impair the functionality of the Release Station; humidity and dust can cause the Release Station to fail.

• Do not open the power supply. There is a danger of electric shock!• Do not cover the Release Station, as this can cause it to overheat.• Never place the device in the bright sun or over a radiator, near a heater, a heat-

ing grid or heat register or another heat source, as this can cause it to overheat.• The Release Station should not be operated in an enclosed space (e.g. cabinet,

shelving), unless proper ventilation is provided.• Ensure the voltage and frequency of the power supply matches your local stan-

dard. For details, see INPUT on the power supply's model plate. • Do not operate the Release Station on any mobile unit or other unstable surface,

where it may fall and be damaged.• Do not place any item on the fixed USB power cord, or locate the Release Sta-

tion where the fixed USB power cord can be stepped on.• Unless otherwise stated in this documentation, do not attempt to service the

Release Station or the power supply yourself. Refer all servicing to qualified ser-vice personnel.

• Do not make any modifications to the Release Station which could cause radio frequency interference.

• Maintain the Release Station in a satisfactory state of repair.


Setting up the Release Station©

Thi

nPrin

t G

mbH

201

8

• If any of the following conditions occur, unplug the power supply from the wall outlet and refer to qualified service personnel:• If the fixed power cord is frayed, or the power supply is damaged in any way.• If liquid has been spilled on the Release Station or on the power supply.• If the Release Station or the power supply has been exposed to rain or water.• If the Release Station or the power supply does not operate normally when

the operating instructions are followed.• If the Release Station or the power supply has been dropped or the casing has

been damaged.• Turn off power before cleaning. Only use a dry soft cloth to clean the case. Do

not use aggressive polishes or cleaning agents.

CE and FCC conformities

Safety approvals for European Union and USA: EN 60950-1, UL 60905-1, CAN/CSA-C22.2 No.60950-1

Setting up the Release Station

To prepare the device for use, proceed as follows:

1. Plug the micro USB connector of the supplied power unit into the Release Sta-tion with the USB icon facing down.

Illus. insert the micro USB plug into the device with the USB icon facing down

2. Connect the other cables required for connecting the printers to the Release Sta-tion: network cable and/or USB printer cables.

3. Plug the power supply unit into the wall outlet (if necessary, use one of the sup-plied power adapters); the red LED on the front cover lights up.


Finding the device in the network©

ThinPrint Gm

bH 2

018

Finding the device in the network

1. Download the ThinPrint Hub Finder from the TOOLS download page:

https://www.thinprint.com/en/resources-support/software/clientsandtools/

2. Run it on a Windows machine. All the Release Stations and ThinPrint Hubs located in the same subnet will be displayed. For searching in another subnet (additionally) enable the USE RANGE SCAN option, enter an IP address range and then click on START SEARCH.

3. Click the URL of the relevant Release Station. The login page of its console opens in a web browser.

Illus. selecting the Release Station URL

Web consoleOpen the web console

– Open the Release Station’s web console in an internet browser. Do so by click-ing the respective link in the Hub Finder or by entering its address in the internet browser with https – thus, an encrypted connection – e.g.:

https://192.168.209.71

Accept the unrecognized certificate. You can replace this later with a proprietary certificate by using the web console to load it onto the Release Station as WEB SERVER CERTIFICATE.



Web console©

Thi

nPrin

t G

mbH

201

8

Illus. selecting the Release Station URL

– Log in to the web console. If the login password has not been otherwise speci-fied, then the default is:

print4life

Illus. log in to the Release Station’s web console

– The web console appears. Select PERSONAL PRINTING.


Preparing the Release Station and registering users©

ThinPrint Gm

bH 2

018

Illus. Release Station’s web console: selecting Personal Printing

Note! For Release Station options that are not described here, see the Thin-Print Hub documentation.

Preparing the Release Station and registering users

Perform the following preparatory activities at the Release Station:

– Set up the device including login (see Setting up the Release Station)– Open the PERSONAL PRINTING configuration in the Web console of the Release

Station, here:• Enable the checkbox SERVICE CONFIGURATION • Enter the URL of the Personal Printing server

(optionally via https, for which a server certificate must first be installed on the Personal Printing server and possibly the matching root certificate on the Release Station)

• Enter the relevant printer ID from the Personal Printing console • Enter the DEFAULT USER PASSWORD, which ...

> with self-registration: ... must be the same as the DEFAULT USER PIN in the console of the Personal Printing server, e.g. 0000 or ABCD> with manual setup by the admin: ... must be the same as the USER PIN in the users’ AD configuration on the Personal Printing server

• Confirm the entries by clicking on SAVE.

https://download.cortado.com/docu/ThinPrint/hub/en/

https://download.cortado.com/docu/ThinPrint/hub/en/


Printing©

Thi

nPrin

t G

mbH

201

8

Illus. Release Station: Personal Printing Client settings

Illus. console of the Personal Printing server: printer IDs

User registration at the Release Station

– See the Self-registration section or alternatively Setting up users manually.

Printing

• Precondition for Windows computers: The Personal Printer shared on the Per-sonal Printing server has been connected to the session (Adding Personal Prin-ters).

• Precondition for Mac and Linux computers: One or more Personal Printers with native drivers have been connected to the session (Setting up Personal Printers for Mac and Linux machines).

1. If users are printing from an application, they select the respective Personal Printer.

https://download.cortado.com/docu/ThinPrint/hub/de/HUBd/Schnellstart/Hub_in_Betrieb_nehmen.htm


Importing certificates©

ThinPrint Gm

bH 2

018

Illus. printing from an application (example for Windows)

2. Users working on Windows workstations are presented with the ThinPrint Out-put Gateway printer driver interface, even when they are printing with the orig-inal driver. The printer settings (duplex/simplex, color/grayscale, print resolu-tion, paper size, source, etc.) can be selected in the ThinPrint Output Gateway interface. If the print settings are not supported by the target printer, the print job will be sent nonetheless (in the form most compatible with the hardware). ThinPrint Output Gateway can be displayed in 16 languages and is automati-cally matched to the display language of the workstation.

3. Then the Windows users go to any printer set up for Personal Printing and authenticate themselves there with their NFC card or their NFC token.Mac and Linux users go to the printer that they have selected previously.

Then, depending on the Release Station settings one or all print jobs so far sent to Personal Printer (and saved on the Personal Printing server) will be printed on this printer, or will be printer for as long as the NFC card or the NFC token is present at the card reader. The user can get an overview of the saved jobs with the JobViewer.

Importing certificates

If the connection from the web browser to the Release Station console or from the Release Station to the Personal Printing server is to be encrypted, then the CERTIFI-CATES menu of the Release Station’s web console is used for loading certificates from a workstation or a server onto the Release Station (see the screenshots below). If a certificate contains key (for the connection web browser→ Release Station), then it is protected with a password; this must be entered while uploading.

https://download.cortado.com/docu/PersonalPrinting/WebHelp/en/Personal_Printing-Docu/Personal_Printing_Manual/Changing_the_language_of_the_print_dialogue.htm



Thi

nPrin

t G

mbH

201

8

Note! A reboot is required after loading the certificates onto the Release Sta-tion. For your certificates to function error-free, also check the system time.

Illus. uploading a certificate

Illus. unlocking a certificate, using its password

Menu Function

UPLOAD CERTIFICATE • select the certificate to be uploaded • file type .pfx, .p12 or .cer

UNLOCK CERTIFICATE→ UNLOCK

• enter password • click UNLOCK to confirm

UNLOCK CERTIFICATE→ REMOVE

• cancel uploading the certificate

IN USE • certificate is in use

REMOVE • remove the certificate • click SAVE to confirm

SAVE saves the entries

CANCEL cancels the operation



ThinPrint Gm

bH 2

018

Illus. uploaded certificates: root certificate ThinPrint Demo CA (for the connection Release Station→ Personal Printing server) and server certificate releasesta-tion-03 (for the connection web browser→ Release Station, assigned in the TLS menu below)

Illus. root certificate for Personal Printing set up (here: ThinPrint Demo CA)

Self-registration and JobViewer.fm Manual 39

Self-registration©

Thi

nPrin

t G

mbH

201

8

Self-registration

Users with an AD account can either be enabled for Personal Printing by the admin-strator or register themselves:

– A user (with an account from the domain of the Personal Printing server) goes to the Release Station and holds his NFC card or token to the card reader.

– The printer will issue a registration instruction.7

Illus. printout of the self-registration instruction (example with https and the server address PP-40)

– The user follows this instruction:• To do this, s/he logs into the JobViewer on the web console of the Personal

Printing server.• If no encryption is set up, s/he must enter http instead of https.

7 To change the template of this instruction, see Editing instructions for self-registration.

40 Manual Self-registration and JobViewer.fm

Self-registration©

ThinPrint Gm

bH 2

018

Illus. logging on to JobViewer

• The user enters the six-digit access code specified on the registration instruc-tions and confirms by clicking on SUBMIT CODE.

Illus. JobViewer: entering the access code for self-registration

• S/he then sees the list of her/his Personal Printing jobs, which is still empty at this time. This completes the registration.


JobViewer: Print job overview©

Thi

nPrin

t G

mbH

201

8

Illus. JobViewer: user successfully registered for Personal Printing

JobViewer: Print job overview

With Personal Printing JobViewer, users can get an overview of all their print jobs stored on the Personal Printing server. Here they can delete print jobs that are not needed any more or were sent by mistake. Additionally, the order of print jobs can be changed here.

JobViewer is installed automatically on the Personal Printing server and can be reached by any browser – inside or outside the company's domain. The classic Inter-net Explorer is not supported here. In contrast, Edge, Chrome and Firefox are recom-mended.

– Enter the following URL into a browser:

http(s)://PersonalPrintingServer/jobviewer Example:

https://pp-04/jobviewer

encrypted connect-ing to the Job-Viewer

If you want to use the JobViewer over an encrypted connection (https://), proceed as follows:

1. Import a server certificate

2. Use this certificate to add an https connection to the IIS

Both steps are described the section Encrypting user data during transmission.

– Open the Jobviewer with the above URL.

42 Manual Self-registration and JobViewer.fm


ThinPrint Gm

bH 2

018

Illus. Login to JobViewer

The Jobviewer is available in English and German and follows the language set in the browser (default: English).

Log in with (user) credentials. Then you will get a list of print jobs stored on the server.

Illus. JobViewer: list of stored print jobs

Here, you can:

• delete a print job: Click on the recycle bin on the right• delay a print job: Click on the checkbox on the left• sort print jobs: With the mouse you can grab a print job and move it to another

position (drag&drop)• Account tab (arrow in the screenshot): User information as well as the possibil-

ity to renew the registration when replacing the NFC card or token



Thi

nPrin

t G

mbH

201

8

As soon as you authenticate yourself at the printer, all print jobs listed here are printed. If you no print jobs are shown here, check if the time period for saving the jobs may have been set too short (see Maximum print job storage time).

Illus. JobViewer: User information and possibility to renew the registration when chang-ing the NFC card or the token

44 Manual Smartphone authentication.fm

Configuring smartphone users©

ThinPrint Gm

bH 2

018

Configuring smartphone usersPreparing Personal Printing server

Open the user properties as described in the section Setting up users and go to the PERSONAL PRINTING tab.

Illus. configuring a user in Active Directory

Enable Personal Printing: Activate Personal Printing for this user account

Disable Personal Printing account temporarily: All the settings are preserved, but the user can (temporarily) not use Personal Printing.

Authentication methods: Select SCAN BARCODE USING SMARTPHONE and FORCE PIN ENTRY ON SMARTPHONE, if additional PIN entry is required (see below).

Depending on whether you have placed a checkmark by FORCE PIN ENTRY ON SMARTPHONE under the AUTHENTICATION tab in the server settings (see Default user PIN and authentication methods), your entry here is preset by default for all users. If not already shown, enter the E-MAIL address of the respective user. The user must be able to access its mail using his smartphone.

User ID: You can change the automatically generated user ID. You can allocate any user ID. With a click on PERSONALIZE, this configuration will be sent to the user’s smartphone by e-mail; this field will then appear grayed out.

User PIN:

Smartphone authentication.fm Manual 45


Thi

nPrin

t G

mbH

201

8

• Case 1: No PIN entryEven if no additional authentication at the printer with PIN is desired, a PIN is required at this point. This is part of the configuration e-mail and is stored along with the user ID on the smartphone. It is recommended to take over the DEFAULT USER PIN by clicking on USE DEFAULT.No checkmark is set at FORCE PIN ENTRY ON SMARTPHONE.

• Case 2: With PIN entryIf you choose FORCE PIN ENTRY ON SMARTPHONE, enter any PIN that the user should enter when printing with the smartphone (max. 255 digits). Make a note of the PIN entered and inform the user of this PIN.Alternatively you can also use the Personal Printing server assigned DEFAULT USER PIN (see Default user PIN and authentication methods) by choosing USE DEFAULT. Note that in this case several users use the same PIN.

Personalize: After the data is transmitted, the user clicks on PERSONALIZE to receive the data entered here, as a configuration e-mail (see Installing apps on smart-phones).

Reset: If required, delete all previous settings entered for the user. Be sure to take note of the user ID, because it will be required for a new configuration for this user.

Preparing printers for smartphone authentication

Creating a QR code To identify each of your network printers with a barcode, you can use a QR code gen-erator. There you should enter the printer’s name and ID (see Setting up target print-ers) using the following syntax:

Printer ID:printer name Example: 1:HP Color LaserJet 4700

Print out the QR code and attach it to the corresponding printer.

Illus. QR code on printer



ThinPrint Gm

bH 2

018

Writing an NFC tag To label your network printers with an NFC tag, the NFC tags must be written on – by an Android device, for example.

– If not existent, download an NFC tag writer in Android Market (NXP TagWriter, for example).

– Focus the Android device on an NFC tag and select TAGWRITER option.

Illus. opening NFC Writer (Example: NXP TagWriter)

– Enter the name of a printer and its ID (see Setting up target printers) using the following syntax:

PrinterID:PrinterName

Example: 1:HP Photosmart

Illus. writing NFC tag (Example: NXP TagWriter)

– Then paste NFC tag on the printer.


iOS app©

Thi

nPrin

t G

mbH

201

8

Installing apps on smartphones

For smartphone authentication, the Personal Printing app must be installed previ-ously on the mobile device. Proceed as follows:

1. Distribute the apps to the smartphones 2. Configure the apps per e-mail

Roll out the app file (package content of Personal Printing) via e-mail to all Android users. For iOS devices you download it from the App Store, for Android devices from the Play Store. The following apps can be used:

• iOS app • Android app

iOS app

First, the users need to download the Personal Printing app in the App Store (left screenshot) and then proceed to configure it. For this, a configuration mail was gen-erated automatically during the user configuration on the server (see Personalize) and sent to the users and is thus in the e-mail application on the users' devices. By open-ing the attachment of the configuration mail (OPEN IN PERSONAL PRINT, see right screenshot), the users configure the app. This will automatically launch the app.

Illus. downloading, installing and configuring Personal Printing app

https://itunes.apple.com/us/app/id645454599?mt=8

https://play.google.com/store/apps/details?id=com.thinprint.android

https://itunes.apple.com/us/app/id645454599?mt=8


Android app©

ThinPrint Gm

bH 2

018

Setting up Per-sonal Printing via AirPrint

So that Personal Printing users can use Apple’s AirPrint option, a trust must be set up between Personal Printing server and print server. To restrict this trust to specific ser-vices (e.g. CIFS) a CONSTRAINED DELEGATION must be applied.

– In ACTIVE DIRECTORY USERS AND COMPUTERS, select your Personal Printing server under COMPUTERS (left arrow). Then click on PROPERTIES in the context menu.

– In the tab DELEGATION→ TRUST THIS COMPUTER FOR DELEGATION TO SPECIFIED SER-VICES ONLY→ USE ANY AUTHENTICATION PROTOCOL, click ADD.

– Click USERS OR COMPUTERS and select your print server and then SERVICE TYPE→ CIFS (bottom arrow).

Illus. trust created between Personal Printing server and print server

Android app

First, the users need to download the Personal Printing app in the Play Store and then proceed to configure it.

Alternatively, you can roll out the file PersonalPrinting.apk or PersonalPrint-ing-release.apk via e-mail to all Android users. To install the app, users need to open the e-mail attachment (.apk file) in the e-mail application of the Android device. Beforehand, ensure that UNKNOWN SOURCES option is enabled on the device (see SET-TINGS→ APPLICATIONS).

https://play.google.com/store/apps/details?id=com.thinprint.android


Printing with smartphone authentication©

Thi

nPrin

t G

mbH

201

8

Illus. installing Personal Printing app

Afterwards, users need to configure the Personal Printing app. A configuration e-mail is created automatically during user configuration on the server, and sent to the mobile device. Open the e-mail application on the Android device and click on the e-mail attachment (.tpmpp file, see Personalize). Configuration of app is done auto-matically while opening .tpmpp file. After successful configuration, the PERSONAL PRINTING app starts automatically.

Printing with smartphone authentication

Here users authenticate themselves directly at the printer, by reading in the QR code or the NFC tag with their smartphone. The print jobs initiated at the workplace can be picked up at the printer.

For preparation of network printers for Personal Printing see Setting up target print-ers. Furthermore, the printers must be set up in the Personal Printing console and mapped into the desktops sessions (Adding Personal Printers).

– Users printing from within an application select the appropriate Personal Printer.Users who work on Windows workstations receive ThinPrint Output Gateway as their printer driver user interface. Here, the print settings (duplex/simplex, color/black & white, paper size, paper tray, etc.) can be changed. If the target printer does not support a selected print setting, the print job will continue to be printed in a way possible with that specific hardware. Output Gateway can operate in 16 languages, and can be matched automatically to the worksta-tion’s display language. See Changing the language of the print dialogue.



ThinPrint Gm

bH 2

018


– Then, Windows users walk to any printer which is configured for Personal Print-ing. Mac and Linux users walk to the printer they selected before (see Setting up Personal Printers for Mac and Linux machines) or to a printer of the same model.

– Then the users authenticate themselves with their device.

Illus. smartphone authentication at the printer (example for iOS)

– Arrived at the printer, the users open the Personal Printing app and scan either the QR code or the NFC tag8 with their camera (See Printing with iOS devices, Printing with Android devices).

8 only available for Android



Thi

nPrin

t G

mbH

201

8

Illus. selecting PERSONAL PRINTING (left iPhone, right Android)

Printing with iOS devices

– The users open the Personal Printing app. A list of all existing print jobs is dis-played. The users can select one or multiple print jobs with a green checkmark (top arrow). Then they tap on the SCAN button (bottom arrow) and scan the QR code with the phone’s camera (right screenshot).

Illus. iOS: scanning QR code for authentication

– If a PIN request was set additionally (see Configuring smartphone users), the users must now enter their PIN.



ThinPrint Gm

bH 2

018

Illus. Personal Printing app on iPhone (example) – entering PIN, if necessary

– A list of all existing print jobs is displayed. The user can select one or multiple print jobs (upper arrow) and then tap on PRINT (lower arrow).

Illus. Personal Printing app on iPhone (example) – List of existing print jobs

– It is also possible to delete print jobs. To do so, the user swipes from the left over the field with the corresponding print job and then taps on DELETE.

Illus. iOS: deleting print jobs



Thi

nPrin

t G

mbH

201

8

Printing with Android devices

Scanning QR code – The users open the Personal Printing app. A list of all existing print jobs is dis-played. The users can select one or multiple print jobs with a green checkmark (top arrow). Then they tap on the SCAN button (bottom arrow) and scan the QR code with the phone’s camera (right screenshot).

Illus. Left: Android interface – scanning QR code or holding over NFC tag, Right: scanning QR code

Read NFC tag – To readout an NFC tag9, Android users open the app and hold their device next to an NFC tag. As soon as the device recognizes the NFC tag, a selection of available applications for further proceeding will be offered. Select PERSONAL PRINTING.

Illus. Android: reading out NFC tag and selecting Personal Printing

– If a PIN request was set additionally (see Configuring smartphone users), the users must now enter their PIN.

9 Reading NFC tags requires Android firmware 2.3.3 or later.



ThinPrint Gm

bH 2

018

Illus. Android: entering PIN, if necessary

Then all selected jobs (which are stored on the Personal Printing server) will be printed on this printer. (To get an overview of the stored print jobs, you can use Job-Viewer alternatively).

– It is also possible to delete print jobs. On this, the users mark the relevant jobs and then select DELETE SELECTED JOBS in the app menu.

Illus. Android: deleting print jobs

Personal Printing Clients in printers.fm Manual 55

Authentication with printers • Overview©

Thi

nPrin

t G

mbH

201

8

Authentication with printers • Overview

The following hardware is needed:

• Server for the installation of Personal Printing• Printer with embedded Personal Printing Client. See below:

• Configuring Lexmark printers • Configuring Samsung printers • Configuring Konica Minolta printers

• external card reader (if not already embedded in the printer)• NFC cards or tokens (e.g. Mifare)

– Connect all the devices as shown in the scenario. In particular, connect:• the printer to the network• a card reader via USB with the printer (optional); to do this, please note the

manual of the card reader manufacturer.

Illus. authentication with NFC card or token on Lexmark printer

Configuring server and users

– Proceed as described in the sections Setting up target printers and Default user PIN and authentication methods.

Configuring Lexmark printers– Enter the IP address of the printer in an internet-enabled browser. If necessary,

add the opened configuration web page of the printer to the list of trusted sites in the security settings of your browser.

– Select the Lexmark printer configuration web page at SETTINGS→ EMBEDDED SOLUTIONS.

56 Manual Personal Printing Clients in printers.fm

Configuring Lexmark printers©

ThinPrint Gm

bH 2

018

Illus. configuration website of the Lexmark printer

– Then select SOLUTIONS→ PERSONAL PRINTING CLIENT.

Illus. configuration website of the Lexmark printer: selecting Personal Printing Client

Via the CONFIGURE menu item you can make the following settings:

Server URL: Enter Personal Printing server’s address as URL.



Thi

nPrin

t G

mbH

201

8

Printer ID: Here you enter the printer ID assigned in Personal Printing server (see Setting up target printers).

Default user PIN: • with self-registration: must be the same as the DEFAULT USER PIN in the con-

sole of the Personal Printing server, e.g. 0000• with manual setup by the admin: must be the same as the USER PIN in the

users’ AD configuration on the Personal Printing server

Operation mode. Select one of the following modes:

• Smartcard without PIN: In this mode, users authenticate only with their NFC card or token at the printer.

• Smartcard with PIN: In this mode, users authenticate with their NFC card or token and their user PIN.

• User ID input: In this mode, users authenticate only by entering an individual user ID at the printer.

Enable logging. When this checkbox is enabled, a log file is created on the printer's configuration web page.

Root certificate for encryption: Here you can install a root certificate which was pur-chased from a certification authority.

Requirement: Personal Printing server’s Internet Information Service has been set up for encrypted communication, and a certificate acquired from a certification authority has been installed there (see Encrypting user data during transmission).

Illus. configuring Personal Printing on Lexmark printer



ThinPrint Gm

bH 2

018

Authenticating on the Lexmark printer

• Precondition for Windows machines: The Personal Printer must be connected in the session (Adding Personal Printers).

• Precondition for Mac and Linux machines: One or more Personal Printer with native drivers must be connected in the session (Setting up Personal Printers for Mac and Linux machines).

1. To print from an application, users must select Personal Printer as the printer.


2. Users who work on Windows workstations receive ThinPrint Output Gateway as their printer driver user interface, even if they're printing with the original driver. ThinPrint Output Gateway allows you to change print settings (duplex/simplex, color/black & white, paper size, paper tray, etc.). If the target printer does not support a selected print setting, the print job will continue to be printed in a way possible with that specific hardware.Output Gateway can operate in 16 languages, and can be matched automatically to the workstation’s display language. See Changing the language of the print dialogue.

3. Then users go to a Lexmark printer and choose PERSONAL PRINTING on the dis-play of the printer.



Thi

nPrin

t G

mbH

201

8

4. According to the pre-adjusted operation mode, users put their NFC cards or tokens on the card reader. Users then tip NEXT.

Illus. Lexmark printer: authentication using NFC card

5. Alternatively they enter their user ID via the printer's display. Users then tip NEXT.

Illus. Lexmark printer: authentication using user ID

6. If in addition to reading the NFC card or token, a user PIN is required, the users will be prompted to enter via the display of the printer. Users then click NEXT.

Illus. Lexmark printer: entering NFC card PIN


Configuring Samsung printers©

ThinPrint Gm

bH 2

018

7. Then users tap on PRINT ALL to print all print jobs that have been sent to the Personal Printer at this printer.

Illus. Lexmark printer: selecting PRINT ALL to start printing

Configuring Samsung printers

1. Download the Personal Printing client for Samsung printers (free) onto any com-puter.

2. Enter the printer’s IP address in your browser to open the SyncThru Web Ser-vice page and login as an administrator.

3. Select MAINTENANCE→ APPLICATION MANAGEMENT and then click ADD.

Illus. opening the Samsung printer’s web interface



Thi

nPrin

t G

mbH

201

8

4. Click BROWSE and select the software PERSONALPRINTINGCLIENT.PAR.

Illus. Installing Personal Printing Client for Samsung

5. Confirm the on-screen information with OK. Now you will find the Personal Printing Client in the APPLICATION area.

Illus. Personal Printing Client installed successfully

6. Open SECURITY→ SYSTEM LOG and enable LOG CONFIGURATION: JOB LOG.

Illus. Enable JOB LOG for Personal Printing

7. Reboot the printer.



ThinPrint Gm

bH 2

018

Configuration

After you have installed the Personal Printing client, the menu item PERSONAL PRINT-ING appears in the XOA10 menu.

Illus. Personal Printing appears in the Samsung printer’s XOA menu

Under PERSONAL PRINTING CONFIGURATION you can make the necessary settings, which are explained below.

Illus. Samsung printer: Personal Printing configuration

SERVER ADDRESS: Personal Printing server address

PORT: Personal Printing server TCP port

PRINTER ID: Printer ID, as assigned for this printer by the Personal Printing server

AUTHENTICATION MODE: The method by which the users authenticate themselves at the printer (USER ID, USER ID + PIN, RFID CARD11 or RFID CARD +PIN). On the Per-sonal Printing server, CARD WITH PRESET ID must be set as the authentication method.

10 The XOA menu only appears if Personal Printing or other XOA programs are installed.

11 If other applications, in addition to Personal Printing, are using NFC or RFID, it may cause prob-lems when printing with Personal Printing. In that situation, we recommend you select RFID CARD + PIN.



Thi

nPrin

t G

mbH

201

8

DEFAULT PIN: This field is only active when USER ID or RFID CARD (without addi-tional PIN entry) are selected as authentication method. The value ...

• with self-registration: ... must be the same as the DEFAULT USER PIN in the console of the Personal Printing server, e.g. 0000

• with manual setup by the admin: ... must be the same as the USER PIN in the users’ AD configuration on the Personal Printing server

CONNECTION METHOD: Connection between the printer and the Personal Printing server: with (HTTPS) or without (HTTP) encryption. For HTTPS, an root certificate must be installed on the printer (go to SECURITY→ NETWORK SECURITY→ DIGITAL CER-TIFICATE). In addition, on the Personal Printing server, Internet Information Services is configured for encryption and a server certificate (signed by the root certificate) is installed.

SERVER TIMEOUT (s): The time, in seconds, for which an attempt is made to reach the Personal Printing server. After the connection is lost; the login mask appears.

APPLICATION TIMEOUT (s): Standby time, in seconds, if a user is inactive in the Per-sonal Printing client (printer display). After that time, the login prompt appears (user is logged off).

– Confirm your entries by clicking APPLY.

Saving configura-tion

You can save the Personal Printing configuration, by clicking on IMPORT / EXPORT at left, and then on EXPORT. You will be supplied with an eas. file (e.g. PERSONALPRINT-ING-CLX-9201.EAS), which you can save on your computer and, when required, use the Browse button (below right) to locate it again and then import it.

Illus. Import/export Personal Printing configuration

Authenticating on the Samsung printer

– For sending a print job to the Personal Printing server see the section Authenti-cating on the Lexmark printer.



ThinPrint Gm

bH 2

018

– It the Personal Printing client has been correctly installed and configured, the PERSONAL PRINTING icon shows on the printer display12. Click on this icon to print.

Illus. Personal Printing on the Samsung display

Depending on which authentication mode was set up (see above) you will see one of the following input masks.

Authenticating with User ID

– The users enter their User ID and confirm with AUTHENTICATE.

Illus. Authentication with User ID without PIN

12 Depending on your printer model, the icons and graphical user interface may vary. The display language will be the same as the system language set in the printer.



Thi

nPrin

t G

mbH

201

8

– If a PIN request was set additionally, the users must now enter their PIN and confirm with AUTHENTICATE.

Illus. Authentication with User ID and PIN

Authenticating with NFC card

– Here the users will be prompted to place their NFC cards or tokens near the card reader.

Illus. Authentication with NFC card without PIN

– If a PIN request was set additionally, the users must now enter their PIN and confirm with AUTHENTICATE.

Illus. Authentication with NFC card and PIN

After successful authentication, the list of all print jobs triggered on the workstation appears in the printer display. You can tap to select one, or several print jobs or select all jobs with SELECT ALL.



ThinPrint Gm

bH 2

018

Illus. Personal Printing with Samsung: Print job overview

PRINT: Prints the selected print job/s. These will then be deleted from the list and from the Personal Printing server. A message shows that printing was successful.

Illus. Notification to confirm that printing was successful

PRINT & KEEP: The selected print job, or jobs, are printed, but remain on the list and are available later for further printing.

REFRESH: Refreshes the list of print jobs

DELETE: After selecting one or more print jobs, you can delete them by clicking on DELETE. A security prompt appears before deleting.

DETAILS: Select a print job and click on DETAILS. You will then see the document name, its size and the date it was created.

CANCEL: If print jobs are being printed (PRINT), the current printing process can be stopped with CANCEL.



Thi

nPrin

t G

mbH

201

8

Logging

Personal Printing authentication procedures an print jobs are logged automatically.

– To view or export logs, open the configuration console and select SECURITY→ SYSTEM LOG→ LOG VIEWER.

– To change the log level, select SECURITY→ SYSTEM LOG→ LOG CONFIGURATION.

Illus. selecting SYSTEM LOG

Illus. displaying Personal Printing and other logs

– To export a log, select SECURITY→ SYSTEM LOG→ TASK→ EXPORT.


Configuring Konica Minolta printers©

ThinPrint Gm

bH 2

018

Illus. exporting Personal Printing and other logs

Configuring Konica Minolta printers

The Personal Printing Client for Konica Minolta is not installed directly on the printer, but rather, as a Windows service on a separate computer; this can also be the Per-sonal Printing server. The Windows service sends the Personal Printing Client's code, and it's settings, to the OpenAPI on the printer. There, the Personal Printing Client can be used for authentication at the printer and to display the list of print jobs. The advantage of this solution is that a group of printers can all be configured simultane-ously at a central location.

Generally, communication between printers and the Personal Printing server is achieved via the Windows service of the Personal Printing Clients for Konica Minolta. The Personal Printing server only communicates as the print server for receiving and sending print jobs. It communicates directly with the applications that the jobs are being printed from, and with the printers.

Illus. PIN or NFC card authentication on Konica Minolta printers



Thi

nPrin

t G

mbH

201

8

Installing the Windows service

The Personal Printing Client for Konica Minolta printers can be installed on the fol-lowing systems:

• Windows Server 2008 and later• Windows Vista and later• incl. .NET Framework from version 4.5

All Konica Minolta printers from Open API v4.5 can be used.

1. Download the client software from the ThinPrint web site.

2. On newer systems, cancel the automatic blocking of the file PPKMClient.exe by clicking on UNBLOCK in its file properties. Windows blocks executables down-loaded from the internet or other sources automatically.

Illus. clicking UNBLOCK to cancel the file blocking

3. Copy the client software into a directory on the computer that you want to install onto. The installation uses installutil.exe from .NET Framework; you must therefore specify its directory, such as:

c:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe

4. Open the command prompt, switch to that directory, and run the following com-mand:

installutil.exe -i <drive>:\<install folder>\PPKM-Client.exe




ThinPrint Gm

bH 2

018

Illus. registering the Personal Printing Client for Konica Minolta Printers Windows ser-vice

You will then find the service in the Windows services folder (Illus. 3). It uses AUTO-MATIC start up, but has not yet started.

5. Therefore, start the service manually.

Illus. Personal Printing Client for Konica Minolta installed as a service

Preparing the Konica Minolta printer

Before we can configure the Personal Printing Client, the printer(s) must be made ready to communicate with the Personal Printing Client. To do this, open each printer's web interface and then enter, or check, that the following settings are in place:

in Network→ OpenAPI Setting: – PORT NO. (SSL) = 50003

This is required because the printer app only allows encrypted communication for the OpenAPI. Confirm twice with OK.



Thi

nPrin

t G

mbH

201

8

Illus. a printer's web interface: OpenAPI with SSL-TCP port 50003

in Security→ SSL Setting: – MODE USING SSL/TLS = ADMIN. MODE AND USER MODE

This is also needed for encrypted communication with the Windows service. Confirm twice with OK.

Illus. a printer's web interface: select SSL mode



ThinPrint Gm

bH 2

018

in Security→ External Certificate Setting: – Provide the root certificate of your company's CA (or another issuer's certificate)

for authentication of the Windows service on the printer. Select TRUSTED CA ROOT CERTIFICATE (or one of the other options), and then import the certificate, using the NEW REGISTRATION option. Confirm twice with OK.

Illus. a printer’s web interface: importing a root certificate or another issuer certificate

– in User Auth/Account Track→ Print without Authentication: PRINT WITHOUT AUTHENTICATION = FULL COLOR/BLACK oder BLACK ONLY Otherwise – i.e. if Restrict is selected - the printer wouldn't accept printing jobs from Personal Printing. Confirm twice with OK.

Illus. a printer's web interface: PRINT WITHOUT AUTHENTICATION must be set to Full Color/Black or Black only

Special case Proof-of-concept

For the authentication of the Windows service on the printer within a proof of concept that uses one printer only, instead of importing the root or issuer certificate, you can generate a self-signed certificate for the printer.



Thi

nPrin

t G

mbH

201

8

in Security→ Device Certificate Setting: – To generate a self-signed certificate for the printer, select NEW REGISTRATION.

Illus. a printer's web interface: machine certificates installed

– Then select CREATE AND INSTALL A SELF-SIGNED CERTIFICATE.

Illus. a printer's web interface: generating a self-signed certificate for the printer

– You then export this certificate, using the SETTING (see above). Select EXPORT CERTIFICATE. Confirm twice with OK.

Illus. a printer's web interface: exporting a self-signed certificate for the printer



ThinPrint Gm

bH 2

018

Configuring the Windows service

The configuration console for the Personal Printing Client for Konica Minolta Printers Windows service opens with Start from PPKMClient.exe (without parameters). A shortcut for this purpose is placed on your desktop.

Illus. configuring Personal Printing Client for Konica Minolta

The console for the Windows service contains the following fields:

• PERSONAL PRINTING (Settings that the service requires to communicate with the Personal Printing server)

• SERVICE SETTINGS (Settings that the printer uses to communicate with the ser-vice; the service sends these to the printer beforehand, using REGISTER)

• CREDENTIALS (User names and passwords, with which the service is authenti-cated to the printer)

• USER AUTHENTICATION MODES (Settings for authenticating users to the printer: with NFC card only, with NFC card and PIN or with PIN only and the setting for which number or character groups of the card number should be used)

• PRINTER SETUP (List of Printers – with specific settings, if applicable - to which the service sends all the settings en bloc)



Thi

nPrin

t G

mbH

201

8

PERSONAL PRINTING

Menu item Function

Host name • address of the Personal Printing serverlocalhost, if the service will be installed directly onto the Personal Printing server

Port • TCP port for the service to communicate with the Personal Printing server

80, if the service will be installed directly onto the Per-sonal Printing server443, if USE SSL is enabled

Use SSL enable, if using an https connection to the Personal Printing server; SSL is here for SSL or TLS

Default PIN • is the same for all users and printers• with self-registration: must be the same as the DEFAULT

USER PIN in the console of the Personal Printing server, e.g. 0000

• with manual setup by the admin: must be the same as the USER PIN in the users’ AD configuration on the Personal Printing server

Certificate issuer name (optional)

• name of the root certificate or issuer certificate, if the cer-tificate installed on the Personal Printing server is not one purchased from a public certification authority, but is instead, a web server certificate from your own CA

• must be installed in the certificate store

Delete job after printing

enable, if you wish jobs to be deleted after they have been printed out



ThinPrint Gm

bH 2

018

Illus. Personal-Printing-Client for Konica Minolta configured

SERVICE SETTINGS

Note! Changes in the SERVICE SETTINGS GroupBox require an Unregister/Reg-ister reset, for the settings to be sent to the printers.

Menu item Function

Local IP address address of the Personal Printing Client for Konica Minolta Printers Windows service

Local port TCP port on which the service listens to the communication from the printers (via https)

Certificate file • web server certificate incl. private key(!), that the service sends at the beginning of communication with the respec-tive printer; (file type: .p12 or .pfx)

• must have been issued by the same root or issuer certifi-cate that is stored on the printers

• for a proof of concept, can also be the self-signed certifi-cate of a specific printer

Printer authenti-cation

• optionally, select ENFORCE if the printer should also send it's machine certificate

• must be issued by the same root or issuer certificate that is stored on the printers

• for the specific machine certificate, see CLIENT CERTIFICATE in Printer setup



Thi

nPrin

t G

mbH

201

8

CREDENTIALS

Illus. web configuration for a KM printer: authentication

USER AUTHENTICATION MODES

Menu item Function

Override printer specific settings

• enabled: the passwords, used by the service for authenti-cation at the printers, are the same for all the printers

• disabled: the service uses different passwords for each printer

Administrator password

• printer administrator's password • only required for installation on MFPs

OpenAPI user name

• account for logging on to the printer as a Public User or Registered User

• required if the OpenAPI account was previously set up on the printer

• only required for installation on MFPs

OpenAPI pass-word

password for the OPENAPI USER NAME

Menu item Function

NFC card only • user authentication at the printer with an NFC card or token

• User ID is used for authentication

NFC card + PIN • user authentication at the printer with NFC card or token and PIN entry

• User ID and User PIN used for authentication

PIN only • user authentication at the printer with PIN entry• User ID is used for authentication – not the User PIN



ThinPrint Gm

bH 2

018

Note! Changes in the USER AUTHENTICATION MODES GroupBox require an Unregister/Register reset, for the settings to be sent to the printers.

PRINTER SETUP

First digit of NFC card ID

• the position of the first digit in the user ID (= card number) that should be used for authentication

0 = 1st digit1 = 2nd digit2 = 3rd digit

Number of digits of NFC card ID

• the number of digits from the user ID (= card number) to be used for authentication

Menu item Function

Printer name any name for the Konica Minolta printer

Printer IP address

address of the Konica Minolta printer

Printer SSL the USE SSL option is mandatory

Client certificate • machine certificate that the printer sends to the Windows service, when communication with the printer begins, if PRINTER AUTHENTICATION→ ENFORCE is enabled (file type: .p12 or .pfx)

• must be installed on the printer • should have been issued by the same root or issuer certifi-

cate that is also stored on the printers

Administrator password

• printer administrator's password • only required for installation on MFPs• is only used if the Option Override printer specific settings

is disabled

OpenAPI user name

• account for logging on to the printer as a Public User or Registered User

• required if the OpenAPI account has been previously enabled on the printer

• only required for installation on MFPs• is only used if the Override printer specific settings option

is disabled

Menu item Function



Thi

nPrin

t G

mbH

201

8

Illus. settings for a specific printer; see PRINTER PORT (here) with PORT NUMBER (SSL) in the section Preparing the Konica Minolta printer

Furthermore the console for the Windows service contains the following buttons:

OpenAPI pass-word

password for the OPENAPI USER NAME

Personal Print-ing printer ID

printer ID on the Personal Printing server (Setting up target printers)

Button Function

Search • search for printers (via UPnP protocol)• during the search, the first four fields are preassigned

Add manually add a printer

Remove manually delete a printer

F5 refresh the list of printers

Register • send the client software and/or the client configuration to the printer

• following a successful transfer of data and printer configu-ration, the value in the column CLIENT APP REGISTERED changes from False to True.

Unregister deletes the client configuration from the printer

Menu item Function



ThinPrint Gm

bH 2

018

Authenticating on the Konica Minolta printer

– For sending a print job to the Personal Printing server see the section Authenti-cating on the Lexmark printer.

– When printing, the KM printer’s home screen is used for authentication. To login, the user must hold his or her NFC card or NFC token up to the dedicated reader, located below the display.

Illus. printing with Konica Minolta printers: start screen

After logging in, the following functions are available:

Personal Printing Jobs: The list of print jobs that were printed previously from the desktop's Personal Printer is displayed. The user can tap to select one or more jobs.

SELECT ALL : selects all print jobs

RESET : deselects all selections

LIST UPDATE : updates the printer list

Apply • confirm and complete the configuration • settings are saved in the file PPKMClient.Settings.xml in

the program directory• entries are enabled and the service is restarted • (a manual restart of the Personal Printing Client for Kon-

ica Minolta Printers will do no harm here).

OK • confirm and complete the configuration

Cancel • cancel the configuration

Button Function



Thi

nPrin

t G

mbH

201

8

INFO : displays additional information for each print job

DELETE : deletes all print jobs from the Personal Printing server

START: the printer's regular START button will start the print job.

EXIT: With the EXIT button, the user is logged out, and the Personal Printing Client goes back to the start screen to log in the next user – otherwise he or she will be automatically logged out after 60 seconds.

Illus. printing with Konica Minolta printers: print jobs

82 Manual Options and supplemental information.fm

Licensing©

ThinPrint Gm

bH 2

018

Licensing

In the License Manager, you can find an overview of your licenses. Here, further license keys can be entered.

Illus. Personal Printing license s overview

For further information about ThinPrint Licensing see http://download.cortado.com/docu/EnterprisePortal/WebHelp/en.

Adding Personal PrintersPersonal Printer for Windows machines

The Personal Printer installed and shared on the Personal Printing server (by the installer) is designed for printing from Windows applications (it uses the ThinPrint Output Gateway.

Illus. Personal Printer (here, on the Personal Printing server)

Setting up Personal Printers for Mac and Linux machinesIf you want to use Personal Printing with applications running on non-Windows sys-tems, then create a Personal Printer specifically object for each printer model. Please note that the driver names of these native Personal Printers and those of target print-ers must match exactly. In contrast the Personal Printer’s denomination is arbitrary.

You can use universal drivers to simplify driver installation. The following drivers are recommended:

• Universal Printer Driver for BR-Script (Brother)• Canon Universal Printer Driver

http://download.cortado.com/docu/EnterprisePortal/WebHelp/en

Options and supplemental information.fm Manual 83

Adding Personal Printers©

Thi

nPrin

t G

mbH

201

8

• Dell Open Print Driver• HP LaserJet 5• HP Universal Printing • Universal Print Driver (Konica Minolta) • Kyocera Classic Driver • Lexmark Universal Printer Driver• Driver for Universal Print (Ricoh) • Samsung Universal Print Driver • Xerox Global Print Driver

Example 1: In your company exist three HP Color LaserJet 4700. For these

physical printers you have to create only one single Personal Printer object,

e.g.: Personal Printer HP Color 4700

However if you have also an HP Color LaserJet 9500 in your company

you have to create another Personal Printer object for this purpose, e.g.:

Personal Printer HP Color 9500

Example 2: Alternatively you can use one of the HP Universal Printing drivers

for all four physical HP printers (however only the static mode of this driver is

recommended). Please note that in this case all five printer objects have to

use the same driver, thus also the respective Personal Printer, e.g.: Personal

Printer HP

In detail: – Open the printer’s folder and find out the exact driver names of the printers cre-

ated there, e.g.:• Kyocera FS-C8500DN XPS• OKI C7200

Illus. finding out the exact driver name

– For each driver create a specific Personal Printer using the same driver. Connect this printer to a specific printer port (type: THINPRINT PRINTTOSTORAGE) and share it. See the example in following two screenshots.



ThinPrint Gm

bH 2

018

Illus. selecting ThinPrint PrintToStorage port for each Personal Printer

Illus. Personal Printer created with a native driver

Note! From Windows 2012 R2 type-4 drivers can’t be connected to third-party printer ports anymore. That’s why use type-3 drivers with ThinPrint PrintToStorage Ports.

Illus. example for a type-3 driver, in this example: OKI Universal PCL 5



Thi

nPrin

t G

mbH

201

8

Creating additional printer ports

In case you create additional Personal Printer objects (see Personal Printer for Win-dows machines) maybe that additional printer ports are necessary to increase the print performance by processing multiple print jobs simultaneously.

Note! You can create a specific ThinPrint PrintToStorage port for each Personal Printer in order to separate the print data streams, for example, in case of several print jobs at the same time. However, avoiding the option ENABLE PRINTER POOLING is mandatory!

Illus. ENABLE PRINTER POOLING is not supported by ThinPrint PrintToStorage ports!

– With port creation, select THINPRINT PRINTTOSTORAGE as port type and then NEW PORT.

Illus. adding Personal Printing port: port type ThinPrint PrintToStorage


Font management©

ThinPrint Gm

bH 2

018

– Select PRINT TO PERSONAL PRINTER in the configuration menu of the new port and enter a port name.

Illus. adding Personal Printing port: Select Personal Printer and enter a port name

Font management

To avoid incorrect characters or fonts in print output follow the instructions in the Solving problems with fonts documentation on www.thinprint.com/en→ RESOURCES & SUPPORT→ TECHNICAL INFORMATION.

Changing the language of the print dialogue

The print dialog is displayed for the users in the language that was chosen during the installation of Personal Printing (English or German).This is set using the Windows registry value:

hkey_local_machine\software\ThinPrint\Lang

With Windows multi-language packs this print dialog can be displayed in the display language of the respective user. To do so, the registry value Lang is to be changed from enu, deu, fra or esn to def. This single setting is sufficient if, for instance, each terminal server user is to be shown the Output Gateway print dialogue in the same language as her or his Windows desktop.

If, however, individual users are to be assigned a different language, the following value must be set – within the sessions – to one of the Language abbreviations in the table below:

hkey_current_user\software\ThinPrint\Lang

Chinese, traditional (CHT) Greek (ELL) Portuguese (PTG)

Chinese, simplified (CHS) Hungarian (HUN) Russian (RUS)

https://www.thinprint.com/en/resources-support/guides-manuals/#Technical Information


Storing encrypted print jobs©

Thi

nPrin

t G

mbH

201

8

Illus. Output Gateway’s localization (examples for JPN and ELL)

Storing encrypted print jobs

In general, folders in Windows Explorer can be encrypted. So can the print job folder, including subfolders, in which Personal Printing print jobs are stored. For encryption, you will need certificates that are automatically created by Windows (see Certifi-cates).

1. Mark the print job folder. The relevant path is shown in Personal Printing con-figuration→ DIRECTORY→ PRINT JOB STORAGE, here: C:\\Personal Print-ing Jobs.

Czech (CSY) Italian (ITA) Spanish (ESN)

English, United States (ENU) Japanese (JPN) Swedish (SVE)

French (FRA) Korean (KOR) Thai (THA)

German (DEU) Polish (PLK)



ThinPrint Gm

bH 2

018

2. Highlight the folder and select PROPERTIES in context menu.

Illus. Select the folder to be encrypted

3. In GENERAL tab, click on ADVANCED.

Illus. folder properties: click ADVANCED



Thi

nPrin

t G

mbH

201

8

4. Place a checkmark in ENCRYPT CONTENTS TO SECURE DATA.

Illus. encrypt folder content

5. In the next step, include encryption of subfolders by also applying these settings to subfolders.

6. Then, the encrypted folder with subfolders are shown in another color, if this setting is enabled13.

Illus. folder encryption successfully (colored folder, here: green)

If encryption fails, ensure that the recovery certificate of the administrator (automat-ically created by Windows) is still up to date. It must not be older than three years.

Certificates

While encrypting a folder, a certificate is created automatically for the account that is currently logged in. Here, it is the PPservice account, as an example (see User account for installation).

This certificate can be saved by an export. Read the appropriate Windows docu-mentation, if necessary.

If the account settings for the above mentioned user get lost, you can rely on a recovery agent, to decrypt print data in case of emergency. Per default, the domain administrator account is set as recovery agent. But it is possible to set another account. For details, refer to Windows documentation.

13 Open in Windows Explorer the menu TOOLS→ FOLDER OPTIONS→ VIEW tab. Place a checkmark at SHOW ENCRYPTED OR COMPRESSED NTFS FILES IN COLOR.


Encrypting user data during transmission©

ThinPrint Gm

bH 2

018

Encrypting user data during transmission

For Personal Printing it is possible to encrypt the following connections via https:

1. from a web browser to the Release Station’s web interface.

2. from the Release Station or another authentication device (like printer or smart-phone) to the Personal Printing server. This encryption can be used for:• opening the JobViewer• the authentication at the printer

(Data such as user ID and password are sent from the authentication devices to the Personal Printing Server.)

Creating a web server certificate for the Personal Printing server

If you do not want to purchase a server certificate for the Personal Printing server from a public certification authority (CA), then you can also create this in your Active Directory with your own CA. In this case, however, you must distribute the root cer-tificate and, if applicable, the intermediate certification authority certificate to all computers that are to access the Personal Printing server via https.

– To do this, enable the role ACTIVE DIRECTORY CERTIFICATE SERVICES with the setup type ENTERPRISE on the Active Directory server or on a member server.

– Then switch to the Personal Printing server and open the certificate manage-ment in the MMC.

– Highlight the certificate store CERTIFICATES (LOCAL COMPUTER)→ PERSONAL and select ALL TASKS→ REQUEST NEW CERTIFICATE.

Illus. Personal Printing server: requesting a web server certificate for the local machine



Thi

nPrin

t G

mbH

201

8

– In the ACTIVE DIRECTORY ENROLLMENT POLICY menu, open the properties of the WEB SERVER certificate to be created.

Illus. Personal Printing server: changing the settings of the web server certificate

– With older CA, the web server certificate type may not be displayed by default. In this case, you must first enable it on the certification authority server by opening the template management in the Certification Authority manager ...

Illus. older CA: managing certificate templates

– ... and opening the properties of the Web server template and, on the SECURITY tab, granting the right ENROLL to the AUTHENTICATED USERS group.



ThinPrint Gm

bH 2

018

Illus. older CA: granting the right Enroll to the Authenticated Users group

– Back to the Personal Printing server: In the settings of the WEB SERVER certifi-cate to be created, enter the COMMON NAME and the DNS name in the SUBJECT tab. Both must match the name of the certificate and the server address (this is a requirement of Chrome browsers). In general, this is the FQDN of the web server or Personal Printing server (but also hostname or IP address are possi-ble).

Illus. Personal Printing server: specifying COMMON NAME and DNS name

– On the PRIVATE KEY tab, you can mark the private key of the certificate as export-able (if you do not request the certificate from the target server or if you want to reinstall it later).



Thi

nPrin

t G

mbH

201

8

Illus. Personal Printing server: marking the private key as exportable optionally

– If you have several CAs in your Active Directory, select the AC on the CERTIFICA-TION AUTHORITY tab. You must distribute its root certificate to the authentication devices (see below).

Illus. Personal Printing server: selecting a specific CA

– Finally, select the WEB SERVER certificate type and click ENROLL to install the web server certificate on the local machine. This is automatically stored in the certificate store CERTIFICATES (LOCAL COMPUTER)→ PERSONAL).



ThinPrint Gm

bH 2

018

Illus. Personal Printing server: installing the web server certificate on the local machine

Assigning the web server certificate to the Personal Printing server

In the certificate store CERTIFICATES (LOCAL COMPUTER)→ PERSONAL you need a server certificate issued to the address of the Personal Printing server (see above).

Note! The server certificate must have the same name as the Personal Print-ing server (FQDN, hostname, or IP address). When opening the JobViewer, the address in the browser must then be specified as shown in the column ISSUED BY (see screenshot). For example, if there is an IP address, the Job-Viewer is opened with:

https://192.168.149.75/JobViewer (example)On the Release Station and on Lexmark printers, the URL is specified in this case with:

https://192.168.149.75 (example)On Samsung and Konica Minolta printers, only the IP address will be specified in this case.



Thi

nPrin

t G

mbH

201

8

Illus. server certificate on the Personal Printing server

– Then open the IIS Manager or Internet Information Services Manager (IIS). Select SITES→ DEFAULT WEB SITE→ BINDINGS.

Illus. IIS Manager: selecting Bindings

– Add a new site binding by clicking on ADD.

– In the next window, select from the following:• Type: https• Port: 443• SSL certificate: your web server certificate (created above)



ThinPrint Gm

bH 2

018

Illus. site binding: adding https protocol and selecting the certificate

You will find the new site binding in the overview.

– If only authentication with encryption is required, carry out SITES→ DEFAULT WEB SITE→ SSL SETTINGS additionally.

Illus. encryption settings, if necessary

– Checkmark SSL REQUIRED if authentication can only take place via HTTPS. (If SSL REQUIRED is not enabled, authentication can take place via both HTTP and HTTPS.)



Thi

nPrin

t G

mbH

201

8

Illus. restricting the connection protocol to https, if required

– Finally, restart the IIS service.

Illus. restarting the IIS service of the Personal Printing server

Creating a web server certificate for the Release Station

If you do not want to purchase a server certificate for the Release Station from a pub-lic certification authority (CA), then you can also create this in your Active Directory with your own CA. In this case, however, you must distribute the root certificate and, if applicable, the intermediate certification authority certificate to all computers that are to access the Release Station via https.

– To do this, enable the role ACTIVE DIRECTORY CERTIFICATE SERVICES with the setup type ENTERPRISE on the Active Directory server or on a member server.

– Then open the certificate management in the MMC of a member server (e.g. the Personal Printing server).

– Highlight the certificate store CERTIFICATES (LOCAL COMPUTER)→ PERSONAL and select ALL TASKS→ ADVANCED OPERATIONS→ CREATE CUSTOM REQUEST.



ThinPrint Gm

bH 2

018

Illus. member server: starting the request for the Release Station’s web server certificate

– In the CUSTOM REQUEST menu, select the WEB SERVER template.

Illus. member server: selecting the template for a web server certificate

– With older CA, the web server certificate type may not be displayed by default. In this case, you must first enable it on the certification authority server by opening the template management in the Certification Authority manager ...



Thi

nPrin

t G

mbH

201

8

Illus. older CA: managing certificate templates

– ... opening the properties of the Web server template and, on the SECURITY tab, granting the right ENROLL to the AUTHENTICATED USERS group.

Illus. older CA: granting the right Enroll to the Authenticated Users group

– Back to Member Server: In the CERTIFICATE INFORMATION menu, select DETAILS and then PROPERTIES.



ThinPrint Gm

bH 2

018

Illus. member server: opening the settings of the web server certificate

– In the settings of the WEB SERVER certificate to be created, enter the COMMON NAME and the DNS name in the SUBJECT tab. Both must match the name of the certificate and the computer address (this is a requirement of Chrome brows-ers). In general, this is the FQDN of the web server or Release Station (but also hostname or IP address are possible).

Illus. member server: specifying COMMON NAME and DNS name

– On the PRIVATE KEY tab, mark the private key of the certificate as exportable (to be able to install the certificate on the Release Station later). Confirm with OK, and proceed with NEXT in the CERTIFICATION INFORMATION menu.



Thi

nPrin

t G

mbH

201

8

Illus. member server: marking the private key as exportable

– Save the certificate request as a text file (type .txt or .req).

Illus. member server: saving the certificate request as a text file

– Go to your CA and open the Certification Authority manager.

– There, highlight your CA and select ALL TASKS→ SUBMIT NEW REQUEST.



ThinPrint Gm

bH 2

018

Illus. CA: managing the certificate request

– Select the certificate request you just saved.

Illus. CA: opening the certificate request

– Save the certificate in .cer format.



Thi

nPrin

t G

mbH

201

8

Illus. CA: saving the certificate

– Switch back to the member server where you created the certificate request. Install the newly created certificate in CERTIFICATES (LOCAL COMPUTER)→ PER-SONAL.

– Export the certificate with its key (file format .pfx).

Illus. member server: exporting the Release Station’s web server certificate

– Assign a password when exporting.



ThinPrint Gm

bH 2

018

Illus. member server: securing the certificate’s key with a password

– Switch to the web interface of the Release Station. To import the certificate, select UPLOAD CERTIFICATE in the CERTIFICATES menu.

Illus. Release Station: importing the web server certificate

– Enter the password specified above.

Illus. Release Station: entering the key’s password

– Assign the certificate to the Release Station’s web interface.



Thi

nPrin

t G

mbH

201

8

Illus. Release Station: certificate assigned to the web interface

– To restart the Release Station, select SYSTEM→ REBOOT.

– After installing the root certificate on a workstation (see below), you can open the web interface of the Release Station via https. Select the same address that you used to create the certificate (here: https://releasestation-03).

Illus. workstation: opening the web interface of the Release Station via https (here: using a Chrome browser)

Assigning the web server certificate to the Release Station

See the section Importing certificates.


Editing instructions for self-registration©

ThinPrint Gm

bH 2

018

Installing the root certificate and setting up the server URL on the client side

– If applicable, install Personal Printing server’s root certificate on users’ authen-tication devices and/or the one of the Release Station on workstations (if it is not preinstalled by default) in the TRUSTED ROOT CERTIFICATION AUTHORITIES and/or THIRD-PARTY ROOT CERTIFICATION AUTHORITIES certificate store and, if applicable, the intermediate certificate in INTERMEDIATE CERTIFICATION AUTHORI-TIES. For the Release Station see the section Importing certificates.

– Configure the URL of the Personal Printing server as https address on the authentication devices. See the respective section:• Importing certificates • Configuring smartphone users • Authentication with printers

Editing instructions for self-registration

– To change the content of the page printed during self-registration, log in to the JobViewer as a member of the local PERSONAL PRINTING ADMINISTRATORS group. After the installation of Personal Printing, only the account with which you have installed the software (here: PPService) is included.

Illus. Personal Printing server: local group Personal Printing Administrators


Editing instructions for self-registration©

Thi

nPrin

t G

mbH

201

8

– Then you can edit the text of the self-registration instruction by means of a form.The following buttons are available:

Illus. printout of self-registration instructions

Button Function

UPLOAD YOUR LOGO embed a graphic

SET TO DEFAULT discard all changes


Setting up users manually©

ThinPrint Gm

bH 2

018

Illus. self-registration instructions form (part 1)

Illus. self-registration instructions form (part 2)

Setting up users manuallyIn the Personal Printing configuration, you also can find the domain users who print with Personal Printing, under ACTIVE DIRECTORY USERS AND COMPUTERS→ domain→ USERS.



Thi

nPrin

t G

mbH

201

8

Illus. configuring users for Personal Printing

If you click on a user here, the user configuration will open in AD, where you will find the register PERSONAL PRINTING.

Illus. activating and configuring Personal Printing for users

– First, select ENABLE PERSONAL PRINTING for the nominated user.

Then, the authentication methods that you have previously set under server settings will be offered. If there is a method missing for a user, it must first be activated in the server settings. Only methods selected there are available here for the users.



ThinPrint Gm

bH 2

018

Card with preset ID To set up authentication using NFC cards, you can read more in the respective sec-tion:

• Authentication using Release Station

• Authentication using ThinPrint Clients in printers

Scan barcode using smartphone

To set up authentication using smartphone, select SCAN BARCODE USING SMARTPHONE. You can read more in the section Configuring smartphone users.

Disable Personal Printing account temporarily

All the settings are preserved, but the user can (temporarily) not use Personal Print-ing.

Configure multiple users simultane-ously (all authenti-cation methods)

Alternatively, you can configure multiple users at the same time from the command prompt. This is especially useful for a large number of users.

To do so, open the command line on the Personal Printing server as an adminis-trator. Then specify the path where the files for Personal Printing have been saved.

For example: C:\Program Files\Personal Printing

Then enter the following to show the command line parameters for configuring mul-tiple users:

rundll32 TPFMExt.dll UserConfig -help

Illus. configuring multiple users for Personal Printing: open command prompt

A window opens with all commands required to configure multiple users. Use a script to simultaneously configure multiple users.


Personal Printing, ThinPrint Engine and Tracking©

Thi

nPrin

t G

mbH

201

8

Illus. configuring multiple users: command overview

Personal Printing, ThinPrint Engine and Tracking

If you use Personal Printing either together with Tracking Service (included in Per-sonal Printing) or with ThinPrint Engine (not included), please note the following instructions.

Order of installa-tion

It is recommended that you install each of the Personal Printing, Tracking Report Engine, ThinPrint Engine, and ThinPrint License Server components on separate servers. Two exceptions are the combinations:

• ThinPrint Engine + Personal Printing• License Server + ThinPrint Engine

So if you want to install Personal Printing on a print server together with the ThinPrint Engine, please follow the following sequence:

1. ThinPrint Engine 2. Personal Printing

Note! The Tracking Report Engine must not be installed together with Per-sonal Printing, ThinPrint Engine or License Server on the same computer. To do this, use a separate web server.

Enabling service account for printing

Since version 10, the ThinPrint Engine is equipped with a license server. If ThinPrint is used additionally, the service account which is to be created for Personal Printing


Print job tracking©

ThinPrint Gm

bH 2

018

installation and configuration (see User account for installation) must be enabled for printing on the License Server.

Illus. Personal Printing’s service account on the License Server

Print job trackingThe ThinPrint Tracking option allows you to oversee your print volume: How many printers are overloaded? Which are hardly used? How many color or black&white printouts are printed on a daily basis? What are the resulting costs?

How it works

The print data of ThinPrint Ports is compiled by the server and transferred into an SQL database. From there, they can be graphically presented as a website using the Tracking Report Engine, which also allows for many other settings, such as querying print volumes for a certain branch during a certain time period. Authorized individu-als can access the website from anywhere.

Print job tracking has the following components:

• ThinPrint Engine or Personal Printingsends data to the ThinPrint Tracking Service

• ThinPrint Tracking Service receives data and writes it to an SQL database

• ThinPrint Tracking Report Engine web component for clear analysis, summary, and graphic report of tracking results



Thi

nPrin

t G

mbH

201

8

Illus. Example for using ThinPrint Tracking

Tracking is part of the following ThinPrint products:

• ThinPrint Engine with a ThinPrint Engine Premium licenseor• Personal Printing

If not yet installed, an SQL server must be installed to enable use of the tracking fea-ture within the ThinPrint Engine. This program is not included in the ThinPrint Engine software.

Tracking Service

You can gather information about the print jobs sent with the ThinPrint Engine for your statistics (tracking). To do so, you must set up a Microsoft SQL server. The Thin-Print Engine sends its tracking data to the server that has the tracking service installed. Print data which can be analyzed and displayed by Tracking Report Engine are:

• Author of a print job (user/group)• Printer used• Settings used• Number of pages printed• Information on any errors• Costs• Compression rates (ThinPrint Engine only)• Print duration• Print data during a defined period

The SQL server can collect print data from different sources – from ThinPrint Engines on application or print servers or from Personal Printing servers.

Tracking Report Engine

ThinPrint Tracking includes a web application for viewing the tracking data. This pro-gram represents the SQL data graphically in its web interface – installed on a web



ThinPrint Gm

bH 2

018

server. The tracking data can therefore be analyzed from the web browser on any workstation.

Illus. Analyzing SQL data in a web browser (example)

Technical requirements

Your architecture must meet the following requirements for running ThinPrint Track-ing:

• The SQL server additionally requires: • Microsoft SQL Server 2005 Express and later

• The ThinPrint Tracking Report Engine can be run on the following servers (as a web server):• Windows Server 2012 R2• Windows Server 2012• Windows Server 2008 R2 SP1

Note! The Tracking Report Engine must not be installed together with Per-sonal Printing, ThinPrint Engine or License Server on the same computer. To do this, use a separate web server.



Thi

nPrin

t G

mbH

201

8

The following is required:• Microsoft .NET Framework 3.5 SP 1• ASP .NET (can be enabled as a Windows component or installed as a part of

the .NET Framework)• Internet Information Services (IIS) 5.1 or later. Port 80 is used by default. Do

not change this port number and make sure that no other programs are using this port.

Administrator permissions are required for all installation and configuration proce-dures.

Please note with ThinPrint Tracking, that data printed via a ThinPrint Port is col-lected.

Installation of Tracking Database

– Open SETUP.EXE onto the SQL server.

– Select the desired language. InstallShield Wizard opens. Click Next.

Illus. Start InstallShield Wizard

– Select the SQL server, on which you wish to install Tracking database. Then specify how do you wish to access the database (bottom arrow):• Windows authentication or• SQL server authenticationConfirm with NEXT.



ThinPrint Gm

bH 2

018

Illus. Choose Database server and authentication to SQL server

– Choose a name for the database in which the information about print jobs will be stored: PRINTJOBTRACKING for example (top arrow).

– In case of a software update, you can select an existing database by clicking on the button BROWSE.

Illus. Choose database server and Authentication mode

Selecting authentication mode

By choosing the authentication mode, you have defined how Report Engine admin-istrators and the tracking service access the data.

SQL server Authen-tication

– Create an account with administration permissions, TRACKINGSERVICE for exam-ple. Or specify an existing one.

– Note the user name and password. Confirm with NEXT and close InstallShield Wizard with FINISH.



Thi

nPrin

t G

mbH

201

8

Illus. Create administrator account for the Database

Windows authenti-cation

If you choose Windows Authentication, all users and servers need to be members of the same domain. Users can log on with their user name and their domain password.

– Choose WINDOWS AUTHENTICATION and confirm with NEXT.

Illus. Choose Windows authentication mode

– You can select user groups from the Active Directory which should be able to access Tracking Database. For this, click ADVANCED.



ThinPrint Gm

bH 2

018

Illus. Inherit groups from Active Directory

During installation of Tracking database, Tracking database administrators with read and write permissions will be created, as well as users with read permissions only.

Illus. Define administrator groups and user groups

– Finally, conclude Tracking database installation in InstallShield Wizard with INSTALL and FINISH.

Manage Tracking database

– Open a management tool for the database, as for example Microsoft SQL Server Management Studio Express14. With this tool, you can administer the database created by the installer.

14 Can be downloaded from the Microsoft website for free (www.microsoft.com, note system requirements)

http://www.microsoft.com/en-us/download/details.aspx?id=8961



Thi

nPrin

t G

mbH

201

8

Illus. Database (here: PrintJobTracking)

With SQL authenti-cation

When you install Tracking database with SQL authentication, a user account will be created with read permissions on the database. This name of the user account will be TRACKINGUSER, and the password is: THINPRINT-1.

– To access the SQL server remotely, open SQL Server Manager and enable the protocols NAMED PIPES and TCP/IP. Then start the SQL SERVER BROWSER in the services folder.

,

Illus. Enable protocols



ThinPrint Gm

bH 2

018

With Windows authentication

– To ensure the Tracking Service gets access to the SQL server, open Management Studio Express and enter with a right click in the FOLDER SECURITY on NEW and LOGIN.

Illus. Install access for Tracking Service on the SQL server

– Create a new account according to this sample:<domain>\<Server name of Tracking Service>$Here: mydomain\ps13$

Illus. Install login for Tracking Service

– Put a checkmark at the database, which is configured for Tracking, here: PRINT-JOBTRACKING (arrow above) and a checkmark at TREADMIN (lower arrow).



Thi

nPrin

t G

mbH

201

8

Illus. User mapping

Then Tracking Service can access the database with Windows authentication.

Installing the Tracking Report Engine

Please consider that Tracking Report Engine cannot be installed on Windows 2003 x64 machines. Make sure that the following Windows components are installed and started: IIS and ASP.NET.

Note! The Tracking Report Engine must not be installed together with Personal Printing or ThinPrint Engine on the same server. On this, use a sep-arate web server.

– Copy SETUP.EXE of Tracking Report Engine onto the web server and open it. Select the desired language and confirm with OK. InstallShield Wizard opens.

– Select the database server on which Tracking Database has been installed (arrow above). Then select the same authentication mode which you have selected during Tracking database installation, here SQL SERVER AUTHENTICA-



ThinPrint Gm

bH 2

018

TION (middle arrow). Finally, indicate the database which has been created by Tracking database installer, here: PRINTJOBTRACKING, (lower arrow). Confirm with NEXT.

Illus. Choose database and authentication mode

– Here, select the authentication mode with which Tracking Report Engine estab-lishes a connection to Tracking Database. Confirm with NEXT and close Install-Shield Wizard with FINISH.

Illus. Choose authentication mode

Analyzing tracking dataPreparing Personal Printing server and Tracking Service

Install the Tracking Database on an SQL server and the Tracking Report Engine on a separate web server, as described in the sections Installation of Tracking Database and Installing the Tracking Report Engine.

To prepare the Personal Printing server for sending data of sent print jobs to the Tracking Service, you must make the following changes to the configuration of the Personal Printing server:

– In the Personal Printing configuration, go to EDIT SETTINGS.



Thi

nPrin

t G

mbH

201

8


– Select the TRACKING tab and enter the following settings:• ENABLE TRACKING • SQL server’s address and name • SQL server or Windows authentication:

an account (specified with Tracking Database installer) which has write per-missions for your database

• Encryption settings if the data are to sent encrypted to the SQL server• Name of the Tracking database (created using its installer)

Illus. Selecting TRACKING settings



ThinPrint Gm

bH 2

018

The result is shown in the following screenshot.

Illus. Print job tracking enabled (Personal Printing configuration)

Use of Report Engine

The ThinPrint Tracking Report Engine makes it possible to display data from the SQL database as an overview in a web browser. All significant information on print jobs can be summarized by various criteria, sorted, and graphically displayed.

You can analyze the data with the included Tracking Report Engine, or any other tool, to retrieve the database.

– To analyze the tracking data, start your web browser and open the website of the server that ThinPrint Tracking Report Engine is installed on:

http://<webserver>/tracking Example:

http://ps13/tracking

– Enter the account created on the SQL server (here: TRACKINGSERVICE) which has write permissions for the database (here: PRINTJOBTRACKING).

Illus. Open the Tracking Report Engine in a web browser



Thi

nPrin

t G

mbH

201

8

Overview The page OVERVIEW appears . You see the following information for analysis:• Number of print jobs

• Color and b/w (grayscale)• Simplex and duplex

• Paper consumption• Color and b/w (grayscale)• Simplex and duplex

You can also specify the information as follows:

Illus. Overview of number of printouts and paper usage

Function Description

Group Choice between a specific or all user groups (see Managing Groups)

Printer Choice between a specific or all printers

Start Start of a report period (display and input)

End End of a report period (display and input)

Predefined Choice of a report period



ThinPrint Gm

bH 2

018

Distribution The DISTRIBUTION page allows analysis of which users, groups, or printers have printed the most. You can specify the information as follows:

CATEGORY Description

Print Jobs Number of print jobs

Costs Print costs for the number of pages printed by the respec-tive selection (group(s) or users), taking into account printer-specific costs per page

Paper Consumption Number of sheets used for printing

Simplex Number of pages printed one-sided

Duplex Number of pages printed on both sides

Black/White Number of pages printed in black-and-white

Color Number of pages printed in color

Errors Number of failed print jobs

Group Choice between a specific or all user groups (see Managing Groups)

Printer Choice between a specific or all printers

Start Start of a report period (display and input)

End End of a report period (display and input)

Predefined Choice of a report periods



Thi

nPrin

t G

mbH

201

8

Illus. Ranking

Trend The TREND page gives an overview of how the frequency of printing has developed across a set timeframe. Additionally you have the option to display compression rates of print jobs, when printing with a ThinPrint Engine.



ThinPrint Gm

bH 2

018

Illus. Displaying trends (here, number of print jobs)

Managing Groups On the MANAGE GROUPS page you can define user groups to make the previous pages easier to read.

Illus. Defining user groups

Note! To do this, you have to use the Internet Explorer browser on the same web server on which the Tracking Report Engine was installed. (It is not pos-sible, in this situation, to gain remote access from just any computer.)

– To do so, click the button IMPORT A GROUP FROM ACTIVE DIRECTORY.

– Then click ADVANCED.

Illus. User import from Active Directory

– Click FIND NOW (top arrow).



Thi

nPrin

t G

mbH

201

8

– Groups are displayed. Checkmark the desired group (bottom arrow) and confirm with OK.

Illus. Select group from Active Directory

The selected group will be displayed with the included users. Include each user in one group only to avoid possible corruption of the general overviews. Users can be arranged or redirected in any groups.

Note that users will only appear here after they have printed at least once or have been imported from an Active Directory group.

Costs On the COSTS page you can define costs to analyze the financial effects of printing. Given values are the estimated values of toner and paper consumption. Because these costs can vary greatly for different printers and types of printouts, ThinPrint rec-ommends changing the default values to reflect your individual factors.

To do so, select a PRINTER and enter its average costs.


Currency Enter a currency (three characters)

Printer Select printer or change template (= default value)

New Paper Size Define additional paper formats

Save Settings Save cost values for b/w and color for the template or the selected printer



ThinPrint Gm

bH 2

018

Illus. Settings for estimated costs

SQL databaseSQL server man-agement tools

In addition to the ThinPrint Tracking Report Engine, you can also use management tools for directly accessing the SQL database, such as Microsoft SQL Server Manage-ment Studio Express15. This has the advantage that you can both create a database and analyze all data stored in the database.

Delete Delete paper format

Apply Apply the same settings for other printers (multiple selection with Ctrl and Shift keys)


15 Can be downloaded from the Microsoft website for free (www.microsoft.com, note system requirements)

http://www.microsoft.com/en-us/download/details.aspx?id=8961



Thi

nPrin

t G

mbH

201

8

Illus. Microsoft SQL Server Management Studio Express

Tracking data If printer drivers and applications in use on the source computer16 provide certain values and the specific version of ThinPrint Engine (or Personal Printing) also sup-ports them, the following information can be sent with each print job to the ThinPrint Tracking Service, which will write it to the SQL database:

16 The computer creating the print jobs that ThinPrint Engine sends to the ThinPrint Tracking Ser-vice

Value in the database

MeaningSupported by Output Gateway

MachineName IP address of the source computer (e.g., 192.168.131.30) √

DriverName printer driver ID

DestName host name of the target computer (e.g., client-22) √

ServerName host name of the source computer (e.g., server-03) √

PrinterName name of the printer on the source computer (e.g., HP LaserJet 4#client-22:6)

√

ID ID in the SQL database

UserName name of the person who printed (= Account) √

Orientation paper orientation (portrait or landscape) √

PaperSize paper format (e.g., A4, Letter, Executive) √



ThinPrint Gm

bH 2

018

PaperLength paper length (cm) For user defined paper formats, otherwise value = 0PaperWidth paper width (cm)

Copies number of copies √

DefaultSource default paper source √

PrintQuality printout quality (maximum value of XRes and YRes; e.g., 600 dpi) or quality level (e.g., fine)

√

Color color or grayscale (b/w) √

Duplex double-sided or single-sided (duplex or simplex) √

XRes horizontal resolution (dpi)

YRes vertical resolution (dpi)

TTOption TrueType fonts embedded in the file as bitmap, as soft font, or outline or information about what printer font is to be replaced sent to the printer

√

dmCollate sorting option; e.g. print longer documents consecutively depending on the application

FormName name of the paper format √

JobID print job ID √

Status values:1 = Print job delivered2 = Successfully printed3 = Print job canceled

√

ClientID client ID

Pages number of printed pages √

TStamp time of print job (start of communication between ThinPrint Engine and ThinPrint Tracking Service)

√

Duration time (in ms) between start of sending a print job by the Thin-Print Engine (= TStamp) and end of transmission

√

DevMode device mode Data as blob (binary large object)

PrintType format of print datavalues: m = EMF; r = RAW

√

JobSize print job size (uncompressed) in Byte √




Troubleshooting©

Thi

nPrin

t G

mbH

201

8

TroubleshootingLogging

Logging the REST interface PPRest

The logging of the REST interface captures the entire communication of the Personal Printing server, such as the access to the JobViewer and the connections from the authentication devices.

JobTSize print job size (compressed) in Byte √

Compression-Rate

computed by dividing JobTSize by JobSize (with ThinPrint Engine only)

√

DocumentName name of the document √




Troubleshooting©

ThinPrint Gm

bH 2

018

– Open the file NLog.config in C:\inetpub\wwwroot\PPRest. Make the orange highlighted supplements:

<?xml version="1.0" encoding="utf-8" ?><nlog xmlns="http://www.nlog-project.org/sche-mas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" autoReload="true"> <extensions> <add assembly="NLog.Web.AspNetCore"/> </extensions> <targets> <target xsi:type="File" name="all-log-file" file-Name="C:\Temp\PPRest-all-${shortdate}.log" lay-out="${longdate}|${logger}|${upper-case:${level}}|${message}|${exception}" /> <target xsi:type="File" name="own-log-file" file-Name="C:\Temp\PPRest-own-${shortdate}.log" lay-out="${longdate}|${logger}|${upper-case:${level}}|${message}|${exception}" /> </targets> <rules> <logger name="*" minlevel="Trace" writeTo="all-log-file" /> <logger name="Microsoft.*" maxLevel="Info" final="true" /> <logger name="*" minlevel="Trace" writeTo="own-log-file" /> </rules></nlog>

Then you get two log files in c:\temp:

• PPRest-all-yyyy-mm-dd.log logs everything

• PPRest-own-yyyy-mm-dd.log logs everything except Windows messages

Note! Enabling logs will affect the performance. So, disable logging if no lon-ger needed.

Logging the Reg-Print module

The logging of the RegPrint module only records the sending of the self-registration instructions to the printer selected by a user.


Troubleshooting©

Thi

nPrin

t G

mbH

201

8

– Copy the file NLog.config from C:\inetpub\wwwroot\PPRest to Personal Print-ing’s program directory (e.g., C:\Program Files\Personal Printing). Make the red highlighted changes:

<?xml version="1.0" encoding="utf-8" ?><nlog xmlns="http://www.nlog-project.org/sche-mas/NLog.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" autoReload="true"> <extensions> <add assembly="NLog.Web.AspNetCore"/> </extensions> <targets> <target xsi:type="File" name="all-log-file" file-Name="C:\Temp\PPReg-all-${shortdate}.log" lay-out="${longdate}|${logger}|${upper-case:${level}}|${message}|${exception}" /> <target xsi:type="File" name="own-log-file" file-Name="C:\Temp\PPReg-own-${shortdate}.log" lay-out="${longdate}|${logger}|${upper-case:${level}}|${message}|${exception}" /> </targets> <rules> <logger name="*" minlevel="Trace" writeTo="all-log-file" /> <logger name="Microsoft.*" maxLevel="Info" final="true" /> <logger name="*" minlevel="Trace" writeTo="own-log-file" /> </rules></nlog>

Then you get two log files in c:\temp:

• PPReg-all-yyyy-mm-dd.log logs everything

• PPReg-own-yyyy-mm-dd.log logs everything except Windows messages

Note! Enabling logs will affect the performance. So, disable logging if no lon-ger needed.


Troubleshooting©

ThinPrint Gm

bH 2

018

Website log The processes of the web interface are logged by default. The log files can be found in:

%SystemDrive%\inetpub\logs\LogFiles

– You can change the path or disable logging. To do this, in IIS Manager select: DEFAULT WEB SITE→ LOGGING.

Illus. IIS Manager: path to the IIS log file and DISABLE option

Solving issues

The table below lists some messages and gives suggestions for solving the problem.

Message/Problem Suggested solution

When installing Personal Printing the following message appears: “The installation of Microsoft .NET Frame-work 4.6 Full has failed. Setup will now exit.”

• Run a Windows update, and then restart the installation.

You or your users can’t connect to the JobViewer. Depending on the browser, they receive an error mes-sage like this: “Hmm, we can’t reach this page.”

• You may have tried to connect the JobViewer via https even though the encryption certificates have not yet been installed and configured.→ See Encrypting user data during transmis-sion.


Troubleshooting©

Thi

nPrin

t G

mbH

201

8

You can open the JobViewer or the Release Stations web console via http, but not via https.

• Does the requested URL match the name of the server certifi-cate installed on the web server (host name, FQDN, or IP address)? If host name or FQDN is used, does name resolution work on the network?

• Has a server certificate (with key) been installed on the web server, and – in case of Personal Printing server: Has this been selected in BINDINGS in IIS Manager (and then the IIS service was restarted)?

• Is the issuer root certificate installed on the workstation (from which the web page is to be opened) in the TRUSTED ROOT CERTIFICATION AUTHORITIES store and/or in the THIRD-PARTY ROOT CERTIFICATION AUTHORITIES store and, if applicable, the intermediate certificate in the INTERMEDIATE CERTIFICATION AUTHORITIES store?

• If the error occurs only with the Chrome browser or a based on it (like Vivaldi), then you may need other certificates on the workstation. See Creating a web server certificate for the Per-sonal Printing server or Creating a web server certificate for the Release Station.

• If the error only occurs with the Firefox browser, then you may also have to import the root certificate directly into Firefox on the workstation (OPTIONS→ PRIVACY & SECURITY→ CERTIFI-CATES→ VIEW CERTIFICATES→ AUTHORITIES→ IMPORT).

• See also Encrypting user data during transmission.

Although users can open the Job-Viewer, the displayed information is not updated.

• Presumably, the users in question use the classic Internet Explorer.→ Recommend a different web browser, e.g. Edge, Chrome or Firefox.

Authentication on the printer works via http, but not via https. For this you have configured the URL of the Personal Printing server in the authentication device first with http and then with https.

• Does the requested URL match the name of the server certifi-cate installed on the Personal Printing server (host name, FQDN, or IP address)? If host name or FQDN is used, does name resolution work on the network?

• Has a server certificate (with key) been installed on the Per-sonal Printing server, and has this been selected in BINDINGS in IIS Manager (and then the IIS service was restarted)?

• Is the issuer root certificate and/or intermediate certificate installed in the respective authentication device?

• See Encrypting user data during transmission.



Troubleshooting©

ThinPrint Gm

bH 2

018

Illus. example for a type-3 driver, in this example: OKI Universal PCL 5

You can’t create a Personal Printer with a native printer driver. Depend-ing on the Windows version, you receive an error message like this: “Unable to install printer. Double check the printer name and make sure that the printer is connected to the network.”

• You may have tried to connect a printer with a type-4 driver to a third party port, such as the THINPRINT PRINTTOSTORAGE port.→ Use type-3 drivers for printer objects to connect to a THINPRINT PRINTTOSTORAGE port (see the screenshot below) – preferably universal drivers of the printer manufacturers.

When trying to print the error mes-sage “An error occurred while spool-ing the print job: %d” appears.

There are two known constellations:• You have set up a share on a remote print server as the target

printer. The target printer uses a printer driver that is not installed on the Personal Printing server → Install this driver manually, not using point&print.

• You have set up a share on a remote print server as the target printer. The target printer uses a printer driver that you have transferred to the Personal Printing server via point&print. In addition, the option RENDER PRINT JOBS ON CLIENT COMPUTERS (alias CLIENT-SIDE RENDERING) is enabled for this printer on the print server (see the screenshot below).→ Disable the RENDER PRINT JOBS ON CLIENT COMPUTERS option or install this driver on the Personal Printing server manually.



Unattended installation©

Thi

nPrin

t G

mbH

201

8

Illus. RENDER PRINT JOBS ON CLIENT COMPUTERS option

Unattended installation

Unattended installation of Personal Printing is also possible. The following parameter will be supported:

• LANG• FORCELANG• INSTALLDIR• TARGETDIR

also the following language IDs:

• 1031 • 1033 • 1034 • 1036

Updating Personal Printing

If you want to update Personal Printing 3.1 to version 4.0, simply install version 4.0 using the setup routine. The old version will then be updated automatically. Your set-tings will be retained. For Personal Printing Essentials 2.0 or Personal Printing 3.0, uninstall the old version before installing Personal Printing 4.0.

The server in question must have an up-to-date status of Windows updates.

https://download.cortado.com/docu/ThinPrint/WebHelp/en/ThinPrint_docu/Unattended_Installation_of_ThinPrint_Engine_components/Products_and_components.htm


Uninstalling Personal Printing©

ThinPrint Gm

bH 2

018

Note! Note that you run the update with the same administrator (account) that you used to both install version 3.1 and perform the configuration, other-wise you might have problems accessing ADAM (or AD-LDS). This information can be found in the local Personal Printing Administrators group.

Illus. user account used for installation in the local Personal Printing Administrators group (here: ourdomain\PPService)

If several PrintToStorage ports were installed before the update, they must be created again (because only one is left after the update).

If the Tracking option has been eingeschaltet before the update, it may need to be re-enabled after updating Personal Printing.

Uninstalling Personal Printing

– Log in to the Personal Printing server as an administrator, e.g. using the PPser-vice user account (see User account for installation).

– Uninstall all Personal Printers with native drivers or connect them to other (con-ventional) printer ports.

– Uninstall the following Personal Printing components in this order:• Cortado License Manager• AD LDS Instance THINPRINT • ThinPrint Personal Printing


Acronyms and abbreviations©

Thi

nPrin

t G

mbH

201

8

Illus. Components of Personal Printing to be uninstalled

Acronyms and abbreviations

AD Active Directory

ADAM Active Directory Application Mode – Microsoft; see (AD) LDS

ASP Active Server Pages (Microsoft)

CA certification authority

dpi dots per inch

EMV Enhanced Metafile

FQDN Fully Qualified Domain Name

ID Identification (number)

IIS Internet Information Service

KM Konica Minolta

LDAP Lightweight Directory Access Protocol

(AD) LDS Lightweight Directory Service; formerly ADAM

LPD Line Printer Daemon

LPR Line Printer Remote

Mac OS Operating system of Apple MacIntosh


Acronyms and abbreviations©

ThinPrint Gm

bH 2

018

MMC Microsoft Management Console

NFC Near Field Communication

Output Gateway ThinPrint Output Gateway

OS Operating System

PCL Printer Command Language

PIN Personal Identification Number

QR Quick Response

RFID Radio-Frequency Identification

SMTP Simple Mail Transfer Protocol

SQL Structured Query Language

SSL Secure Socket Layer, actually TLS(SSL is an outdated encryption protocol)

TCP/IP Transmission Control Protocol/Internet Protocol

TLS Transport Layer Security (the current encryption protocol)

TP ThinPrint

UPN User Principal Name (AD account)

URL Uniform Resource Locator (web address)

USB Universal Serial Bus

VM virtual machine

WAN Wide Area Network

2D two-dimensional

personal printing (english) - cortado

Documents