[Samba] Need help getting colour printing features restricted to a specific group

[Gary Greene]

I¹ve got a Ricoh multi-function printer/copier that I need to restrict the
colour printing functions to only members of the @ColorPrinting group. I¹ve
two print queues for the Ricoh, one colour, one not. Unfortunately, even
users on the B&W queue can change the colour settings on the print dialog in
Windows and bypass the restriction and prints in colour.

Part of this likely is our CUPS configuration in tandem to our Samba
configuration. I¹d appreciate it if someone knowledgeable about printing
with CUPS over Samba can help get this resolved. Our CUPS configuration can
be made available if we need it. Our Samba configuration follows:

[global]
        workgroup = MINERVANETWORKS
        server string = ""
        printing = cups
        printcap name = cups
        printcap cache time = 120
        load printers = yes
        cups options = raw
        map to guest = Bad User
        include = /etc/samba/dhcp.conf
        log level = 3 printdrivers:10
        logon path = \\%L\profiles\.msprofile
        logon home = \\%L\%U\.9xprofile
        logon drive = P:
        usershare allow guests = No
        idmap gid = 10000-20000
        idmap uid = 10000-20000
        realm = MINERVANETWORKS.COM
        security = ADS
        template homedir = /home/%D/%U
        template shell = /bin/bash
        usershare max shares = 100
        winbind use default domain = yes
        winbind offline logon = yes
        winbind refresh tickets = yes
        add machine script = /usr/sbin/useradd  -c Machine -d
/var/lib/nobody -s /bin/false %m$
        domain logons = No
        domain master = No
        passdb backend = smbpasswd
        wins support = No
        wins server = 10.5.1.12 10.6.1.55 10.6.1.110
[printers]
        comment = All Printers
        path = /var/spool/samba
        browseable = yes
        guest ok = no
        writable = no
        printable = yes
        printer admin = root, @ntadmins, @smbprintadm
        use client driver = yes

[homes]
        comment = Home Directories
        valid users = %S, %D%w%S
        browseable = No
        read only = No

[hp_business_inkjet_2250_ps]
        comment = HP Business InkJet 2250
        path = /var/spool/samba
        printable = Yes
        browseable = Yes
        guest ok = No
        writable = No
        create mode = 0700
        print command = lpr-cups -P %p -o raw %s -r
        use client driver = yes
        create mask = 0700
        read only = Yes

[hp_designjet_800_ps]
        comment = HP DesignJet 800
        path = /var/spool/samba
        printable = Yes
        browseable = Yes
        guest ok = No
        writable = No
        create mode = 0700
        print command = lpr-cups -P %p -o raw %s -r
        use client driver = yes
        create mask = 0700
        read only = Yes

[hp_laserjet_2100]
        comment = HP LaserJet 2100
        path = /var/spool/samba
        printable = Yes
        browseable = Yes
        guest ok = No
        writable = No
        create mode = 0700
        print command = lpr-cups -P %p -o raw %s -r
        use client driver = yes
        create mask = 0700
        read only = Yes

[hp_laserjet_4050_series_ps]
        comment = HP LaserJet 4050
        path = /var/spool/samba
        printable = Yes
        browseable = Yes
        guest ok = No
        writable = No
        create mode = 0700
        print command = lpr-cups -P %p -o raw %s -r
        use client driver = yes
        create mask = 0700
        read only = Yes

[ricoh_aficio_mp_c4500]
        comment = RICOH Aficio MP C4500
        path = /var/spool/samba
        printable = Yes
        browseable = Yes
        guest ok = Yes
        writable = No
        create mode = 0700
        print command = lpr-cups -P %p -o %s -r
        use client driver = yes
        create mask = 0700
        read only = Yes
        printer admin = @"Domain Admins"

[ricoh_aficio_mp_c4500_color]
        comment = RICOH Aficio MP C4500 Color
        path = /var/spool/samba
        printable = Yes
        browseable = Yes
        guest ok = No
        writable = No
        create mode = 0700
        print command = lpr-cups -P %p -o raw %s -r
        use client driver = yes
        create mask = 0700
        read only = Yes
        printer admin = @"Domain Admins"
        read list = @ColorPrinter

[print$]
        comment = Printer Drivers
        path = /var/lib/samba/drivers
        write list = @"Domain Admins", root, @smbprintadm
        browsable = yes
        guest ok = yes
        browseable = yes

[scans]
        browseable = Yes
        comment = Public scans directory for the RICOH
        guest ok = Yes
        inherit acls = Yes
        path = /srv/samba/Scans/
        read only = No


-- 
Gary L. Greene, Jr.
Sr. Systems Administrator
IT Operations, Minerva Networks Inc.
Cell: (650) 704-6633