Prevent users from bypassing PaperCut

“Help! I’m a Systems Administrator and PaperCut customer and our organization is serious about tracking print jobs and preventing unauthorized printing. What tools do we have to restrict access to printing and ensure that all print jobs are properly funnelled through PaperCut?”

Whether you’re using PaperCut NG or MF (on-premise) or PaperCut Hive or Pocket (cloud-native), all print jobs should go through PaperCut to be tracked, controlled, and accounted for. But there are a few ways users might accidentally — or deliberately — bypass that.

This article outlines how print jobs can sneak past and what you can do to prevent them. Some of the recommendations apply to both product families, while others are specific to either NG/MF or Hive and Pocket. We’ll point that out as we go.

Disable or physically block printing from USB Ports

Whether you’re using NG/MF or Pocket and Hive, you might need to find a way to stop users from printing via a USB stick.

We’ve seen photos where schools have literally hot-glued these ports shut. We’re not sure we can recommend this, even if you own the printer and don’t plan on reselling it. There’s just something not right about this.

Thankfully, there are better methods:

• Disable USB printing in the printer’s firmware. Check the manufacturer’s documentation for the exact steps.
• Physically block access with USB port locks or blockers (available to buy in bulk online).

Disable protocols like WSD, Bluetooth, and AirPrint (Bonjour)

This applies to PaperCut NG/MF as well as Pocket and Hive

WSD, Bonjour/AirPrint, and Bluetooth are designed to make it easy for users to discover printers on local networks.

The downside is that these protocols let users discover and connect to printers directly, bypassing PaperCut tracking. They can also create confusion: users may find a printer on one network (like wired Ethernet), but lose access when they switch to another (like Wi-Fi).

To reduce these risks:

• Disable WSD, AirPrint/Bonjour, and Bluetooth at the printer level. Check the manufacturer’s documentation for the exact steps.
• Separate users and printers onto different VLANs/subnets to reduce accidental discovery

As an example, here’s where to disable WSD and Bonjour in a Ricoh copier’s web interface:

Move the printers to a separate network

This option works best when print jobs are routed through a print server (NG/MF) or a super node (Pocket and Hive).

One way to stop users from connecting directly to printers is to place those printers on a separate VLAN or subnet. This lets your network team control who can talk to the printers—and who can’t.

For example, you could:

• Set up a dedicated VLAN just for printers
• Use firewall rules to block users from reaching printer IPs or ports directly
• Allow traffic only from trusted devices like your print server or super node

This limits access to the printers and ensures jobs are always tracked by PaperCut.

Limit printer access by IP address

Most modern printers let you control which devices are allowed to print to them. In the printer’s web interface—usually under Security or Access Control—you can allow-list specific IP addresses and block the rest.

• For PaperCut NG/MF, allow-list the print server’s IP address. This ensures all print jobs go through the PaperCut-managed queue.
  
• For Pocket and Hive, allow-list the super node’s IP address, but only if you’ve set up a Print Delivery Profile . This ensures print jobs are routed through PaperCut’s secure delivery process.

This approach blocks users from printing directly from their laptops or workstations and ensures all jobs are processed through PaperCut.