Although native Macintosh networking provides support for file security, it does not provide support for print device security. The AppleTalk protocol contains no mechanism that supports client user name or password. Macintosh clients, therefore, cannot identify themselves on the network, and the Windows NT print server cannot impose user-level security on Macintosh clients. If a Macintosh client is physically able to send a job to a print device or print server, that client implicitly has permission to do so.
You can, however, enforce one set of printer permissions on all Macintosh users as a group. The Macintosh client must start the MacPrint service by logging on using a user account. By default, it logs on as the System account. The System account has Print permission on all local print devices, so any Macintosh client can send a job to any of the Windows NT computer's local printers. To limit the permissions for Macintosh clients, create a new user account, giving it the printer permissions you want the group to have. Then set the Macintosh client MacPrint service to log on using this account.
Note The System account on one computer does not have permission to access resources on other computers. Macintosh clients that start the MacPrint service by logging on as System user cannot send jobs to printers that forward jobs to other print servers. The solution is to configure the Macintosh client MacPrint service to log on as another user, one which has permission to print on all the print servers to which print jobs are forwarded.