Pharos Blueprint 5.3 - Update 7 Release Notes

This update should be applied to all machines hosting Blueprint components, i.e. the Analyst, Collector, Administrator.

The components included in this update are:

The Print Scout package should be distributed to all Workstations where Serverless Printing feature will be used.

What's new in Print Scout 7.27.61.11

• Print Scout now supports Windows 11 and Windows Server 2022.

• Support for Windows 7 has been removed.

• The Print Scout Spooler Service is now also installed on Blueprint servers and print servers.

• The Serverless Web Socket automatically disconnects when there are no secure jobs held on the Workstation.

• Fix for an HP PCL driver upgrade issue. 

• The IPP Driver has been updated to version 1.1.39 with the following improvements

  • Grayscale is now supported.

  • The IPP queue can be renamed without affecting Policy Print.

  • When the Print Scout is installed with the User Authentication option, IPP Jobs now support Policy enforcement.

What's new in 5.3 - Update 7 Release

Note: These settings are not enabled by default. Administrators will need to modify the Pharos Print Center settings in the database.

• Email and PIN can now be configured from the Print Center (Secure > PIN tab).

• Added a new UI Mode setting in the Print Center (Secure > Sentry Print tab). It allows admins to select the UI mode to display to Sentry Print printer users. Note, if both were set before doing upgrade, the UI Mode option becomes "Choose an option".

• Added Device Scout to list of services checked by Health Check.

• Updated .Net Core requirements

  • .Net Core 2.1.x is no longer required

  • Blueprint 5.3 Update 7 requires new versions 3.1.23 & 6.0.4 (or greater) of .NET Core.
    Note: Blueprint 5.3 Update 7 no longer requires .Net Core 2.1.x. If you wish to uninstall .Net Core 2.1.x (due to security concerns, for example), you’ll need to uninstall it first before installing 3.1.23 or 6.0.4. Removing Net Core 2.1.x when .Net Core 3.1.x is also installed results in the "Pharos ASP.Net Core" Application Pool in IIS to fail. The Blueprint components that depend on this application pool will stop working.

• Pharos Sentry Print Service to start "Auto (Delayed)".

• New theme configuration for Sentry Print Devices. Admins can now change the following Sentry Print elements:

  • Label of the "Secure Print" icon

  • Username and Password labels

  • Keyboard authentication Help title and message

  • Card Authentication Lock Screen Image

• Additional configuration for Sentry Print device logon workflow

  • A new setting where users are redirected to the Review Documents screen.

  • A new setting where users can immediately see the Keyboard login screen (instead of the Secure Print walk-up screen).

• Event logs now includes Terminal names for Sentry Print devices.

• Secure Queue Configurator Improvements

  • Sets DisableServerFilePooling.

  • Securing a queue now disables bi-directional communication.

  • Securing a queue now enables the "Start printing after the last page is spooled" setting.

• Support for Windows Server 2022 and Windows 11.

Refer to the Blueprint New Features Guide in the Pharos Community for more information about new features, improvements, and bug fixes in Blueprint 5.3 Update 7.

Known Issue

Blueprint 5.3 Update 5 introduced the ability to implement a standby Analyst server for disaster recovery. Applying Update 7 automatically installs the Device Scout on the Analyst as well as the standby Analyst. You will need to remove the Device Scout that is installed on the standby Analyst to prevent device meter collection issues.

How to apply this Update

Warning: Blocked Files

Depending on how this update or its files were copied to the target machine, some of the files may have been 'blocked' by Windows. Trying to update a Blueprint component with a blocked file will most likely prevent that component from working correctly. To check whether a file is blocked and/or unblock it, right-click the file in Windows Explorer and select 'Properties'.

Warning: In use Files

Under some conditions, the upgrader may be unable to replace files because they are in use. If this happens,

1. Stop all the Application Pools in IIS.

2. Run the upgrade again.

3. Start all the Application Pools after the patcher succeeds.

Updating Analyst or Collector

Installation Steps

1. If updating Analyst, make sure you have an up to date backup of the psbprint database.

2. Close the Window's Printers window (if it is open). Close any Pharos applications (e.g. Troubleshooter, Blueprint Administrator) that are open.
    Note: you do not need to stop the Pharos Services. The update installer will do this automatically.

3. Open an elevated Windows command prompt and run Patcher.exefrom the command line. No additional parameters are necessary.

   • The update installer does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the installer. This output will include error messages if the installer fails.

   • Also, the existing Blueprint files will be backed up to BP53 in the Temp directory, before they're replaced with the updated versions.

   • If the update installer fails, you can correct the cause of the error and run Patcher.exe again.

   • At completion, the Patcher may automatically force a restart. Follow the remaining instructions after the restart.

   • To log the installation of MSI files associated with the update, edit <MsiLogFileDirectory> in the Patcher.xml file with a folder path.

   • If Site Monitor with a lite license is installed and the logged on user does not have permissions to remove the Site Monitor database, the DbAdminUser and EncryptedDbAdminPasswordelements can be populated in the patcher.xml to allow full uninstallation of Site Monitor.

     1. Open an elevated command prompt and type in patcher /encrypt:MySecretPassword to retrieve the encrypted version of the Db Admin Password.

4. On Analyst, open the Blueprint Analyst, go to Reporting -> Publications and click on "Publish to Data Warehouse" on the toolbar.

Automated Server Deployment

Customers with a large number of Blueprint Servers may want to deploy this update using an automated software deployment tool (e.g. IBM's Tivoli).

To help with this process, the Patcher can be configured to send an e-mail at the end of the patching process indicating the patching attempt's success or failure. The configuration is held in the file Patcher.xml. Modify the file as follows:

1. Change the <automated> element from "false" to "true".

2. Set "to" to the e-mail address you want the notification sent to.

3. Set "from" to the e-mail address you want the notification to claim it was sent from.

4. Set smtpServerHost to the FQDN of the mail server.

5. Leave smtpServerPort alone, unless the mail server is using a non-standard port. Or you want the communication encrypted using SSL.

6. If the mail server and its Host are configured to support SSL, you can change useSSL to "true" and smtpServerPort to the SSL port (usually 465).

7. Set smtpUserName and smtpPassword to the user and password needed to use the mail server.

8. If you do not want to put an unencrypted password in the Patcher.xml file, you can put the password as encrypted text into smtpEncryptedPassword. You can encrypt the password by calling Patcher.exe from the command line with the flag "/encrypt:". e.g. Assume your mail server's password is "MySecretPassword".

   1. Open an elevated command prompt and type in patcher /encrypt:MySecretPassword

   2. Patcher.exe will return EncryptedPassword:L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"

   3. Set smtpEncryptedPassword="L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"

9. If your deployment tool will run the patcher under an account that has permission to send e-mails, then you can set useDefaultCredentials to "true" and leave smtpUserName, smtpEncryptedPassword and smtpPassword blank.

Updating standalone installations of the Blueprint Administrator

If Workstation Tracker is installed along with the Blueprint Administrator, applying the update will NOT update the Tracker.

1. Close the Window's Printers window (if it is open).

2. Open an elevated Windows command prompt and run Patcher.exe from the command line. No additional parameters are necessary.
   Note: The update installer does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the installer. This output will include error messages if the installer fails.

3. A reboot might be required after the update is run. This is done automatically so make sure you save any open files prior to applying the update.

4. If the update installer fails, you can correct the cause of the error and run Patcher.exe again. Alternatively, you can contact Pharos for manual upgrade instructions.

Updating Tracker on Print Servers

On all the Windows Print Servers where tracking is required, use the Blueprint Print Scout package contained in the Tracker directory to install or upgrade the Tracker.

Updating Tracker on Windows Workstations

Print Scout packages should be distributed to all workstations hosting the Blueprint Tracker, so you can take advantage of the new features and improvements.

The patcher does not uninstall Site Monitor when database cannot be contacted

Applying Update 5 to Blueprint removes any existing Pharos Site Monitor Lite install on the Analyst. However, the Site Monitor is not removed when the database cannot be contacted by the patcher.

Site Monitor can be uninstalled after running the Patcher.

1. Go to "Add or Remove Programs" and select "Pharos Systems Site Monitor".

2. Select "Uninstall", and when prompted, supply credentials for a MSSQL server administrator account.

Integrations

MobilePrint

MobilePrint is NOT affected by applying this update. Also, MobilePrint installed AFTER update is applied will work with no further configuration changes. MobilePrint 2.2.1 does not support TLS 1.2 and will not work if TLS 1.2 is the only cipher suite enabled. MobilePrint 2.3 and later have full support for TLS 1.2.

Other

Updated versions of the following integrations are included in this update.

• Apple Airprint

• MobilePrint

• Pharos Print Center

• VPSX

VPSX, HP ePrint, and Apple UTF-8 Integration

• Any previously installed version of these Integrations will stop working once the update is applied.

• After applying this update, you will need to re-install the integration using the version included with this Update. i.e. replace the deployed DLLs with the new versions.

• If TLS 1.2 is the ONLY cipher suite enabled the VPSX SRH integration will not work.

What was new in 5.3 - Update 5 Release

• Sentry Print for Canon, Lexmark FW3 & FW4, and Toshiba Devices. Canon, and Toshiba now support Sentry Print, joining other supported manufacturers (HP, Konica Minolta, Lexmark, and Ricoh).Lexmark FW3 and FW4 models support adds to our existing support of the newer FW5 and FW6 models.

• Support multiple Analysts (i.e. better CNAME support).

• Secure Print Failover. Scout Sentry Print jobs can be released from the workstation to the printer when the Scout's parent server is offline.

• Site Monitor has been replaced with the Device Scout.

• New Health Test, BP Directory service can communicate with AD/LDAP.

• Check available SE50 licenses before allowing devices to be provisioned.

• On nightly publication, devices that don't support duplex will have any jobs with duplex changed to simplex.

• Times shown on Administrator > Servers > Servers are recorded in UTC, but shown in Administrator's local time.

• If a device is recorded in Blueprint as not having a duplex unit, all printing for the device is recorded as single sided (i.e. NOT double sided).

• Updated device models in the Models table.

• Patcher improvements.

  • The Patcher now supports unattended mode for Analyst.

  • The Patcher can be configured to produce MSI logs for all the Pharos products the Patcher installs or upgrades.

  • The Patcher now skips warning dialogs when run in unattended mode.

• Sentry Print can be configured so that supported devices will show the user to the device "Home Screen" after logon.

• JobStore files are no longer backed up during Service Pack installation.

• New item in Policy Edit Prompts for Back button title

• Manufacturer "Hewlett-Packard" renamed to "HP".

• Improved summary information logged for Collector Bin file imports.

• Print Center, User can select which Devices to print QR code sheets for using either a search or a text file import.

• Print Center allows changing color of buttons on an SE50 device.

• Print Center allows changing the Finishing Options of IPP (as well as Mobile Print) jobs.

• Print Center - Sentry Print Secure dialog box restricts the use of the "Reregister" function to Ricoh devices only.

• Newer Ricoh devices can use Smart Cards (e.g. CAC/PIV) with Sentry Print.

• Update 5 does not support Windows Server 2012. However, 2012 R2 is supported.

• Bug Fixes.

  • Job Releases via Print Center or Sentry Print Devices now have any policy violations recorded.

  • Releasing VPSX print jobs to a device (either using the Print Center or a Sentry Print device) now enforces the requirement the the Device's Print Group is associated with the VPSX Personal Queue the job was submitted to.

  • Deployment of SR25 Terminals automatically create terminal records in Blueprint as intended.

  • The icon for the Print Scout UI is now shown on the task bar.

What was new in 5.3 - Update 4 Release

• Serverles Print Scouts can now be configured to store a copy of print jobs on the server, so jobs can be released when the workstation is off-line.

• New Site wide setting to limit maximum number of print jobs that will be shown for release on iMFPs.

• Transactions reports no longer have "Waste Savings" lines.

• Administrator > Secure Release Here > Settings. Renamed "Workstation Release Settings" to "Print Center Release Settings".

• Configure Publication SQL timeout.

• Document Forensics trigger added to Print Policy.

• Server Overview sub-tab added to System Monitor Tabs in Print Center.

• Some site wide settings for Sentry Print can be configured from the Print Center on the new "Sentry Print Settings" sub-tab under the "Secure" tab.

• DisableLdapChainSearch option in Directory Service config file to select method used to get a user's groups. (Use if fetching groups is too slow.)

• Improvements to importing devices with terminals.

• Administrator -> Device Management -> Authentication Methods. For Standard Scripts, you no longer need to configure AD or LDAP. Instead Standard scripts use the Pharos Directory Service to do AD/LDAP lookup.

• Collector Bin file importing performance improvements.

• Policy can be used to limit user actions (e.g. copy, fax, scan and color) on SE50 devices.

• New Fact sub-type in reports for IPP print jobs.

• New "QR Release" terminal type.

• Audit trail logging of changes made to BP configuration.

• Support for users from multiple domains. (Note, this should NOT be advertised in Readme/New Features, as we recommend against using it.)

• Add CNAME to analyst server, to make disaster recovery swapping of Analyst easier.

• SE50 Theme can be modified.

• In Blueprint Administrator, Print Center Hostname accepts only a Fully Qualified Domain Name

Notes

• The built-in account is now the only logon that can use username and password. This upgrade will remove any other logons that use username and password.

All other logons must use domain authentication, i.e., you must specify the domain and network ID for each user who will have permission(s) to manage Blueprint. Alternately, instead of creating logons for individual users, you can assign Blueprint roles to Active Directory Groups and allow users to inherit Blueprint management permissions via their group memberships.

What was new in 5.3 - Update 3 Release

• CNAME support in Sentry Print Service SSL Certificate.

• Blueprint now supports MobilePrint version 2.4.

• Added health test for IPP Service.

• The Blueprint Administrator now shows the update version.

• Sentry Print terminal is now deleted from the database when device is unsecured.

• New Touchless Printing, including QR codes,iOS & Android apps, and proximity cards for job release.

• "HP Secure Print Service" renamed to "Pharos Systems Sentry Print Service".

• "Pharos Universal Printing Service" renamed to "Pharos IPP Service".

Note: Refer to the Blueprint New Features Guide in the Pharos Community for more information about new features, improvements, and bug fixes in Blueprint 5.3 Update 3.

What was new in 5.3 - Update 2 Release

• Microsoft Silverlight dependency has been removed from Blueprint.

• Print Center Improvements:

  • Finer grain control of which users can release jobs from Print Center.

  • Assorted security improvements.

  • Administration Roles can be granted to SSO logons.

  • Print Center can be installed on Server without needing the rest of BP Collector components.

• Delegate Printing Improvements:

  • Better control of how to search for delegates in Active Directory.

  • Support for delegate search using LDAP.

  • Can disable sending email notifications when a print job with delegates is submitted or released.

  • Users don't have to change Delegate settings to "Automatically Assign" when creating delegates.

• Distribution Lists can be used for Permissions/Policy.

• Quotas have been largely re-written. Refer to the Blueprint New Features Guide for information on what's changed in Quota Management.

• Print Scout - /NoCertificate option added. When set, the Pharos CA certificate is not installed.

• Option to hash the names of all Print Jobs that a Collector stores in the database.

• New Health test showing the number of Web Sockets in use.

• Applying Update no longer stops logging of Sentry Print services.

• Removed the ability to submit jobs via AirPrint. Replaced by the Pharos Universal Printing Service (IPP/E protocol).

• Partial support for Sentry Print devices to continue working when the Analyst/MS SQL server is off-line.

• The new Pharos Universal Printing Service allows job submission to Secure Release Here via iOS App, macOS, and Linux. Refer the to the Pharos Universal Printing Service Technote in the Community.

• Improvements to Pharos Sentry Print:

  • Database Off-line support.

  • Support for some HP iMFP models.

  • Sentry Print iMFPs can be assigned to a different Collector without needing to uninstall the Sentry Print app from the iMFP first.

  • Devices with no IP address in the Blueprint database can no longer be secured.

  • Sentry Print supports "Pull Print" release mode for print jobs.

    • Turn on by setting <UsePullPrint> in GlobalConfig.xml to true.

    • Add <PullPrintFqdn> entry to file below the UsePullPrint to specify the HostName to use for the Collector from outside the company firewall.

• Option to identify delegates using an email address instead of a network name where network id is considered sensitive.

• Improvements to LDAP directory search for Groups - Now matched to Active Directory group search.

• Patcher correctly updates DatabaseVersion table.

• .Net Core 2.2 requirement updated to .Net Core 3.1.3.

• Fixed issue with SRH service becoming unresponsive when unable to establish Websockets for Serverless printing.

Note: Refer to the Blueprint New Features Guide in the Pharos Community for more information about new features, improvements, and bug fixes in Blueprint 5.3 Update 2.

What was new in 5.3 - Update 1 Release

• Policy Print UI moved from Silverlight to Electron. Allowing screen readers to be used with Policy Print.

• New Logon Roles (e.g. "Manage Devices", "Manage Event Log") have been added.

• Audit Log of logons by administrative staff.

• New Health test that sends warning 30 days before Blueprint license is due to end.

• Email + PIN authentication.

Limitations

• If "Integrated Security" is used to connect to MS SQL, the Print Center won't work after applying this release. To fix, set the Pharos ASP.NET v4.0 App Pool in IIS to use an account that has MS SQL permissions. Refer to the "New Features" document in the Pharos Community for more information.