Pharos Blueprint 5.3 Update 5 Release Notes

This update should be applied to all machines hosting Blueprint components, i.e. the Analyst, Collector, Administrator. The components included in this update are:

The Print Scout package should be distributed to all Workstations where print tracking and other features are needed.

What's new in Print Scout 7.26.11.1

• Secure Print Failover.

• Updated the Pharos IPP Driver to v1.1.29.

What's new in Blueprint 5.3 Update 5

• Sentry Print for Canon, Lexmark FW3 & FW4, and Toshiba Devices. Canon, and Toshiba now support Sentry Print, joining other supported manufacturers (HP, Konica Minolta, Lexmark, and Ricoh).Lexmark FW3 and FW4 models support adds to our existing support of the newer FW5 and FW6 models.

• Support multiple Analysts (i.e. better CNAME support).

• Secure Print Failover. Scout Sentry Print jobs can be released from the workstation to the printer when the Scout's parent server is offline.

• Site Monitor has been replaced with the Device Scout.

• New Health Test, BP Directory service can communicate with AD/LDAP.

• Check available SE50 licenses before allowing devices to be provisioned.

• On nightly publication, devices that don't support duplex will have any jobs with duplex changed to simplex.

• Times shown on Administrator > Servers > Servers are recorded in UTC, but shown in Administrator's local time.

• If a device is recorded in Blueprint as not having a duplex unit, all printing for the device is recorded as single sided (i.e. NOT double sided).

• Updated device models in the Models table.

• Patcher improvements.

  • The Patcher now supports unattended mode for Analyst.

  • The Patcher can be configured to produce MSI logs for all the Pharos products the Patcher installs or upgrades.

  • The Patcher now skips warning dialogs when run in unattended mode.

• Sentry Print can be configured so that supported devices will show the user to the device "Home Screen" after logon.

• JobStore files are no longer backed up during Service Pack installation.

• New item in Policy Edit Prompts for Back button title

• Manufacturer "Hewlett-Packard" renamed to "HP".

• Improved summary information logged for Collector Bin file imports.

• Print Center, User can select which Devices to print QR code sheets for using either a search or a text file import.

• Print Center allows changing color of buttons on an SE50 device.

• Print Center allows changing the Finishing Options of IPP (as well as Mobile Print) jobs.

• Print Center - Sentry Print Secure dialog box restricts the use of the "Reregister" function to Ricoh devices only.

• Newer Ricoh devices can use Smart Cards (e.g. CAC/PIV) with Sentry Print.

• Update 5 does not support Windows Server 2012. However, 2012 R2 is supported.

• Bug Fixes.

  • Job Releases via Print Center or Sentry Print Devices now have any policy violations recorded.

  • Releasing VPSX print jobs to a device (either using the Print Center or a Sentry Print device) now enforces the requirement the the Device's Print Group is associated with the VPSX Personal Queue the job was submitted to.

  • Deployment of SR25 Terminals automatically create terminal records in Blueprint as intended.

  • The icon for the Print Scout UI is now shown on the task bar.

Limitations and Known Issues

• The patcher does not uninstall Site Monitor when database cannot be contacted
  Applying Update 5 to Blueprint removes any existing Pharos Site Monitor Lite install on the Analyst. However, the Site Monitor is not removed when the database cannot be contacted by the patcher.
  Site Monitor can be uninstalled after running the Patcher.

1. Go to "Add or Remove Programs" and select "Pharos Systems Site Monitor".

2. Select "Uninstall", and when prompted, supply credentials for a MSSQL server administrator account.

• Unsecuring an HP device fails with the “The manufacturer type of this device is currently not supported” error message
  This occurs when you are attempting to unsecure an HP device using an older verison of the Print Center than is installed on the Analyst. For example, the device was secured using the Print Center on the Collector running Update 4 and you are unsecuring (again using the Collector Print Center) after updating the Analyst to Update 5. To unsecure the device, use the Print Center on the Analyst or apply Update 5 to the Collector first.

• Securing multiple devices for Sentry Print when there’s only one SE50 license left
  The Blueprint Print Center now enforces license limits when securing Sentry SE50 Terminals. If there’s only one terminal license left and you try to secure two devices at the same time, the second operation hangs. We recommend checking your license limits before securing your devices for Sentry Print.

How to apply this Update

Warning: Blocked Files

Depending on how this update or its files were copied to the target machine, some of the files may have been 'blocked' by Windows. Trying to update a Blueprint component with a blocked file will most likely prevent that component from working correctly. To check whether a file is blocked and/or unblock it, right-click the file in Windows Explorer and select 'Properties'.

Warning: In use Files

Under some conditions, the upgrader may be unable to replace files because they are in use. If this happens: 

1. Stop all the Application Pools in IIS.

2. Run the upgrade again.

3. Start all the Application Pools after the patcher succeeds.

Updating Analyst or Collector

Installation Steps

1. If updating Analyst, make sure you have an up to date backup of the psbprint database.

2. Close the Window's Printers window (if it is open). Close any Pharos applications (e.g. Troubleshooter, Blueprint Administrator) that are open.
    Note: you do not need to stop the Pharos Services. The update installer will do this automatically.

3. Open an elevated Windows command prompt and run Patcher.exe from the command line. No additional parameters are necessary.

   • The update installer does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the installer. This output will include error messages if the installer fails.

   • Also, the existing Blueprint files will be backed up to BP53 in the Temp directory, before they're replaced with the updated versions.

   • If the update installer fails, you can correct the cause of the error and run Patcher.exe again.

   • At completion, the Patcher may automatically force a restart. Follow the remaining instructions after the restart.

   • To log the installation of MSI files associated with the update, edit <MsiLogFileDirectory> in the Patcher.xml file with a folder path.

4. On Analyst, open the Blueprint Analyst, go to Reporting -> Publications and click on "Publish to Data Warehouse" on the toolbar.

Automated Deployment to Collectors

Customers with a large number of Collectors may want to deploy this update using an automated software deployment tool (e.g. IBM's Tivoli; Microsoft's SCCM).

To help with this process, the Patcher can be configured to send an e-mail at the end of the patching process indicating the patching attempt's success or failure. The configuration is held in the file Patcher.xml. Modify the file as follows:

1. Change the <automated> element from "false" to "true".

2. Set "to" to the e-mail address you want the notification sent to.

3. Set "from" to the e-mail address you want the notification to claim it was sent from.

4. Set smtpServerHost to the FQDN of the mail server.

5. Leave smtpServerPort alone, unless the mail server is using a non-standard port. Or you want the communication encrypted using SSL.

6. If the mail server and its Host are configured to support SSL, you can change useSSL to "true" and smtpServerPort to the SSL port (usually 465).

7. Set smtpUserName and smtpPassword to the user and password needed to use the mail server.

8. If you do not want to put an unencrypted password in the Patcher.xml file, you can put the password as encrypted text into smtpEncryptedPassword. You can encrypt the password by calling Patcher.exe from the command line with the flag "/encrypt:". e.g. Assume your mail server's password is "MySecretPassword".

   1. Open a command prompt and type in patcher /encrypt:MySecretPassword

   2. Patcher.exe will return EncryptedPassword:L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"

   3. Set smtpEncryptedPassword="L9EMZX9r1CkvI8rNybP/dikf09zwBPLMfl6OMk7/nXOCgZQpaePQDoGDULN3eAbe"

9. If your deployment tool will run the patcher under an account that has permission to send e-mails, then you can set useDefaultCredentials to "true" and leave smtpUserName, smtpEncryptedPassword and smtpPassword blank. 

Updating standalone installations of the Blueprint Administrator

If Workstation Tracker is installed along with the Blueprint Administrator, applying the update will NOT update the Tracker.

1. Close the Window's Printers window (if it is open).

2. Open an elevated Windows command prompt and run Patcher.exe from the command line. No additional parameters are necessary.
   Note: The update installer does not create a log file. It is recommended that you run DebugView (http://technet.microsoft.com/en-us/sysinternals/bb896647) to capture the output of the installer. This output will include error messages if the installer fails.

3. A reboot might be required after the update is run. This is done automatically so make sure you save any open files prior to applying the update.

4. If the update installer fails, you can correct the cause of the error and run Patcher.exe again. Alternatively, you can contact Pharos for manual upgrade instructions.

Configuring the Patcher to Generate MSI Logs

The patcher installs or updates a number of Pharos products by running their MSI installers these can be configured to each generate an MSI log file

1. Populate the element in the patcher.xml file with an existing directory the patcher will have permission to write to.

2. Run the patcher either in the manual or automated mode, MSI log files for each of the installers run will be saved to the specified directory after the update is complete.

Updating Tracker on Print Servers

On all the Windows Print Servers where tracking is required, use the Blueprint Print Scout package contained in the Tracker directory to install or upgrade the Tracker.

Updating Tracker on Windows Workstations

Print Scout packages should be distributed to all workstations hosting the Blueprint Tracker, so you can take advantage of the new features and improvements.

Integrations

MobilePrint

MobilePrint is NOT affected by applying this update. Also, MobilePrint installed AFTER update is applied will work with no further configuration changes. MobilePrint 2.2.1 does not support TLS 1.2 and will not work if TLS 1.2 is the only cipher suite enabled. MobilePrint 2.3 and the latest version 2.4 have full support for TLS 1.2.

Other

  Updated versions of the following integrations are included in this update.

• MobilePrint v2.3.0.0

• VPSX v2.0.1.0

VPSX Integration

• Any previously installed version of these Integrations will stop working once the update is applied.

• After applying this update, you will need to re-install the integration using the version included with this Update; i.e. replace the deployed DLLs with the new versions.

• If TLS 1.2 is the ONLY cipher suite enabled the VPSX SRH integration will not work.

What was new in 5.3 - Update 4 Release

• Serverles Print Scouts can now be configured to store a copy of print jobs on the server, so jobs can be released when the workstation is off-line.

• New Site wide setting to limit maximum number of print jobs that will be shown for release on iMFPs.

• Transactions reports no longer have "Waste Savings" lines.

• Administrator > Secure Release Here > Settings. Renamed "Workstation Release Settings" to "Print Center Release Settings".

• Configure Publication SQL timeout.

• Document Forensics trigger added to Print Policy.

• Server Overview sub-tab added to System Monitor Tabs in Print Center.

• Some site wide settings for Sentry Print can be configured from the Print Center on the new "Sentry Print Settings" sub-tab under the "Secure" tab.

• DisableLdapChainSearch option in Directory Service config file to select method used to get a user's groups. (Use if fetching groups is too slow.)

• Improvements to importing devices with terminals.

• Administrator -> Device Management -> Authentication Methods. For Standard Scripts, you no longer need to configure AD or LDAP. Instead Standard scripts use the Pharos Directory Service to do AD/LDAP lookup.

• Collector Bin file importing performance improvements.

• Policy can be used to limit user actions (e.g. copy, fax, scan and color) on SE50 devices.

• New Fact sub-type in reports for IPP print jobs.

• New "QR Release" terminal type.

• Audit trail logging of changes made to BP configuration.

• Support for users from multiple domains. (Note, this should NOT be advertised in Readme/New Features, as we recommend against using it.)

• Add CNAME to analyst server, to make disaster recovery swapping of Analyst easier.

• SE50 Theme can be modified.

• In Blueprint Administrator, Print Center Hostname accepts only a Fully Qualified Domain Name

Notes

• The built-in account is now the only logon that can use username and password. This upgrade will remove any other logons that use username and password.

All other logons must use domain authentication, i.e., you must specify the domain and network ID for each user who will have permission(s) to manage Blueprint. Alternately, instead of creating logons for individual users, you can assign Blueprint roles to Active Directory Groups and allow users to inherit Blueprint management permissions via their group memberships.

What was new in 5.3 - Update 3 Release

• CNAME support in Sentry Print Service SSL Certificate.

• Blueprint now supports MobilePrint version 2.4.

• Added health test for IPP Service.

• The Blueprint Administrator now shows the update version.

• Sentry Print terminal is now deleted from the database when device is unsecured.

• New Touchless Printing, including QR codes,iOS & Android apps, and proximity cards for job release.

• "HP Secure Print Service" renamed to "Pharos Systems Sentry Print Service".

• "Pharos Universal Printing Service" renamed to "Pharos IPP Service".

Note: Refer to the Blueprint New Features Guide in the Pharos Community for more information about new features, improvements, and bug fixes in Blueprint 5.3 Update 3.

What was new in 5.3 - Update 2 Release

• Microsoft Silverlight dependency has been removed from Blueprint.

• Print Center Improvements:

  • Finer grain control of which users can release jobs from Print Center.

  • Assorted security improvements.

  • Administration Roles can be granted to SSO logons.

  • Print Center can be installed on Server without needing the rest of BP Collector components.

• Delegate Printing Improvements:

  • Better control of how to search for delegates in Active Directory.

  • Support for delegate search using LDAP.

  • Can disable sending email notifications when a print job with delegates is submitted or released.

  • Users don't have to change Delegate settings to "Automatically Assign" when creating delegates.

• Distribution Lists can be used for Permissions/Policy.

• Quotas have been largely re-written. Refer to the Blueprint New Features Guide for information on what's changed in Quota Management.

• Print Scout - /NoCertificate option added. When set, the Pharos CA certificate is not installed.

• Option to hash the names of all Print Jobs that a Collector stores in the database.

• New Health test showing the number of Web Sockets in use.

• Applying Update no longer stops logging of Sentry Print services.

• Removed the ability to submit jobs via AirPrint. Replaced by the Pharos Universal Printing Service (IPP/E protocol).

• Partial support for Sentry Print devices to continue working when the Analyst/MS SQL server is off-line.

• The new Pharos Universal Printing Service allows job submission to Secure Release Here via iOS App, macOS, and Linux. Refer the to the Pharos Universal Printing Service Technote in the Community.

• Improvements to Pharos Sentry Print:

  • Database Off-line support.

  • Support for some HP iMFP models.

  • Sentry Print iMFPs can be assigned to a different Collector without needing to uninstall the Sentry Print app from the iMFP first.

  • Devices with no IP address in the Blueprint database can no longer be secured.

  • Sentry Print supports "Pull Print" release mode for print jobs.

    • Turn on by setting <UsePullPrint> in GlobalConfig.xml to true.

    • Add <PullPrintFqdn> entry to file below the UsePullPrint to specify the HostName to use for the Collector from outside the company firewall.

• Option to identify delegates using an email address instead of a network name where network id is considered sensitive.

• Improvements to LDAP directory search for Groups - Now matched to Active Directory group search.

• Patcher correctly updates DatabaseVersion table.

• .Net Core 2.2 requirement updated to .Net Core 3.1.3.

• Fixed issue with SRH service becoming unresponsive when unable to establish Websockets for Serverless printing.

Note: Refer to the Blueprint New Features Guide in the Pharos Community for more information about new features, improvements, and bug fixes in Blueprint 5.3 Update 2.

What was new in 5.3 - Update 1 Release

• Policy Print UI moved from Silverlight to Electron. Allowing screen readers to be used with Policy Print.

• New Logon Roles (e.g. "Manage Devices", "Manage Event Log") have been added.

• Audit Log of logons by administrative staff.

• New Health test that sends warning 30 days before Blueprint license is due to end.

• Email + PIN authentication.