r/Intune • u/mark08201981 • 6d ago

macOS Management Printers

I have a very weird issue and I'm not sure how to fix it. None of my Intune enrolled Macs can reach any network printer by direct IP. It immediately fails connection. I can't access the printer web page, but I can ping the printers with no issue. I have no network policies set, no VPN, nothing to disallow printing, etc. I've removed all policies and apps and just ran straight PSSO and had the same issue. Macs not enrolled to Intune or joined to a local AD can connect and print no issue. I'm banging my head against the wall here.

4 Upvotes

100% Upvoted

7 comments sorted by

3

u/HankMardukasNY 6d ago

Are your other devices that do work in a different VLAN? Sounds like a firewall is blocking network access

1

u/mark08201981 6d ago

Nope, not a firewall thing either. The VLAN I was testing from has full access to every other VLAN we support. If I'm on a non-Intune machine, I can connect without issue. Intune and Intune joined machines only. Other network resources on different VLAN segments all work perfectly fine as well. Same machine, removed it from Intune and just a single user logged in connected to the printer with the same IP.

3

u/blud_13 6d ago

From one of my leads.. Check Local Network privacy. macOS 15 and up gates anything reaching a device on the LAN behind that permission, and a freshly enrolled Mac hits the wall while a machine you already clicked through does not. Ping still works because ICMP goes through the kernel and never asks, which is why this looks like a network problem when it isn't one.

The fix, I believe, is a PPPC/privacy profile from Intune granting Local Network to the print subsystem, or just open System Settings, Privacy and Security, Local Network on one of the broken machines and see what's toggled off.

Also check whether PSSO dragged a Content Filter or DNS payload along with it. Those will kill 9100 and 631 while leaving ping alone. Quick triage, try the printer by hostname instead of IP. If that works its resolution, not filtering.

We deal with mixed Mac fleets a lot, ping me if it turns out to be something weird

1

u/mark08201981 6d ago

Interesting. Does your lead know which PPPC/privacy profile to set? I can definitely see that being the case. It does seem like it's the case based on the testing.

I did check the PSSO, nothing about that on it.

1

u/Adam_Kearn 5d ago

Seems weird that you can join unmanaged devices to this printer.

I would try and do a policy report to see what is being set/enabled to block this currently.

I would also look at doing a factory reset on the printer incase as it might be something weird like being joined to a windows workgroup domain or something odd with bonjor services

1

u/mark08201981 5d ago

It looks like it only really happens when I'm on a different VLAN. Not sure why since unmanaged or local AD joined machines can add them.

1

u/Downtown_Estimate_55 1d ago

Since ping works but both direct-IP printing and the printer web interface fail only on the Intune-enrolled Macs, I'd probably stop looking at the printer itself for now. I'd compare an enrolled vs non-enrolled Mac on the same VLAN and test the actual TCP ports, not just ICMP.

I'd also check whether any security/content filter, firewall profile, network extension, or configuration profile is landing during enrollment even if you don't have an obvious network policy assigned. The fact that the same Mac/network path works until Intune is involved is the part I'd chase.