Direct answers on scope, drivers, and operational boundaries.

Any network printer that speaks standard SNMP (v1, v2c, or v3) with MIB-II, Host-Resources-MIB, and RFC 3805 Printer-MIB, IPP / IPPS, or eSCL (/eSCL/ScannerCapabilities and /eSCL/ScannerStatus) works with the standards drivers for discovery, status, supply/tray/counter polling, and baseline configuration reads.

In addition, 13 compiled-in vendor plugins normalise model/serial strings across major enterprise brands: HP adds read-only PML and LEDM XML enrichment, and Ricoh and Canon add probe-gated private MIB total impression counters.

No. The embedded catalog (internal/catalog/enterprise_printers.json) is a structured research inventory of 126 enterprise printer families (495 base model identifiers across 15 brands) compiled from vendor documentation. Every family ships as research_candidate_unvalidated (0 physically validated in the shipped catalog).

PrintMarshal keeps three states strictly separate on every device page: Documented (described in vendor documentation), Observed (a PrintMarshal driver actually answered on that device), and Unknown (neither).

Standard Printer-MIB and IPP attributes do not expose every security setting on every printer (for example, whether an admin password is set or whether WSD/SLP/LLMNR are enabled). Treating an unreadable setting as a passing check creates false compliance confidence.

PrintMarshal records unreadable checks as ? Unknown, lists them explicitly on the device's Security tab, and excludes them from the weighted compliance score denominator.

Configuration writes use the highest-priority driver advertising CapWriteConfig on the target device:

• Standards SNMP (snmp): Writes sysName (identity.hostname), sysLocation (identity.location), sysContact (identity.contact), prtGeneralPrinterName (identity.printerName), prtInputDefaultIndex, and prtMarkerDefaultIndex using a credential with write or both purpose.
• Standards IPP (ipp): Writes printer-location, printer-info, printer-organization, printer-organizational-unit, and *-default print/media attributes when the printer supports IPP Set-Printer-Attributes (0x0013).

No real-vendor ConfigWriter, SecurityWriter, CertManager, or FirmwareUpdater ships today.

Certificate enrollment is implemented in PrintMarshal: the server generates an RSA-2048 or ECDSA-P256 keypair and CSR and requests a signed certificate from your CA via SCEP, EST, or ACME DNS-01 (with manual DNS TXT record creation), storing the issued certificate and AES-256-GCM encrypted private key.

Certificate installation pushes that issued certificate and key onto the printer's TLS listener and requires a driver implementing CertManager (CapInstallCert). No shipped real-vendor driver implements CertManager today, and background auto-renewal is not implemented.

Not with the shipped drivers. PrintMarshal implements the firmware artifact repository (with SHA-256 digest verification and signature status metadata) and the canary → staged wave campaign engine, but the only shipped FirmwareUpdater is fwsim, which is restricted to opt-in simulator targets (PM_FIRMWARE_SIM_TARGETS). Physical printer firmware delivery requires a vendor driver implementing FirmwareUpdater.

No. PrintMarshal is a fleet operations, security assessment, and configuration console—not a CUPS replacement or Windows print driver host. It includes an optional pull-print hold/release workflow (/api/print/jobs and /api/print/release/card) that submits held PDF/PostScript/PWG-Raster jobs over IPP/IPPS to printers supporting RFC 3998, plus CSV/JSON job accounting import for PaperCut and uniFLOW.

Run a single active PrintMarshal server process per database. Whether you use embedded SQLite (WAL) or external PostgreSQL, background discovery, polling schedules, and job workers run in-process without a distributed cluster lock.

Use the built-in printer simulator (cmd/pm-sim) on loopback (127.0.0.1). It replays real SNMP walk fixtures (testdata/fixtures/*.snmp) and speaks SNMPv2c/v3, IPP/IPPS, and eSCL so you can evaluate discovery, security policy assessments, and dry-run configuration writes locally. Follow the Get Started guide.