The attached document is step by step for an XSA setup to get you started.
Once it is complete, go to CWIS > Properties > Login / Permissions / Accounting > User Permissions > Job Override Policies > Edit
And set it to just do BW
Then, if they use a code that can do color they will get color, if they use a code that can't do color they will get BW.
As for the who gets prompted, the driver needs to be BW by default, so the prompt only happens when they select color, other wise the driver will have to use color to make BW (Better detail). In your case it would be better to add the driver to a server, then blacklist/filter IP's that are not the server from printing so they cannot print from a local install and bypass your implementation.
Else you need to have them set their default to BW in Printing Preferences.
Or, have them each get a BW code and a color code.
This is a model 7855. The users told me that it's setup so that anyone can print. However, unless you put in the group info/password, everything will print in black and white. If you have a colored document, it will still print it out, but only in black and white.
However, I can't get it to function like that. Right now, I can either give you the "color access" code for that user, or I don't. Without the code, if you have a color document, it will not let you print it even if they select only black and white. So, currently, my only resolve is giving everyone the code, and then individually selecting "xerox black and white conversion" on their pc so that, even though you have color access, it will only print in black and white.
That's not how it had been working, though. And, that would defeat the purpose of even having the "color user" code they setup. What is the easiest way to accomplish this. I could make a second user with only b&w access (maybe?) and put them on that, but they didn't have one before. And, this does not use LDAP.
Of note: There is a second type of group that's labeled as default with code 999999 that appears to be what should be what they want. But, if I put in that code, it says "invalid accounting code". I forgot where this is at. But, it's the only one listed. The "color user" and the "default group" are on different parts of the login options. They are not the same type of group/account.
Thanks for the help!