Software

Ask something
Question Locked

Who is using my printer?

0 helpful
7 replies

by csaby30

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hy, help me pls, how can I view who had acces to my printer or my computer in the last 24hours? my computer is on of a local network computer, and someone has printed on my printer. The printer is installed on my computer through an usb cable. To be able to print my partner from the same office I have shared the printer on the network. The problem is that someone else than my partner is printing through the network on my printer.

7 replies

by tobif

I'm not sure I can help you.
But, in order for anyone to help you, more information is needed.

Which operating system do you use?

Do you have administrator privileges on your computer?

Is your computer a part of a windows domain?
(In the morning, do you need to logon to the company network in order to start the computer?)

What printer model are we talking about?

Do you remember how you set up the printer sharing?

by csaby30

Hy. I am using Windows xp professional sp2, I have administrator privileges. In the morning I start my computer, when I reinstalled the operating system, 3 month ago, I set up the domain, so that be visible in the local area network, an d i shared my printer(right click on the printer-share-share the printer-apply-ok). The printer model is Canon i-sensys Mf3220. The problem is that someone has printed out a threat on my printer. The company where I work is a school, where are several computer in the labs. Each computer is protected with Deep Freeze, so that every changes made to the system are being deleted after system shut down/restart. The computer on witch the printer is installed(via usb cable) is not protected with deep freeze. I'm asking if there is some way to see in the windows registry, or some logs in the windows on my computer, who accesed the computer drivers library to install the printer, who printed the document(a trace of an ip

by tobif

Try running the event viewer (eventvwr.msc) it might have a corresponding entry.

It's also possible that the spooler service on your computer left some traces on the hard drive. Any ideas from other people on that?

Umm. Just in case, check your computer for rootkits.

by csaby30

Thanks for the the, i will trey to find some trace, but the event logs are corrupt. Thank's a lot.

by robo_dev

do a google search on "windows print queue forensics"

In XP, the spool files are in \Windows\system32\spool\printers.

Once a job has printed, these files are typically erased, but with a forensics utility and/or an undelete utility, you can recover and analyze the spool files.

The file you want to find is the spool shadow file (e.g. File001.SHD), which would contain the username, data/time, name of file printed, and file format.

by larryd4

Just restrict the printer to print only documents from you partner and no one else. Then see who complains that they can't print.

This discussion is closed to new replies.