I'm trying to track down a document that was printed from our network on a Sunday—when the office was closed. The challenge is that all printers are different: some have logs and some don't. I only know that something was printed that day, but no details on which computer, printer, or file were involved. I'm wondering if there's a way to search through the files for their last print dates, or if checking the logs from various printers is the way to go. Any advice on how to find this out would be greatly appreciated!
5 Answers
If you’re using a Windows print server, check the event logs under Microsoft-Windows-PrintService. It might not show the printed file, but it will indicate who printed it, and then you can investigate their recent files.
There are software solutions that can capture printer logs, but they usually need to be running beforehand. Since you mentioned that some printers log events, have you checked if any print event details might be stored in the system's Event Logs? There might not be a bulk search option available, so you'll likely have to go through this manually unless there's an existing tool that can help you. Don't forget to check the logs of your existing setups first!
Ask around if there are security cameras or keycard logs available from that day. Cameras can help determine who was in the building, and keycard access records could give insight into who was accessing the office around that time. It’s worth a shot!
You might also want to look into the print queue logs if you have a centralized printing solution in place. If all printers are networked, you might be able to see activity in the print server logs. But if you have a mix of local and centralized setups, it might complicate things. Check each printer manually, especially if they tend to rotate logs quickly!
It sounds like you might want to gather more intel from whoever informed you about the print. They could have seen it in the logs or maybe they were the ones who printed it. The more information you can get, the better your chances are of figuring this out!
Great idea! I’ll definitely look into the keycard access logs.