My daughter has asked me if it is possible to work out on a network where/which terminal authorized a print command to a printer on another part of a network.
i don't know if the network has been restarted or rebooted or how long ago this happened ( we think 2 days). It would appear that the wrong person ( not my daughter I hasten to add) has been getting in to bother for tying up an important printer for a long time when it was needed for customer reciepts.
They all know who it was but as they're passing the buck and blaming a younger newer worker they want to be able to prove it.
just another jumped up manager who won't admit he's cocked up AGAIN IMHO.

The short answer is yes:

The print server should keep a record of the IP address that sent the print request, which should tie up with the DHPC server. (Asuming that they are that techinical).

HTH.

O

It's certainly possible... but it depends if logs are kept.

Very few print servers are set to keep the logs as they fill up and need clearing out!

Whether it's a log of IP address or PC name I can't remember.
Assuming logs are kept; if it's PC name or they use fixed IP addresses then you're in business.

If they use DHCP then depending on the lease times the records may still be there. At y last place we used to renew after 48hours so they'll need to move quickly!


HTH,
James

In the windows event logs (System) on the server (if its a domain with proper print sharing from the server) they'll be an "Information" entry with "Source" "Print" and "User" will be the domain user who printed.

The detail of this entry will include the filename, application or website page (depending on what was printed) along with the details of the printer it went to, pages, size.

eg.
Document 24, http://www.yell.com/ucs/UcsSearchAction.do?keywords=powder+coat owned by Chris was printed on Operations A4 via port IP_172.16.100.243. Size in bytes: 91552; pages printed: 1

Document 125, Plan.xls owned by Chris was printed on Operations A4 via port IP_172.16.100.243. Size in bytes: 27884; pages printed: 1

etc.

Even if DHCP is used, the domain username is shown correctly.

[Edited on 13/6/09 by the_fbi]