Maybe use psloggedon or something like that to verify who is logged on around the time it was deleted?
I think you can actually turn on printer auditing for certain groups through the Security | Advanced tab in Printer Properties, I would enable this for the users that have access. Not sure it audits deletion actions though, never looked (or had the need, fortunately!) 2009/10/9 Wilhelm, Scott <[email protected]> > We’ve already buttoned down the security. The teachers & students > definitely do not have permission to this printer. We have verified this > visually & through the effective permissions tab. > > > > Thank you, > > > Scott > > > > > > > > *From:* James Rankin [mailto:[email protected]] > *Sent:* Friday, October 09, 2009 9:32 AM > *To:* NT System Admin Issues > *Subject:* Re: Printer Dissappearring > > > > Check the permissions and see who has access to delete it. If needs be, > change them to a select few and see if it stops > > > > > > -- "On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." http://raythestray.blogspot.com ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
