Printer Deleted on the terminal server - How to trace who deleted and when ?

[benxxv via WinServerKB.com]

Hi,

There are several printers available in the windows 2008 RDP session for the
users, the printers are installed on the terminal server.

One of the printer got deleted few days back. We tried to trace how the
printer got deleted but unable to come up with the fact.

Please help me how to trace when and how the printer got deleted on the
terminal server..

Regards,
Raghuveer.

--
Message posted via http://www.winserverkb.com

 

[Vera Noest [MVP]]

You won't be able to track this information after the fact, but for
the future: you can enable logging of all printer-related events in
the EventLog. Go to Printers and faxes - File menu - Server
rpoperties - Advanced.
_________________________________________________________
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Services
RDS troubleshooting: http://ts.veranoest.net
___ please respond in newsgroup, NOT by private email ___

"benxxv via WinServerKB.com" wrote on 14 sep 2009 in
microsoft.public.windows.terminal_services:

> Hi,
>
> There are several printers available in the windows 2008 RDP
> session for the users, the printers are installed on the
> terminal server.
>
> One of the printer got deleted few days back. We tried to trace
> how the printer got deleted but unable to come up with the fact.
>
> Please help me how to trace when and how the printer got deleted
> on the terminal server..
>
> Regards,
> Raghuveer.

 

[Lanwench [MVP - Exchange]]

benxxv via WinServerKB.com wrote:
> Hi,
>
> There are several printers available in the windows 2008 RDP session
> for the users, the printers are installed on the terminal server.
>
> One of the printer got deleted few days back. We tried to trace how
> the printer got deleted but unable to come up with the fact.
>
> Please help me how to trace when and how the printer got deleted on
> the terminal server..
>
> Regards,
> Raghuveer.

In addition to Vera's reply ....nobody but an admin should be able to delete
them anyway. Perhaps your users have more rights on this box than they
should.

 

[Leythos]

In article , u30064@uwe says...
>
> Hi,
>
> There are several printers available in the windows 2008 RDP session for the
> users, the printers are installed on the terminal server.
>
> One of the printer got deleted few days back. We tried to trace how the
> printer got deleted but unable to come up with the fact.
>
> Please help me how to trace when and how the printer got deleted on the
> terminal server..

Only an Admin type user can MANAGE PRINTERS normally - why are you users
given access that would allow them to Delete printers?

At best, give authenticated users the ability to manage print jobs, or
just trusted managers, but no user should be an Administrator (except an
admin).

--
You can't trust your best friends, your five senses, only the little
voice inside you that most civilians don't even hear -- Listen to that.
Trust yourself.
spam999free@rrohio.com (remove 999 for proper email address)