|
I'm with Beastie on this one: Look at your print server, it should (assuming you've set it up properly) log the user that sent the print job, and the time. If you can even find the time and the job, you can view the event logs.
As for searching the cache files (assuming they didn't clear them), your only real option is (assuming you don't have a central file server that stores people's files - and assuming you haven't set the profiles up NOT to store Temporary Internet Files on the fileserver) is to mount each C$ share and look.
It sucks that it takes a lesson like this to learn better auditing, but now you know.
__________________
Eat antimatter, Posleen-boy!
|