Can I determine when a default printer was set on windows

Question

We are trying to trace the time a windows default printer was changed and by who or what.

Any ideas?

Answer 1

I don't think that is tracked anywhere. For past changes, you might be out of luck.

For future changes, you could try setting up security auditing (via regedit: Permissions->Acvanced->Auditing) on HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows and watch for changes to that key in the Security event log. The amount of security event messages may make tracking difficult, though.