An administrator is investigating a misuse of printer resources.

To verify the source of printer misuse, the administrator needs detailed records showing who performed specific actions and when. According to CompTIA Core 1 (220-1201) printer management and security objectives, audit logs provide a historical record of printer activity, including user IDs, timestamps, document names, and print volumes. These logs allow administrators to trace printer usage back to a specific user or device, making them the most effective tool for investigating misuse.

Secure printing requires users to authenticate at the printer before jobs are released, which helps prevent unauthorized access but does not provide historical evidence of past misuse. A print counter tracks the total number of pages printed but does not identify individual users or specific print jobs. User authentication ensures that only authorized users can access the printer, but by itself it does not provide detailed usage tracking unless combined with logging.

CompTIA emphasizes audit logging as a critical component of accountability and security across systems, including printers. When investigating policy violations or misuse, audit logs are the primary source of verifiable evidence.