If every job from Remote User is one that should not have made it, then it is safe to assume the only thing sending prints that should not be there is the one device using RAW instead of LPR.
RAW ports list the user only as Remote User
LPR ports will list the Windows login name and the file name too.
So the quick and dirty way to resolve the issue is to disable RAW (Port 9100) on the printer and wait for a user to complain about getting spooler crashes and faulted prints on their PC. You will then have found the culprit.
So go to CWIS > Properties > Connectivity > Setup > RAW TCP/IP printing > Edit and just disable the port
There are virus's and trojans that can do this. Bugbear was the big one back in the day.
There could also be a user with a redirected /bad driver (just plain broken, or perfectly fine, but for another printer, and redirected to this printer)
But that is all just guesses.
Disable the port and wait for the complaints is the easiest.
We have a Xerox WorkCentre 7845. When we first installed (about a month ago), we got several jobs called "Job 001, Job 002, Job 003, etc." from "Remote User". These were stuck in active jobs and not allowing anything to print, scan, or e-mail (not sure on copy). I cleared out the jobs and everything started working fine. Today, the same problem happened again. Same solution worked.
Has anyone seen this before? I've gone through the Event Viewer for the servers with this printer on them and have not found any record of where they came from. Looking for suggestions or if this is an error on the machine (only having issue on 1 machine.)
