The Machine in the Corner That Remembers Everything: A 30-Minute Health Check for Your Office Printer

There's a machine in your office that has a login, an operating system, an internet connection and a hard drive. It also has a complete copy of last month's payroll summary, a scanned passport or two, and the signed contract you thought you'd deleted. Nobody has logged into it since the engineer set it up in 2021.

It's the photocopier. The multifunction printer (MFP) that also scans, faxes, staples and emails. The one nobody thinks of as IT equipment, because it's furniture.

This isn't a scare story about nation-state printer hacking. It's a much duller problem: the MFP is the most-neglected device on your network, it holds more personal data than most of your laptops, and almost nobody revisits it until the day it's wheeled out of the door.

If you're a twelve-person firm in a converted mill in Bradford, or a charity sharing a floor in Cardiff, you can fix most of this in half an hour. Here's how.

First, find the thing

Most MFPs have a small screen on the front and a sticker somewhere with a hostname or an IP address. If not, log into your router or ask whoever manages your network to look at the DHCP table — the printer will usually be the device with a suspiciously tidy hostname like RICOH-IMC3000 or KM-C3350.

Type that IP address into a browser and you'll usually land on the machine's web console. That console is where everything lives: the address book, the scan-to-email settings, the stored document queue, the logs. Treat it as an admin panel for a small server, because that's what it is.

Change the password before anything else

Factory credentials are published in the manual, and the manual is on the internet. Common offenders are admin with no password, admin/admin, admin/1234, or the serial number. Some machines have a separate "supervisor" or "service" account that is even more powerful and even less likely to have been changed.

So: log in, change the administrator password to something long and unique, and put it in your password manager with a note saying which machine it belongs to. If you don't have a password manager, this is a good reason to get one — and it solves the "Gary left in 2023 and took the printer password with him" problem in advance.

While you're in there, check whether remote access or a cloud management feature is switched on. If you're not using it, turn it off. A printer that phones home to a management portal you've forgotten about is one more door with a key under the mat.

Kill the scan-to-email relay

This is the one that gets small offices into real trouble. Scan-to-email needs a mail server to send through, and a lot of installations are configured to point at a local relay that accepts mail from any device on the network without authentication.

If that relay is reachable from outside — or if someone gets a foothold on your network — you've just handed them a way to send convincing, well-formatted spam from your domain. Your domain reputation takes the hit, your legitimate invoices start landing in junk folders, and you spend a fortnight explaining yourself to clients.

Two fixes, both quick. First, make sure the MFP authenticates to your mail provider properly, ideally using a dedicated account with a strong password and, if your provider supports it, an app-specific credential. Second, check your SPF, DKIM and DMARC records actually cover that sending route, so if the printer does get abused, the receiving world is less likely to believe it.

Also worth checking: the MFP's own address book. Lots of machines store every email address ever scanned to, including ex-staff, personal Gmail accounts and that supplier who went bust. If yours does, export it, review it, and clear out anything stale.

Look at what's actually stored

Here's the bit people don't like. Most MFPs have a hard drive or solid-state storage, and depending on the settings they may keep copies of every job printed, scanned or copied. That's how "print and hold" and "secure print" features work — and it's also why the machine's storage is a small filing cabinet nobody audits.

Go through the settings and look for:

• Stored document or job retention — often set to keep documents for hours, days or indefinitely. Set the shortest retention that still lets people pick up their printing.
• Secure print / print release — if it's available, switch it on for anything sensitive. The job only prints when someone badges or PINs at the machine.
• Scan-to-folder shares — check which network shares the printer can write to. If it can reach your finance folder, that's a door worth knowing about.
• Audit logs — enable them if they're off, and check you can actually retrieve them. If nobody ever reads the logs, at least make sure they exist for the day you need them.

While you're scrolling, take a photo of the firmware version and check whether it's current. Printer firmware vulnerabilities are routine, and updates are free. It's the cheapest patch you'll install this month.

Disconnect the connectors you don't use

Newer machines come with a menu of cloud destinations: OneDrive, Google Drive, Dropbox, Box, a dozen others. Someone enabled one during the install and then the project ended.

Each connector is an authenticated link from a device in your office to a storage account somewhere else. If you're not using it, remove it. If you are using it, check which account it's tied to — and whether that account belonged to a person who has since left.

Same principle for anything else switched on that you can't explain: fax-over-internet, AirPrint across the whole network, WSD discovery, an unauthenticated FTP drop. If you can't say what it's for, it's not earning its keep.

The day the lease ends

The machine goes back to the supplier. Sometimes it goes to a refurbisher. Sometimes it goes to a pallet in a warehouse and then to someone else's office, still carrying your scanned documents.

So build a return routine now, before the day arrives and everyone's distracted:

1. Export and keep the settings, so you have a record of the configuration.
2. Run the manufacturer's data-overwrite or initialise function — most business MFPs have one. It's usually under a maintenance or security menu, and it may take a while.
3. Ask the supplier for written confirmation of erasure — a data sanitisation or destruction certificate. If they can't provide one, consider having the drive removed and destroyed yourself.
4. Log it. Date, machine, serial number, who wiped it, who has the certificate. One line in a spreadsheet is fine.

If you handle anything client-facing, this little record is the sort of evidence an insurer or a client's procurement team might ask about later. It's also just good manners towards the next tenant of that machine.

Thirty minutes, once a quarter

None of this is glamorous. It doesn't get you a badge on a maturity chart. But the printer is a networked computer holding personal data, and treating it like one — password, patches, least privilege, a wipe at the end — closes a gap that a lot of small organisations leave open for years.

Put it in the diary with the fire alarm test. Fifteen minutes for the settings, fifteen for the checklist, and a note about who owns it. The machine in the corner will keep humming either way, but at least it'll stop being a filing cabinet with a plug on it.