I agree Shane... not much there. It changes "HKEY_USERS\"+@sid+"\Software\Microsoft\Windows NT\CurrentVersion\Windows","Device", and aside from capitalization looks exactly the same with kix or using the GUI for me. Based on Jochen's UDF GetDefaultPrinter ( http://www.kixtart.org/forums/ubbthreads.php?ubb=showflat&Number=118766 ), this is the correct location to check this.

So maybe the process monitor on the specific program while attempting to print is the right direction?