In this blog, we can track printer usage with event viewer logs. How do you enable and configure print event logging in Windows, view print history in the Event Viewer, and search or filter print events using PowerShell? Organizations need to audit their print server to determine what data is being printed, its volume, and who is printing sensitive data. Regular auditing will help an organization identify vulnerabilities and focus on working on necessary security measures. Print server audit reports are more important than user management reports.
Track Printer Usage with Event Viewer Logs
You can track printer usage with Windows Event Viewer. All the print jobs sent to the print spooler are logged in the Event Viewer. If you have a print server installed on Windows, you can utilize these logs to organize a simple print audit solution that lets you understand who has printed on your printers, when, and how many pages.
Enable Print Logging with Command Prompt or PowerShell
Furthermore, you can enable Windows print logging using the built-in wevutil utility. Just open an elevated PowerShell or Command Prompt and run the below command.
wevtutil.exe sl Microsoft-Windows-PrintService/Operational /enabled:true
How to Enable Print Logging in Windows 10/11 and Windows Server 2022
Press the Windows key + R to open the Run box, type eventvwr.msc, and enter to open Event Viewer. In Windows Server 2022, you can access Event Viewer from server manager tools.
When the Event Viewer window opens, go to:
Applications and Services Logs\Microsoft\Windows\PrintService
Right-click on the Operational item and select Properties.
In the Log Properties dialog, select the Enable logging option. You can modify the maximum event log size or enable Overwrite events only to keep recent events.
From this point forward, Event Viewer will log all your print activities, and you can view the event logs under Applications and Services.
Logs\Microsoft\Windows\PrintService\Operatinal
The most intriguing event for printer usage tracking is event 307. Double-click the 307 event.
It tells you which document was printed, how many pages or copies were used, and the printing time.
How to Enable Allow Job Name in Event Logs in Group Policy
You must enable a particular GPO setting if you want the event log to display the file name sent for printing.
To open the Local Group Policy Editor, type gpedit.msc in the run box and hit enter.
Go to:
Computer Configuration\Administrative Templates\Printers.
Double-click on the Allow job name in event logs to enable this option.
Select Enable.
Update group policy settings using the gpupdate /force command.
All print events will be logged into the Event Viewer.
Checking Print History on Windows with Event Viewer.
You can now view detailed information about all printing events on this computer.
Open the Event Viewer and go to:
Applications and Services Logs\Microsoft\Windows\PrintService\Operational
ID 307: Printing a document.
Open the event details:
The event description contains the following:
The print file’s name and the application were printed on it.
The name of the user who printed the file.
The printer’s name
Number of pages printed
The file size in bytes
How do I enable Windows Print Service Event logging?
By default, print jobs on Windows Server aren’t logged in the Windows Event Viewer, but they can be accommodating when resolving issues requiring tracing a job from the start to the end of its print trip! It can also be beneficial to assist with troubleshooting printing/driver-related issues.
