How to Audit Print to Device Events

Windows writes Print to Device events to the Microsoft-Windows-PrintService/Operations Event Log. Auditing is accomplished by consolidating these log entries to a central log database then scanning the log entries for specific criteria. Server Manager includes several sample filters, templates and reports to provide out-of-the-box print to device compliance and auditing support. The filters look at specific log entries. The templates download and save the audit log entries. The reports scan the consolidated log entries, filter the entries, then report the results.

Who Requires Print To Device Auditing?

Specification	Section
DoD JSIG	AU-2 a.11 - Print to a device (Success/Failure)

How to enable Print Service Audit Log Consolidation

• From the Explorer View expand Templates | Sample Templates | Log Consolidation | Print Events.
  
  Important

  If the template groups or templates do not exist, select Tools | Create Default Objects
• Right click on Event Log Consolidation - Microsoft-Windows-PrintService/Operational then click Template Properties. The Template Property View displays.
• From either the Hosts Drop-Down or the Host Groups Drop-Down, select the target items.
  
• Click the Close Button then when prompted click Yes to save your changes.
  Note

  If the log is not enabled, the software automatically enables the log when downloaded.

How to view Print Auditing Reports

• From the Explorer View expand Reports | Sample Reports | Event Logs | Print Events.
  
  Important

  If the report groups or reports do not exist, select Tools | Create Default Objects
• To see a report of all print events, right click on Print Events then select Properties
  Or
  To see a report of printed documents, right click on Print Events (307) then select Properties.
  The Report Properties View displays.
• Use the Options Tab to configure the filters (e.g. The Event IDs to include and the Users to exclude).
  
• Use the Columns Tab to configure the columns to include in the report, the sort order, sort direction and group by column options.
  
• Use the Date/Time Range Tab to specify the data and time range to include in the report.
  
• Use the Actions Tab to assign the On Complete actions (e.g. Save to HTML, CSV or PDF File and Send an Email).
  
• From either the Hosts Drop-Down or the Host Groups Drop-Down, select the target items.
  
• Click View Report to execute the report and see the results in the Management Console.
• Click Execute to execute the report and trigger the assigned actions.