If your organization has a need for auditing the use of printers, you can accomplish this with the Windows Event Logs.
Step 1: Configure Auditing.
Auditing can be configured through several means. Group Policy is the most effective because it is a centrally managed system and users are not able to turn it off. To enable auditing on the client/servers where the printer is managed, scope a GPO with these settings:
Expand Computer Configuration \ Policies \ Windows Settings Security Settings \ Local Policies \ Audit Policies.
Configure Audit object access to log success.
Close the GPO editor. You must make sure that this GPO is scoped for the target client and the policy is applied.
Step 2: Configure audit settings on the printer.
On your Windows 2012 or Windows 8 client, press the (Windows) key to bring up the start menu. For Windows Server 2008/7, click Start.
Type Printers and click Settings.
Click Devices and Printers.
Right click the printer that you want to perform auditing on and click Printer Properties.
Select the Sharing tab. You need to list this shared printer in Active Directory to enable Auditing.
Click Change Sharing Options and elevate your privileges if necessary,
Check List in the directory and then click Apply.
Click the Security tab and then click Advanced.
Click the Auditing tab.
Now click Add and the click Select a principal.
From here you can select the user or group that you want to audit. If you just want to audit who is sending print jobs to this printer, just audit for Print.
Click OK 3 times.
A word of caution. This will fill your security log very quickly. In testing, 35 events were generated from printing 1 page from Notepad. Consult your printer manufacture to see if they have management software for their product that will achieve your goals. Here is a link to the KB article warning you about this same issue. The information that is of value to you; username, printer, and document are located in multiple events in the message portion of the event. This is not something that you can easily scan through so a third party solution may be required.
Comments