Auditing Printers in Windows Server 2012

If your organization has a need for auditing the use of printers, you can accomplish this with the Windows Event Logs.

Step 1: Configure Auditing.

Auditing can be configured through several means. Group Policy is the most effective because it is a centrally managed system and users are not able to turn it off. To enable auditing on the client/servers where the printer is managed, scope a GPO with these settings:

Expand Computer Configuration \ Policies \ Windows Settings Security Settings \ Local Policies \ Audit Policies.

Configure Audit object access to log success.

Close the GPO editor. You must make sure that this GPO is scoped for the target client and the policy is applied.

Step 2: Configure audit settings on the printer.

On your Windows 2012 or Windows 8 client, press the (Windows) key to bring up the start menu. For Windows Server 2008/7, click Start.

Type Printers and click Settings.

Click Devices and Printers.

Right click the printer that you want to perform auditing on and click Printer Properties.

Select the Sharing tab. You need to list this shared printer in Active Directory to enable Auditing.

Click Change Sharing Options and elevate your privileges if necessary,

Check List in the directory and then click Apply.

Click the Security tab and then click Advanced.

Click the Auditing tab.

Now click Add and the click Select a principal.

From here you can select the user or group that you want to audit. If you just want to audit who is sending print jobs to this printer, just audit for Print.

Click OK 3 times.

A word of caution. This will fill your security log very quickly. In testing, 35 events were generated from printing 1 page from Notepad. Consult your printer manufacture to see if they have management software for their product that will achieve your goals. Here is a link to the KB article warning you about this same issue. The information that is of value to you; username, printer, and document are located in multiple events in the message portion of the event. This is not something that you can easily scan through so a third party solution may be required.

Comments

Sticky Key problem between Windows Server 2012 and LogMeIn

This week I instructed my first class using Windows Server 2012 accessed via LogMeIn and discovered a Sticky Key problem every time you press the Shift key. Here is my solution to resolve this. First off, in the Preferences of LogMeIn for the connection to the Windows Server, click General . Change the Keyboard and mouse priority to Host side user and click Apply at the bottom. On the Windows 2012 server, open the Control Panel – Ease of Access – Change how your keyboard works . Uncheck Turn on Sticky Keys . Click Set up Sticky Keys . Uncheck Turn on Sticky Keys when SHIFT is pressed five times . Click OK twice. If you are using Windows Server 2012 as a Hyper-V host, you will need to redo the Easy of Use settings on each guest operating system in order to avoid the Sticky Key Problem. Updated Information: March 20, 2013 If you continue to have problems, Uncheck Turn on Filter Keys .

With the AD Recycle Bin Turned on, What Happens when you Create a User Account with a Password that does not meet the Password Policy?

This was an interesting observation from one of my Windows Server 2012 classes. While working with the AD Recycle bin in a lab, one of my students discovered some interesting accounts that were created. When he created user accounts that did not meet password complexity requirements, an account is temporarily made and then deleted. When a new password is provided that meets the password requirements, then a new account is made. We discovered this in two places. First off in the Active Directory Administrative Center. This is what caused the initial confusion. Take a look. This is in the Deleted Objects OU. You can see multiple deleted accounts for Test2 and one for Test3. Test3 is a valid, functioning user account. Using the PowerShell command Get-ADObject –IncludeDeletedObjects –Filter * –Properties ObjectSID we can see that indeed, two accounts were created, with one of them deleted. Notice the RID portion of the SID is different. ...

Where did a User’s Account Get Locked Out?

Updated: May 15, 2015 When this article was originally published, two extra carriage returns were add causing the code to malfunction. The code below is correct. My client for this week’s PowerShell class had a really interesting question. They needed to know where an account is being locked out at. OK, interesting. Apparently users hop around clients and forget to log off, leading to eventual lock out of their accounts. The accounts can be unlocked, but are then relocked after Active Directory replication. This problem is solved in two parts. The first one is to modify the event auditing on the network. The second part is resolved with PowerShell. The first part involves creating a group policy that will encompass your Domain Controllers. In this GPO, make these changes. Expand Computer Configuration \ Policies \ Windows Settings \ Security Settings \ Advanced Audit Policy Configuration \ Audit Policies \ Account Management Double click User Account Management C...

Jason Yoder, MCT

Search This Blog