SIEM, Log Management, Security, Compliance, Server Monitoring and Uptime Monitoring Software

How to Audit Print to Device Events

November 22nd, 2021

Windows writes Print to Device events to the Microsoft-Windows-PrintService/Operations Event Log. Auditing is accomplished by consolidating these log entries to a central log database then scanning the log entries for specific criteria. Server Manager includes several sample filters, templates and reports to provide out-of-the-box print to device compliance and auditing support. The filters look at specific log entries. The templates download and save the audit log entries. The reports scan the consolidated log entries, filter the entries, then report the results.

Who Requires Print To Device Auditing?

SpecificationSection
DoD JSIGAU-2 a.11 - Print to a device (Success/Failure)

How to enable Print Service Audit Log Consolidation

  • From the Explorer View expand Templates | Sample Templates | Log Consolidation | Print Events.
    Print Auditing Templates
    Important
    If the template groups or templates do not exist, select Tools | Create Default Objects
  • Right click on Event Log Consolidation - Microsoft-Windows-PrintService/Operational then click Template Properties. The Template Property View displays.
  • From either the Hosts Drop-Down or the Host Groups Drop-Down, select the target items.
    Select Hosts Select Host Groups
  • Click the Close Button then when prompted click Yes to save your changes.
    Note
    If the log is not enabled, the software automatically enables the log when downloaded.

How to view Print Auditing Reports

  • From the Explorer View expand Reports | Sample Reports | Event Logs | Print Events.
    Print Auditing Reports
    Important
    If the report groups or reports do not exist, select Tools | Create Default Objects
  • To see a report of all print events, right click on Print Events then select Properties
    Or
    To see a report of printed documents, right click on Print Events (307) then select Properties.
    The Report Properties View displays.
  • Use the Options Tab to configure the filters (e.g. The Event IDs to include and the Users to exclude).
    Print Audit Report Options
  • Use the Columns Tab to configure the columns to include in the report, the sort order, sort direction and group by column options.
    Print Audit Report Columns
  • Use the Date/Time Range Tab to specify the data and time range to include in the report.
    Date Range Options
  • Use the Actions Tab to assign the On Complete actions (e.g. Save to HTML, CSV or PDF File and Send an Email).
    On Complete Actions
  • From either the Hosts Drop-Down or the Host Groups Drop-Down, select the target items.
    Select Hosts Select Host Groups
  • Click View Report to execute the report and see the results in the Management Console.
  • Click Execute to execute the report and trigger the assigned actions.
November 22nd, 2021