This is a bit of a long shot, however, someone's printed a huge amount and not claimed it, so, we wanted to see who's responsible, without asking a few obvious suspects!

I had a look around on the server and nothing jumped out - I'm guessing this kind of functionality would require configuration and perhaps third party software?

I'm not looking for anything mega complex, just something containing info such as:

Machine/User
Printer Name
Document Name
Date/Time

I appreciate it may be too late to find info for this doc, that's not really a huge concern but going forward it would be nice!

The domain has around 60 users, printing is not typically high volume.

Hi,

Thanks for the post.

Unfortunately, Windows Server 2008 does not provide this kind of function to monitor the print jobs with these information. It should be a lot of third party program regarding the print job monitoring.

Hope this helps.

• Marked as answer by Miles ZhangModerator Thursday, October 22, 2009 2:19 AM

Thanks for the clarification Miles, that's a shame, but at least I didn't spend hours trying to figure out where it was!

• Proposed as answer by SvenP70 Thursday, April 15, 2010 12:38 PM

Windows Server 2008 DOES have functionality to monitor the print jobs, they are just turned of by default.


Diagnostics -> Event Viewer ->Applications and Service Logs-> Microsoft -> Windows -> Print Service -> Operational -> Enable log

• Proposed as answer by OptimAdam Wednesday, November 18, 2009 4:53 PM

When I look on my 2008 print server, I don't have the Print Service at the Diagnostics -> Event Viewer -> Applications and Service Logs -> Microsoft -> Windows ->    location. Why??

• Proposed as answer by JCM2 Thursday, May 19, 2011 1:42 PM
• Unproposed as answer by JCM2 Thursday, May 19, 2011 1:42 PM

OptimAdam is incorrect stating this for 2008.  The log location is in Windows 7, Server 2008 R2.  Look in the system event log for print events on Server 2008.

I was trying to do this on a Server 2008-32bit install, and yes it's turned off by default.

To turn it on:  Start > Settings > Printers > File > Run as Administrator (2nd one down with the submenu) > Server Properties > Advanced > "Log spooler information events".  All print jobs will now show up in the System Event log.

• Proposed as answer by Chuck_Saunders Tuesday, August 24, 2010 2:31 PM

Burt, thanks for this post.  It was exactly what I was looking and does indeed record the correct information to the log for later review.

BULLSEYE !   Wish it was on by default, but that does it!  THANKS.

• Proposed as answer by JCM2 Thursday, May 19, 2011 2:24 PM
• Unproposed as answer by JCM2 Thursday, May 19, 2011 2:24 PM

I was trying to do this on a Server 2008-32bit install, and yes it's turned off by default.

To turn it on:  Start > Settings > Printers > File > Run as Administrator (2nd one down with the submenu) > Server Properties > Advanced > "Log spooler information events".  All print jobs will now show up in the System Event log.

I cant find It.....There is no setting button in start menu(2008 R2 standard 64 bit). even in devices and printer there is no file button... Kindly help.

In 2008 R2 do:

Control Panel - Printers,  Server Properties,   Log spooler information events

Posted for the next person who gets here by google.

 

Windows 2000/2003: This exceptionally useful feature is enabled by default.

Windows 2008 R1: Start --> Control Panel --> Printers --> Server Properties --> Advanced --> Log spooler information events

Windows 2008 R2: Server Manager --> Event Viewer --> Applications and Service Logs --> Microsoft --> Windows --> Print Service --> Operational --> Enable log

Also as an FYI to the WMI scripters out there, the source of the events is "Microsoft-Windows-PrintSpooler", even though it only displays as PrintSpooler. If you're writing a WMI query againt Win32_NTLogEvent, and you want it to work on 2k3 and 2k8, you have to use like '%PrintSpooler'.

 

Now if anyone know why Microsoft insists on making each version of the OS more unfriendly with even more clicks to complete a task, please let me know.

• Proposed as answer by DaneKan Monday, February 27, 2012 6:18 PM

Once you've enabled logging, make the event log more accessible:

- Right Click "Custom Views"

- Create Custom View

- Check all Event levels

- In the "By Log" drop down, find the "Print Service - Operational" Log and check it

- Click ok, give it a name, click ok again.

Voila, your new event log is at the top level of the event viewer.

 

• Proposed as answer by Nicolas C13160 Thursday, December 13, 2012 9:33 AM

Even a year later this was great information. Thank you for your help...

IdontWanna, your instructions are indeed correct for R2. It is not under the server properties of the print spooler like it was in the past pre-R2. Thanks

I had noticed this lack of logging awhile back but thought I must be missing something and put it in the "look into more later" pile, how could MSFT disable logging print jobs?  I've always thought the level of reporting on print jobs is already insufficient in Windows, that they couldn't have possibly have made it any less informative? ...but they did.

In my dream world I'd be able to not only pull up the transactional log as you always have, but quickly generate fancy pie charts showing which users are printing the most, what programs are outputting the most print jobs, etc...   Does anyone know any good tool that does this via WMI queries?

I know this is an old one but I have just come across it looking for something else and though it might be a good idea to post this link -

Audit Windows Printing

This is for working on Windows Server 2003 but I'm sure it could be modified easily enough for use on Server 2008. I have used it and it works really well.

"Once you've enabled logging, make the event log more accessible:

- Right Click "Custom Views"

- Create Custom View

- Check all Event levels

- In the "By Log" drop down, find the "Print Service - Operational" Log and check it

- Click ok, give it a name, click ok again.

Voila, your new event log is at the top level of the event viewer."

The option "Print Service - Operational" does not exist in Server 2008 Enterprise w/SP2 x86. Please advise as to an alternate log to monitor? 

The option "Print Service - Operational" does not exist in Server 2008 Enterprise w/SP2 x86. Please advise as to an alternate log to monitor? 

If it's not a R2 Windows, you should have like "IDontWanna" said above...

-- 
Philippe Ferrucci
www.AmigaOS.net

• Edited by GimelLavergne Wednesday, July 11, 2012 1:34 PM

This post has a great script that details how to enable the logs and use powershell to filter through history.  Worked great for me!

http://mywinsysadm.wordpress.com/2012/07/16/powershell-audit-printer-event-logs/

• Edited by bbickett Saturday, July 28, 2012 9:13 PM
• Proposed as answer by bbickett Saturday, July 28, 2012 9:13 PM

OptiAdam's answer is 100% correct. This post should really have OptiAdam's answer as the "Marked" answer and not the one by Miles Zhang. I think it's &*&%  that a moderator marks his stuff as the answer and does not properly assign the answer (and points) to the person who actually contributed a solution...just my two cents.

Windows 2008 R1: Start --> Control Panel --> Printers --> Server Properties --> Advanced --> Log spooler information events

Mine is grayed out. Any idea how I can enable that box?? I'm local admin and domain admin, etc!!

By default the UI opens in user context so you cannot modify these.

Add Printer tools, then launch printmanagement.msc.  Use the management tools for perfoming admin work.

Thank you!! In addition to opening printmanagement.msc, I expanded Print Servers --> right-clicked my print server name--> Properties --->Advanced--->checked Log Spooler information events. 

Thanks so much, Alan!

Try the free program from PaperCut (www.papercut.com).  There's a free software download called PaperCut Print Logger.  I've found this to be very useful as it can view the print logs as HTML or Excel/CSV on a daily basis.  Each entry shows the time stamp of the print job, the user, the number of pages printed, the printer used, and even the printed document source.

- JP Babiera

• Edited by LakeAveIT Friday, March 01, 2013 11:10 PM added more info
• Proposed as answer by LakeAveIT Friday, March 01, 2013 11:10 PM
• Unproposed as answer by LakeAveIT Saturday, March 02, 2013 12:01 AM

+1 for PaperCut

We use their PaperCut-NG to do auditing of our printers and it also gives us a log of what was printed and by whom.  If you just need the logger and not the other most excellent features then the Print Logger should work.

You need to enable logging on your print server first, then it gets written to the Event Log.  With a bit of PowerShell magic you can get this presented in an easy to manipulate grid/table window (allows filter/sort etc).

See http://vblog.strutt.org.uk/2013/06/whos-printing-what/ for more info

Many thanks to DaneKan! This worked perfectly!

I would add that if you only want to see what was printed under 2k8R2 you should filter by the event ID 307.

xDMaynarDx- You are correct. Windows 2008 SP2 (ver 6.0.6002) does not have a "Print Service - Operational" container. You can still see the logs if you've enabled them as previously stated, but they show up in the "System" log in the Windows Logs folder.

The standard informational event will be Event ID 10 with a source as PrintSpooler.

Likely too late to help you, but maybe someone else will find it useful (as I would have about 10 minutes ago!).

Windows Server 2008 DOES have functionality to monitor the print jobs, they are just turned of by default.


Diagnostics -> Event Viewer -> Applications and Service Logs -> Microsoft -> Windows -> Print Service -> Operational -> Enable log

This is the best response. It really should be marked as such but this thread is over 6 years old. For shame, OP.

I already did that and i found the logs. But the logs shows the Ip but i actually want the host name. Please help if possible.