none
Print Management Auditing Logs (Extra)

    Question

  • Hi Printer Mgt Gurus,

    I'm trying to locate more granular logs w/ regards to the the Operational Logs under EventViewer>App and Service>Microsoft>Windows>PrintService.

    The logs are great, but I noticed it does not capture Add/Removal of printer ports.  Also,  when making a configuration change to the printer, a generic event is generated that doesn't specify what part of the printer was modified (ie. Comment change, location change, port change, etc.)

    Anyone know if these logs are generated elsewhere in EventViewer?  I'm not opposed to any 3rd party auditing software to monitor these minute changes.  Thanks in advance for any replies on this.

    Thursday, April 03, 2014 4:23 PM

Answers

  • There is not a print spooler event when ports are added, deleted, or configured.

    The setprinter event does not keep a record of what changes were made to the share.


    Alan Morris Windows Printing Team

    Thursday, April 03, 2014 7:05 PM
    Answerer
  • The success on setprinter is logged.  In some cases a failure can be logged.  The previous state of the print queue is not retained and compared to the new state when writing this log. 

    Alan Morris Windows Printing Team

    Friday, April 04, 2014 12:47 AM
    Answerer

All replies

  • There is not a print spooler event when ports are added, deleted, or configured.

    The setprinter event does not keep a record of what changes were made to the share.


    Alan Morris Windows Printing Team

    Thursday, April 03, 2014 7:05 PM
    Answerer
  • Thanks Alan for addressing the port add/remove/configured change.

    What about comment and location changes?  These generate an Operational log event stating the following:

    Task Category: Setting printer configuration

    I'm looking for a bit more detail in log description, such as "Printer Comment Change."

    Thanks again for the prompt replies.


    Thursday, April 03, 2014 10:04 PM
  • The success on setprinter is logged.  In some cases a failure can be logged.  The previous state of the print queue is not retained and compared to the new state when writing this log. 

    Alan Morris Windows Printing Team

    Friday, April 04, 2014 12:47 AM
    Answerer