Overview

    Purpose of this guide

    Use this guide to configure ADAudit Plus for Windows print server auditing and to validate that print jobs are being collected correctly.

    ADAudit Plus helps you monitor who printed a document, what was printed, which printer was used, how many copies were requested, when the job was processed, and whether the print activity appears in reports for audit and investigation use cases.

    This feature is part of ADAudit Plus infrastructure auditing and is typically used with the Member Servers add-on for print servers hosted on Windows Server.

    What ADAudit Plus audits on print servers

    After print server auditing is configured correctly, ADAudit Plus can report on:

    • Document name or file name printed.
    • User who initiated the print job.
    • Number of copies requested.
    • Printer name.
    • Print server name.
    • Date and time of the print job.
    • Print job status and related operational context.

    The source log for printer auditing is the Microsoft-Windows-PrintService/Operational log on the Windows print server. ADAudit Plus correlates two event IDs from this single log per print job: 307 (job submission and completion) and 805 (job rendering diagnostics, including copy count, color mode, and print resolution/quality):

    Event Viewer → Application and Services Logs → Microsoft → Windows → PrintService → Operational

    Important Document names appear reliably only when the required Microsoft update and GPO setting described in [Configure GPO to include document names in logs are applied.

    Event collection modes

    ADAudit Plus supports three print event collection modes.

    Mode Event source Best use Branch office direct printing Notes
    Real-time PrintService Operational log Use when you need continuous collection from Event Viewer. Supported Recommended when you need ongoing log-based collection without waiting for a polling window.
    Schedule PrintService Operational log Use when you want collection at a fixed interval. Supported Good for controlled polling windows or lower-frequency collection.
    Print Listener Windows print queue via API Use when you want queue-level collection when the job starts. Not supported Does not support branch office direct print auditing.

    Use the following decision guide when selecting a mode:

    If you need to... Use this mode
    Collect print events continuously from the server log Real-time
    Collect print events at fixed intervals Schedule
    Capture print queue activity at job initiation Print Listener
    Audit branch office direct printing Real-time or Schedule

    Important If your environment uses branch office direct printing, do not use Print Listener mode.

    Supported Windows Server versions

    Printer server auditing supports Windows print servers running the following Windows Server versions.

    Windows Server OS version Status
    Windows Server 2008 / 2008 R2 Supported
    Windows Server 2012 / 2012 R2 Supported
    Windows Server 2016 Supported
    Windows Server 2019 Supported
    Windows Server 2022 Supported
    Windows Server 2025 Supported

    Note The legacy source material states "Windows Server 2008 and above." This guide presents a current planning table through Windows Server 2025 for customer readability.