Prerequisites

    Complete these prerequisites before adding print servers to ADAudit Plus.

    Requirements summary

    # Requirement Details
    1 ADAudit Plus administrator access Required to add print servers and configure collection settings.
    2 Supported Windows print server Required to generate the printer audit events collected by ADAudit Plus. See details.
    3 PrintService Operational log enabled Required for Real-time and Schedule modes. See Enable print auditing event logs on the print server.
    4 KB2919355 or KB2934016 where applicable Required on Windows Server 2012 R2 or 2012 to capture document names in event logs.
    5 `Allow job name in event logs` GPO enabled Required for document names to appear in reports. See Configure GPO to include document names in logs.
    6 Event Log Readers membership for the service or collection account Required to read the print server event logs (agentless collection only). See Windows Server Auditing Guide — Configure GPO to include document names in logs.3. Not required when using the Agent Configuration Guide's agent-based collection.
    7 Domain Admin or equivalent GPO rights Required to configure the GPO setting for document names.
    8 Network ports and collection privileges Both agentless and agent-based collection are supported for print servers. No additional ports or privileges are required specifically for printer auditing beyond standard Windows log collection. See the Windows Server Auditing Guide — Enable print auditing event logs on the print server for collection method planning, ports, and privileges, or the Agent Configuration Guide if using agent-based collection.
    9 Print Spooler service running Required for Print Listener mode and for normal print queue activity.

    Enable print auditing event logs on the print server

    Enable the PrintService Operational log on each Windows print server.

    Important ADAudit Plus does not configure this setting automatically. You must enable the Operational log manually on each print server, regardless of the event fetch mode you use in.
    1. Sign in to the print server.
    2. Open Event Viewer.
    3. Go to Application and Services Logs → Microsoft → Windows → PrintService.
    4. Right-click Operational and click Properties.
    5. Select Enable logging.
    6. Click Apply, then OK.
    Field or setting Value to use
    Navigation path Event Viewer → Application and Services Logs → Microsoft → Windows → PrintService
    Log to enable Operational
    Action Select Enable logging

    Tip Generate a test print job after enabling the log so you can confirm that Event ID 307 is being written.

    Configure GPO to include document names in logs

    If you want document names to appear in ADAudit Plus reports, configure the required Windows update and printer policy.

    Important ADAudit Plus does not configure this policy automatically. You must apply the Microsoft update and enable the Allow job name in event logs GPO setting manually for each print server.

    Confirm that the print server has the required Microsoft update:

    • KB2919355 for Windows Server 2012 R2
    • KB2934016 for Windows Server 2012
    • Open Group Policy Management Console (GPMC).
    • Edit the GPO that applies to the target print server OU, or create a dedicated printer auditing GPO.
    • Go to Computer Configuration → Policies → Administrative Templates → Printers.
    • Open Allow job name in event logs.
    • Select Enabled.
    • Click Apply, then OK.
    • Update Group Policy on the print server and wait for replication if required.
    Field or setting Value to use
    Policy path Computer Configuration → Policies → Administrative Templates → Printers
    Policy name Allow job name in event logs
    Required state Enabled
    Windows Server 2012 R2 prerequisite KB2919355
    Windows Server 2012 prerequisite KB2934016
    Important Without the update and policy, ADAudit Plus may still report print jobs, but the document name can be blank or incomplete.
    Note ADAudit Plus supports branch office direct printing only when the event fetch mode is Real-time or Schedule.