Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Windows Server 2019 / Tracking Printer Usage with Windows Event Viewer Logs

March 12, 2024

Tracking Printer Usage with Windows Event Viewer Logs

In Windows, you can track printer usage with the Event Viewer. All print jobs sent to the print spooler are logged in the Event Viewer. If you have a print server deployed on Windows, you can use these logs to organize a simple print audit solution that enables you to understand who has printed on your printers, when, and how many pages.

In this article, we will show how to enable and configure print event logging in Windows, view print history in the Event Viewer, and search or filter print events with PowerShell.

Contents:
  • How to Enable Print Logging in Windows
  • Checking Print History on Windows Using Event Viewer
  • Print Logs Analysis with PowerShell

How to Enable Print Logging in Windows

Windows has a separate Event Viewer log where all printing events are logged: SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-PrintService%4Operational.evt. However, this log is disabled by default. To enable print logging on Windows:

  1. Open the Event Viewer (eventvwr.msc);
  2. Go to Applications and Services Logs -> Microsoft -> Windows -> PrintService.
  3. Right-click the Operational and select Enable Log; Enable print logging in Event Viewer
  4. Increase the size of this event log from the default of 1MB if you want to keep print logs for a long time. Open Operational log properties and set the maximum log size; Increase printing events log size
You can also enable (disable) a specific event log with the command:

wevtutil.exe sl Microsoft-Windows-PrintService/Operational /enabled:true

You must enable a special GPO setting if you want the event log to show the file name sent for printing.

  1. Open the Local Group Policy Editor (gpedit.msc);
  2. Go to Computer Configuration -> Administrative Templates -> Printers.
  3. Enable the option Allow job name in event logs; GPO: Allow job name in event logs
  4. Update policy settings using gpupdate /force command.

Now all print events will be logged in the Event Viewer.

Checking Print History on Windows Using Event Viewer

You can now see detailed information about all printing events that have occurred on this computer.

Open the Event Viewer and go to Applications and Services Logs -> Microsoft -> Windows -> PrintService -> Operational. Find the event with Event ID 307: Printing a document.

Open the event details:

Document 12, Microsoft Word - woshub.docx owned by maxadm on \\DESKTOP-PC617 was printed on HP LaserJet M1530 MFP Series PCL 6 through port USB001. Size in bytes: 31780. Pages printed: 1. No user action is required.

The event description contains:

  • The name of the print file and the application from which it was printed: Microsoft Word — woshub.docx
  • The name of the user who printed the file: maxadm
  • The printer name: HP LaserJet M1530 MFP Series PCL 6
  • Number of pages printed: Pages printed: 1
  • The file size: size in bytes

Audit printing events in Windows Event Viewer

Print Logs Analysis with PowerShell

The Event Viewer does not allow to get convenient statistics of print history or search by date/user/document. You can process and filter print events using PowerShell.

To get events from the PrintService/Operational log, use the Get-WinEvent PowerShell cmdlet. The following PowerShell script displays a list of all documents that have been printed on the current computer in the last 24 hours:

$all2dayprint=Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-PrintService/Operational"; ID=307; StartTime=(Get-Date).AddDays(-1)} | Select-object -Property TimeCreated, @{label='UserName';expression={$_.properties[2].value}}, @{label='Document';expression={$_.properties[1].value}}, @{label='PrinterName';expression={$_.properties[4].value}}, @{label='PrintSizeKb';expression={$_.properties[6].value/1024}}, @{label='Pages';expression={$_.properties[7].value}}
$all2dayprint|ft

PowerShell: list print history on Windows

If you only want to display documents that a particular user has printed:

$PrintUsername='maxadm'
$all2dayprint| Where-Object -Property UserName -like $PrintUsername|ft

You can export a list of printed documents into a CSV file using Export-CSV:

$all2dayprint | Export-Csv -Path "c:\ps\Print Audit.csv" –NoTypeInformation -Encoding UTF8

Or view it in a graphical Out-GridView form:

$all2dayprint| Out-GridView -Title "All print jobs"

View Windows print statistics with PowerShell

You can schedule this PowerShell script to run daily and write printer usage information to an external database.

For example, you can write data from PowerShell script to MySQL, MariaDB, or Microsoft SQL Server database.
2 comments
8
Facebook Twitter Google + Pinterest
PowerShellWindows 10Windows Server 2019Windows Server 2022
previous post
PowerShell: Configure Certificate-Based Authentication for Exchange Online (Azure)
next post
Zabbix: How to Get Data from PowerShell Scripts

Related Reading

How to Restore Deleted EFI System Partition in...

March 11, 2024

How to Run Program without Admin Privileges and...

June 8, 2023

Fix: Remote Desktop Licensing Mode is not Configured

August 24, 2023

How to Install Remote Server Administration Tools (RSAT)...

March 17, 2024

Refresh AD Groups Membership without Reboot/Logoff

March 15, 2024

How to Find the Source of Account Lockouts...

March 12, 2024

Fix: BSOD Error 0x0000007B (INACCESSABLE_BOOT_DEVICE) on Windows

March 17, 2024

How to Delete Old User Profiles in Windows

March 15, 2024

2 comments

Cycu October 24, 2023 - 6:46 pm

how can i get a number of copies?

Reply
admin October 25, 2023 - 6:00 am

The “Pages printed” attribute shows a summary of the number of pages printed in this print job (including copies).

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Configuring Windows Protected Print Mode (WPP)

    May 19, 2025
  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • Install and Manage Windows Updates with PowerShell (PSWindowsUpdate)
  • Fix: Remote Desktop Licensing Mode is not Configured
  • How to Delete Old User Profiles in Windows
  • Configuring Port Forwarding in Windows
  • How to Install Remote Server Administration Tools (RSAT) on Windows
  • Start Menu or Taskbar Search Not Working in Windows 10/11
  • Adding Drivers into VMWare ESXi Installation Image
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top