Tracking Printer Usage with Windows Event Viewer Logs

In Windows, you can track printer usage with the Event Viewer. All print jobs sent to the print spooler are logged in the Event Viewer. If you have a print server deployed on Windows, you can use these logs to organize a simple print audit solution that enables you to understand who has printed on your printers, when, and how many pages.

In this article, we will show how to enable and configure print event logging in Windows, view print history in the Event Viewer, and search or filter print events with PowerShell.

How to Enable Print Logging in Windows

Windows has a separate Event Viewer log where all printing events are logged: SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-PrintService%4Operational.evt. However, this log is disabled by default. To enable print logging on Windows:

1. Open the Event Viewer (eventvwr.msc);
2. Go to Applications and Services Logs -> Microsoft -> Windows -> PrintService.
3. Right-click the Operational and select Enable Log;
4. Increase the size of this event log from the default of 1MB if you want to keep print logs for a long time. Open Operational log properties and set the maximum log size;

You must enable a special GPO setting if you want the event log to show the file name sent for printing.

1. Open the Local Group Policy Editor (gpedit.msc);
2. Go to Computer Configuration -> Administrative Templates -> Printers.
3. Enable the option Allow job name in event logs;
4. Update policy settings using gpupdate /force command.

Now all print events will be logged in the Event Viewer.

Checking Print History on Windows Using Event Viewer

You can now see detailed information about all printing events that have occurred on this computer.

Open the Event Viewer and go to Applications and Services Logs -> Microsoft -> Windows -> PrintService -> Operational. Find the event with Event ID 307: Printing a document.

Open the event details:

Document 12, Microsoft Word - woshub.docx owned by maxadm on \\DESKTOP-PC617 was printed on HP LaserJet M1530 MFP Series PCL 6 through port USB001. Size in bytes: 31780. Pages printed: 1. No user action is required.

The event description contains:

• The name of the print file and the application from which it was printed: Microsoft Word — woshub.docx
• The name of the user who printed the file: maxadm
• The printer name: HP LaserJet M1530 MFP Series PCL 6
• Number of pages printed: Pages printed: 1
• The file size: size in bytes

Print Logs Analysis with PowerShell

The Event Viewer does not allow to get convenient statistics of print history or search by date/user/document. You can process and filter print events using PowerShell.

To get events from the PrintService/Operational log, use the Get-WinEvent PowerShell cmdlet. The following PowerShell script displays a list of all documents that have been printed on the current computer in the last 24 hours:

$all2dayprint=Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-PrintService/Operational"; ID=307; StartTime=(Get-Date).AddDays(-1)} | Select-object -Property TimeCreated, @{label='UserName';expression={$_.properties[2].value}}, @{label='Document';expression={$_.properties[1].value}}, @{label='PrinterName';expression={$_.properties[4].value}}, @{label='PrintSizeKb';expression={$_.properties[6].value/1024}}, @{label='Pages';expression={$_.properties[7].value}}
$all2dayprint|ft

If you only want to display documents that a particular user has printed:

$PrintUsername='maxadm'
$all2dayprint| Where-Object -Property UserName -like $PrintUsername|ft

You can export a list of printed documents into a CSV file using Export-CSV:

$all2dayprint | Export-Csv -Path "c:\ps\Print Audit.csv" –NoTypeInformation -Encoding UTF8

Or view it in a graphical Out-GridView form:

$all2dayprint| Out-GridView -Title "All print jobs"

You can schedule this PowerShell script to run daily and write printer usage information to an external database.