Windows Printing Services

Document printing is essential for daily operations in many environments. The vast amount of printing requests increases the difficulty in tracking and identifying which document was printed and by whom. Documents forwarded to a printer for processing can be recorded for logging purposes in multiple ways. Each printing job can be logged either by a printing server, the printer itself, or the requesting machine. The logging of these activities permits early detection of printing certain documents. The following event is generated on the client machine requesting to print a document. This event should be treated as a historical record or an additional piece of evidence rather than an auditing record of printing jobs.This operational log is disabled by default and requires the log to be enabled to capture this event.

Sections on this page

SIEM Events

Printing Document

Event Source - Microsoft-Windows-PrintService - Event Log - Microsoft-Windows-PrintService/Operational

AIS Managed SIEM

Last modified March 30, 2021