Is it possible to track user print usage statistics for a network printer?
In order to track print usage statistics follow the below steps:
1) The first thing that needs to be accomplished is to turn on Printer event auditing on the print server. The methods used to do this on each OS are a bit different but the idea is the same.
You can reference the following for information on how to do this using Windows Server 2003. Also Windows Server 2008/R2 instructions can be found in the community additions at the bottom of the page:
2) Download the attached Printed Documents.RDL file and put it in the Reports folder of your choosing on the server Netwrix Auditor is installed. By default this location is C:Program Files (x86)NetWrixEvent Log Manager Commercial VersionReportsNetWrix Event Log Manager.
3) Create an inclusive filter in Netwrix Auditor for Generic Events.
In the Netwrix Auditor console expand the managed object which contains the generic events feature -> Expand Generic Events -> Select Audit Archiving Filters -> Click Add to add a new filter.
The filter can have any name you choose however the event log should read Microsoft-Windows-PrintService/Operational. Verify this location in the Windows Event Logs of your print server in case yours is different.
On the Event Fields tab you will want to check Event ID: and specify event ID 307. At this point you can hit okay and have all 307 events get collected. If you want to further customize the filter to reduce the number of events collected you can use the rest of the Event Fields tab and the Insertion Strings tab. Find below the indexes and the type of data contained in their value for reference.
Note that %1 is a reference to index number 1. The insertion string for index one for example would be the job number.
%1: Job #
%2: Name of Document
%4: Source Computer
%5: Printer Name
%6: Printer Port on the server
%7: Size in Bytes
%8: Page Printed ?