howto audit printing?

[frank]

I want to audit successful print events on a windows 2000 print server. I
open the 'properties' dialog for a printer, select 'security' tab, and click
'advanced' button. I select 'auditing' tab and click the 'add' button. I
added 'everyone', checked the 'print' item, and clicked OK. Everyone
appears in the auditing entries list, type 'success', access 'print', it
looks good but no print events appear in the event log. I checked
application, security and system logs. Just in case there's a problem
specifying 'everyone', I also added my own personal login account to the
auditing list for this printer but still no print events when I send print
jobs to it.

What am I doing wrong? What's the correct way to audit print jobs in
windows 2000 server?

-Frank Brown
Seattle Fire Dept.
http://www.inwa.net/~frog/

 

[Guest]

Frank the best way you should do this is to go to
Start/Settings/Printers click File/Server Properties click
on the Advanced Tab and check the Log Spooler information
events and Notify when remote documents are printed. This
will add events in to the System log in the Event Viewer.
Then if you want to go further you can use DUMPEL.EXE
which is part of your W2kreskit.
Good Luck
Joe
GD in VA