Advertisement
In a Windows 2000 or later domain, is it possible to audit when specific files are printed?
Unfortunately, no. The OS knows when an application opens a printer object and starts pumping in data to be printed, but it can't determine that the data source is a particular file. In the Security log, you can track whenever someone prints to an object by enabling the Audit object access events policy and then enabling auditing under the printer's Properties. However, Windows can tell you—through event ID 560 (Object Open)—only that a user opened the printer for print access, nothing more.
