Announcement

Collapse
No announcement yet.

Auditing Printer Deletion

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Auditing Printer Deletion

    Hi Folks

    Is there any way to audit printer deletion in Win 2003 server?
    The Printer Auditing at the NTFS level doesn't give us the option to audit Deletion. Is there another way to accomplish this??

    Thanks in advance
    Caesar's cipher - 3

    ZKHQ BRX HYHQWXDOOB GHFLSKHU WKLV BRX ZLOO UHDOLVH LW ZDV D ZDVWH RI WLPH!

    SFX JNRS FC U6 MNGR

  • #2
    Re: Auditing Printer Deletion

    There's no auditing for printer deletion.

    What you need is a utility to consume the event log. Printer deletion and print job information is written there.

    http://windowsitpro.com/windowsscrip...y-utility.html
    Andrew

    ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

    Comment


    • #3
      Re: Auditing Printer Deletion

      ...or you could set auditing on the printer's registry key.

      HKLM \System\CurrentControlSet\Control\Print\Printers \<printer name>

      When the printer gets deleted, so does this key.


      Tom
      For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

      Anything you say will be misquoted and used against you

      Comment


      • #4
        Re: Auditing Printer Deletion

        Originally posted by Stonelaughter View Post
        ...or you could set auditing on the printer's registry key.

        HKLM \System\CurrentControlSet\Control\Print\Printers \<printer name>

        When the printer gets deleted, so does this key.
        Good suggestion.

        No need to audit the individual printers by name, just the "HKLM\System\CurrentControlSet\Control\Print\Print ers" key and delete subkey.
        One small problem. You'll get spammed by remote desktop printers that have been redirected.
        Last edited by ahinson; 29th September 2008, 21:18.
        Andrew

        ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **

        Comment

        Working...
        X