How to Enable or Disable Print Logging in Event Viewer in Windows 11

Most activities on your Windows computer can be seen on the system’s built-in logging feature. A tool made for this purpose is the Event Viewer, and it goes beyond system error logging. The Event Viewer printer logs in the PrintService section offer a detailed record of your printing activity. These activities include document names, printer names, user details, and print statuses.

While helpful, some users may want to turn the printer logs in Event Viewer off. In this guide, we will teach you how to configure printer logs in Event Viewer using both the graphical interface and PowerShell commands.

📌 Recommended deployment strategies:

Method 1: Enable or disable print logging using Event Viewer

📌 Use Cases:

This method is ideal for individual users who can easily navigate the Event Viewer graphical interface.

📌 Prerequisites: 

• Applies to all editions of Windows 11: These steps work across Windows 11 Home, Pro, and Enterprise editions.
• Administrator privileges are required: This method requires administrator rights.
• Log location: The log is located in Event Viewer under Applications and Services Logs > Microsoft > Windows > PrintService > Operational.

1. Open a Run dialog box by pressing the Windows key + R.
2. Type eventvwr.msc and press Enter.
3. In the Event Viewer window, navigate to: Applications and Services Logs > Microsoft > Windows > PrintService.
4. Click on Operational under PrintService.
5. Right-click Operational and select Enable Log to start logging.
6. To stop logging, right-click again and select Disable Log.

Once enabled, Windows will begin recording print job events, such as:

• Event ID 307: A document was printed successfully.
• Event ID 805: A printer error occurred.
• Other entries may include job start, cancellation, or failure details.

💡 NOTE: The log file is stored locally at: C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PrintService%4Operational.evtx

Method 2: Enable or disable print logging using PowerShell

📌 Use Cases:

This method is ideal for those who prefer command-line tools for scripting across multiple endpoints, implementing Group Policy startup scripts, and automating tasks.

📌 Prerequisites: 

• Applies to all editions of Windows 11: These steps work across Windows 11 Home, Pro, and Enterprise editions.
• Administrator privileges are required: This method requires administrator rights.
• Log location: The log is located in Event Viewer under Applications and Services Logs > Microsoft > Windows > PrintService > Operational

1. Press the Windows key to open the Start Menu. Type PowerShell. On the right pane of the search results, click Run as administrator. This will open an elevated PowerShell.
2. Run the following command:
   • To enable logging: wevtutil sl Microsoft-Windows-PrintService/Operational /e:true
   • To disable logging: wevtutil sl Microsoft-Windows-PrintService/Operational /e:false

⚠️ Things to look out for

Why manage print logging in Event Viewer?

There are several reasons why users configure printer logs in Event Viewer. Here are some of them:

• Aid for print tracking: Enabling print logging in Event Viewer provides historical data on print activities. The log data can show who prints what and when, which is critical, especially in shared or enterprise environments.
• Audit user access: Printer logs can be used to determine unauthorized printer access, which is critical to sensitive or high-volume printers in an organization.
• Enforce privacy: Disabling the printer log feature can strengthen privacy on personal devices or in sensitive locations.
• Troubleshooting: Users can look at the printer logs when print queues get stuck or printing jobs fail. The logs can help pinpoint the issue, making troubleshooting easier.

Additional considerations about Event Viewer print logging settings

Here are some factors you need to consider when configuring print logging in Event Viewer.

• Log size: The event log size may grow over time, especially when unchecked. Users can configure retention settings as highlighted in the Things to look out for section.
• Privacy: Enabling print logging in Event Viewer may pose a risk as logs may expose document names and user activity. Users can disable the feature for personal or sensitive-use environments.
• Central logging: Use Windows Event Forwarding (WEF) or SIEM for central collection in enterprise networks
• No restart needed: Logging configurations will apply immediately without rebooting the computer.

Managing the print logging in Event Viewer

The Event Viewer print logs are valuable and can be used for printer audits and troubleshooting. However, some users may prefer to disable print logging due to privacy concerns. Fortunately, Windows offers ways to configure the print log settings through Event Viewer or PowerShell. Whether you’re troubleshooting print failures or implementing print security in an enterprise, configuring Event Viewer printer logs can be helpful, depending on your system’s needs.

Related topics:

• How to Read Windows Event Logs: Shutdown and Restart
• Complete Guide: How to Read Windows Update Logs
• How to read Memory Diagnostics Tool results in Event Viewer in Windows 10