How to Track Print History in Windows

This tutorial demonstrates how to see print history in Windows, and includes instructions for both Windows 11 and Windows Server. It also shows you how to track print history using the Windows Event Viewer. Furthermore, the tutorial shows how to use PowerShell scripting to collect print history information such as document names, printer, timing, and which user is printing. Steps are also provided for automating the export of print logs to CSV format.

Does Windows save print history?

By default, Windows does not save a history of what has been printed. You must enable print logging by following the steps below for your preferred method.

Where is print history stored?

To see the print history, you need to use the Windows Event Viewer, where it is stored in both Windows 11 and Windows Server. Note that the duration that print logs are stored for is configurable, and once that period has passed, they are removed from the Event Viewer permanently.

You can also export print history using PowerShell scripting, which is described below. This lets you customize and consolidate the collection of reports in a central repository. This is useful for IT teams and managed service providers (MSPs) who want to create a traceable print history, record standardized evidence for auditing, internal reviews, or compliance purposes.

How do I check printer logs in the Event Viewer?

To check Windows printer logs in the Event Viewer, you’ll need the following prerequisites.

For Windows 11 users on standalone devices:

• A local administrator account
• An optional location for storing exported logs

For IT administrators working on multiple machines or Windows Server:

• Administrative rights on target endpoints or print servers
• Storage location for scheduled CSV exports and evidence
• Decision on whether to capture document names in logs (based on internal policy or privacy compliance requirements)
• Change window to enable and size the print log

Enable a short-term print history in Windows 11

Windows 11 has a basic option for how to see print history (that keeps completed print jobs in the print queue for each device temporarily) for users who don’t want to use the Event Viewer.

• Open Settings > Bluetooth & devices > Printers & scanners
• Select your printer from the list
• Click Printer properties and then Change Properties (if you’re not logged in as an administrator, you’ll be prompted for credentials)
• Under the Advanced tab, check the Keep printed documents checkbox

This allows you to review a history of printed documents for that printer by navigating to your printer in the Settings app, then clicking Open Print Queue.

Step 1: Enable print history logging

Advanced users, or IT administrators who require more detail, control, or are working in a domain environment, should instead use the Windows Event Viewer. To do this, you’ll first need to enable print history logging:

• Right-click on the Start button and open the Event Viewer
• Expand Applications and Services Logs, then navigate to Microsoft > Windows > PrintService > Operational
• In the Actions sidebar, click Enable Log
• Click Properties in the Actions sidebar, and set an appropriate Maximum log size, and choose whether to overwrite logs once the maximum is reached, archive full logs, or prevent events from being overwritten
• Print a test document to confirm that new print jobs produce Event Viewer entries

Step 2: Filter and review Event Viewer events

You can filter events in the Event Viewer by clicking Filter Current Log… in the Actions pane while viewing the Operational PrintService log. This allows filtering by time, event level, user, computer, and keywords. Filter to event ID 307 for printed documents.

Step 3: Export from the Event Viewer and automate CSV exports using PowerShell

In the Event Viewer, click Save all Events As in the Actions pane while viewing the PrintService Operational log. The filtered list of events will be exported to a .evtx file that can be read by the Event Viewer.

To export a CSV file that can be read anywhere, use the following PowerShell script:

$printEvents = Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational ` -FilterXPath “*[System/EventID=307]”

$printEvents | Select-Object TimeCreated, Id, LevelDisplayName, Message | Export-Csv -Path “.\Print_307_Events.csv” -NoTypeInformation

Step 4: Apply privacy controls

Depending on the data privacy and protection rules that cover your organization, you may need to tweak this script if it reveals sensitive information (for example, redacting document names if they include personal details). Store these exported printer logs securely to prevent data leaks.

Step 5: Correlate printer usage when troubleshooting

When troubleshooting unexpected printer usage or abuse, you can use your exported logs to gain historical context and hunt down the source of print jobs. By including user or device in your captured data, you can speed up resolution times by immediately identifying where a print job came from.

You can also use this data to automatically limit printer usage once thresholds are met, or bill users for resource usage.

Step 6: Review and retain historical data for insights

Regularly prune exported print logs when they are no longer useful, ideally using automation to clear old log files. Summarized data, such as totals by time period, can be retained without privacy concerns, while still being useful for identifying anomalous usage.

NinjaOne consolidates print history log collection across your entire network

For troubleshooting, auditing, or accountability, schedule regular print history exports using the automation features that come as part of NinjaOne remote monitoring and management (RMM). You can schedule PowerShell scripts on remote endpoints and servers that collect print history data, automatically redact sensitive fields, and then send that data for centralized logging and analysis.

As data ages, you can automatically summarize it and store it in NinjaOne documentation for future review during audits and quarterly business reviews (QBRs). You can also automate the deployment and management of printers across Windows, macOS, and mobile devices, and automatically resolve issues using remediation scripts, streamlining a traditionally laborious component of IT support operations.