Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. Microsoft-Windows-PrintService%4Operational.evtx
LogRisk: Caution

Microsoft-Windows-PrintService%4Operational.evtx C:\Windows\System32\winevt\Logs\Microsoft-Windows-PrintService%4Operational.evtx

PrintService/Operational log, disabled by default: one 307 entry per printed document (user, printer, pages) once the channel is enabled.

Updated on By AltF4 Formation

What it’s for

The Microsoft-Windows-PrintService/Operational channel is disabled by default. Once enabled, it records every print job: the native way to know who printed what, on which printer, without a third-party audit product. The .evtx file therefore only fills up after you enable it. The neighboring PrintService/Admin channel is enabled and reports spooler and driver errors.

What it contains

  • 307: document printed, with the job number, document name, user, originating machine, printer, port, size in bytes and page count.
  • Other job tracking events (spooling, rendering), depending on the version.

Risks and best practices

  • The document name appears in clear text, so collection can expose confidential titles (payroll, disputes, customer files). Restrict access and set a retention period.
  • It grows fast on a print server: raise its maximum size before enabling it, or export it regularly.
  • Enable it on the print server, not on each workstation, when printers are shared through a server: that is where every job is visible.

Useful commands

Fenêtre de terminal
# Channel state
wevtutil gl "Microsoft-Windows-PrintService/Operational"


# Enable the channel (as administrator)
wevtutil sl "Microsoft-Windows-PrintService/Operational" /e:true


# Latest printed documents
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PrintService/Operational'; Id=307} -MaxEvents 30 |
    Select-Object TimeCreated, Message

Format

Binary XML file (.evtx). The “/” in the channel name becomes “%4” in the file name.

Rotation and archiving

Maximum size and behavior when full are set in the log properties or through Group Policy; wevtutil gl shows the configuration and wevtutil epl exports the log to an .evtx file.

How to read it

In Event Viewer, go to Applications and Services Logs, Microsoft, Windows, PrintService, Operational (right-click, Enable Log if it is disabled). Filter on ID 307; for a spooler incident, read PrintService/Admin instead.

Report a mistake