All printers deleted from Print server

[Bhavin78]

all the printers were deleted from our print server, I want to figure out what time and by whom this was done. I did not find any thing in event viewer.
what should I do to log this type of things ?
and
how can I prevent this to happen?

 

[PU36]

Were you auditing anything?

There is a setting within GP that prevents users from deleting/adding printers. Enable it.

 

[Bhavin78]

Nothing was audited but event viewer should have logged that, right?

Printers were deleted on server, (for this can I use GP settings?)

where do I set auditing for printer deletion?

 

[LWComputingMVP]

Are you sure your server didn't just have the Print Spooler crash? If it crashes, then all the printers disappear.

Otherwise, to record this information, you would likely need to enable auditing for it to appear in the security log.

 

[Bhavin78]

where do I turn auditing on?
and
how can I find out that print spooler crashed?

 

[PU36]

Auditing can be turned on either local (Local Security Policy) or through a GPO through AD at the OU/Domain level.

 

[Bhavin78]

I have created Test OU and have added test computer to it, I will also add a test user to it.
1)now what particular group policy I need to turn on and where?

2)We have being facing some issue with File and printers permission I want to track who is doing what?

3)Many users logs on to domains/ exchange server/ file server etc and instead of logging off they end up shutting down. how can I prevent this from happening on all servers?