Event ID: 10 1

[viciousdogs]

I have a Win2k server set up as a print server. The System Logs are filling up with Event ID: 10 Source: Print. It looks like auditing has been enabled on the printers but I sure don't remember setting it (or even where to enable it) and audit logs would be under the Security Log anyway, wouldn't they?

How do I prevent these entries?

 

[GrnEyedLdy]

ViciousDogs,

Not familiar with the Event ID 10 but as far as where you enable auditing;

In order to audit an Object such as a printer in Win2K, you must first enable auditing within a GPO.

Check for any GPO's applied to the domain that have enabled 'Audit Object Access'. You will find this under - Computer Configuration|Windows Settings|Security Settings|Local Polices|Audit Policy

Also, the Object that you want to audit must have auditing turned on for it. Right click the Printer Object and choose Properties. Select Security, Advanced and then click the Auditing tab. If auditing has been turned on for this object you will see it here.

Hope this helps,

Patty

 

[viciousdogs]

I checked the GPO. The Audit object access is set to No Auditing with an effective setting of Failure. The Security|Auditing tab on the printer doesn't show any entries.

 

[GrnEyedLdy]

Well then the printer is not set up to be audited. I tried to research your Event ID, but found nothing on it. Are you certain of the Event ID number?


Patty

 

[viciousdogs]

'fraid so. The full description of the entry reads:

Document 68, <filename> owned by <username> was printed on <printername> via port <ipaddr>. Size in bytes: <size of job>; pages printed: <# of pages>

For more information, see Help and Support Center at

http://go.microsoft.com/fwlink/events.asp.

Of course the link to MS doesn't have any information.

Every print job generates an informational message like this one.

 

[Scruby]

Indicates a successul printing. To disable this type of messages follow these steps:
- On the server open the Printers folder.
- In the File menu you will find &quot;Server Properties&quot;.
- Use the Advanced tab to configure the logging level.
You have to restart the server for the changes to take effect. Just restarting the Spooler service is not enough.

If the number of pages is listed as 0 (with 0 bytes) then see Q232230 and Q319198.

If the job is listed as being owned by ANONYMOUS LOGON, then see Q323909. There is a fix available for this.

P.S. is this a USB printer?

Scruby

 

[viciousdogs]

Thanks, Scruby! That took care of it.

BTW, it's an HP8100dn network printer.