Print tracking
Roll out the PrintSentinel Print Agent with Group Policy to record who printed what, where and from which PC.
With the Enterprise plan, a small PrintSentinel Print Agent on each PC reads Windows’ own print log and sends it to your server. No print server and no driver changes are needed. Only operators see the Printing page. Tell your staff that printing is recorded, as your policy and local law require.
Requirements: sharing switched on at the server, PCs that can reach it on TCP 47631, and Windows 10 1903 or later, or Windows 11.
1. Save the agent files
On the server, Settings → Print tracking → Save agent files… into an empty folder. You get PrintSentinelPrintAgent.exe, print-agent-config.json (the server address, its certificate fingerprint and the print-reporting key) and an install script. The key can only send print events, but treat the file like a password.
2. Put them on a locked-down share
Every PC runs the agent from this folder as SYSTEM, so nobody but IT may write to it. Create a folder of its own, share it as PrintSentinelAgent$, and allow only:
| Where | Who | Permission |
|---|---|---|
| Share | Domain Computers / Administrators | Read / Full control |
| Folder (NTFS) | Domain Computers | Read & execute |
| Folder (NTFS) | Administrators, SYSTEM | Full control |
Disable inheritance on the folder and remove every other entry, including Users, Authenticated Users and Everyone.
3. Add a Group Policy startup script
- Computer Configuration → Policies → Windows Settings → Scripts → Startup → Add
- Script name:
\\fileserver\PrintSentinelAgent$\ PrintSentinelPrintAgent.exe - Parameters:
--install --config \\fileserver\PrintSentinelAgent$\ print-agent-config.json - Enable Always wait for the network at computer startup and logon.
At the next restart each PC installs the agent as a service and turns on the print log. A newer agent on the share replaces the installed one at the next restart. To install on one PC by hand, run the same command in an administrator prompt.
4. Check that PCs report
Settings → Print tracking → Reporting PCs lists each PC a few minutes after its agent starts, even before anyone prints. On first start a PC sends the last 7 days of its print log. Agents check in every 6 hours, so a PC not seen for over a day was off or can’t reach the server.
5. Try your drivers first
Pages are what the printer driver reported to Windows, and drivers differ. Print a known document single-sided, double-sided and as 2 copies from a PC with each driver you use, then compare with the Printing page.
Document names
Settings → Print tracking → Record document names decides whether file names are kept. Switching it off erases the names already stored in the database; older backups keep them until they roll off.