Windows 7 and print jobs logging

On the Windows 7 machine I just tested on, there are two PrintService logs. The Administrative one, and the Operational one. You have to explicitly enable the Operational log. (I already enabled mine, so pretend it says Enable instead of Disable.)

Now print something:

You might need to right-click that image and open in a new tab to get a better view. It will inform you of every job that is being spooled, printed, deleted, etc., and from what user it came from. Look at the log on the print server. For my test I just used the local XPS writer but imagine I was sending the job to a remote printer.

Edit: I forgot one more thing. In the Windows Audit Policy settings, through either the Group Policy or the Local Security Policy setting in the Administrative Tools section in the Control Panel.

After setting the Audit Policy, right-click the printer name in the Printers folder, click the Properties/Security/Advanced/Auditing menu item and add an audit entry for tracking printer activity. Audit entries will be recorded to the Security log, viewable through the Event Viewer.