In this article:

• Issue description

• Possible causes

• Prerequisites

• Resolution

• Related topics and articles

• How to reach support

Issue description  

This issue occurs when ADAudit Plus is unable to collect logs related to printer auditing. This can be due to configuration issues, permission restrictions, or missing audit policies.

Prerequisites  

• Ensure the monitored server is added and configured in ADAudit Plus.

• The ADAudit Plus service account must have the necessary permissions to read security event logs.

• Confirm that the required audit policies are enabled to track Printer Auditing events.

• Ensure the event log size is set to at least 4 GB to prevent log overwrites.

Possible Causes  

1. Insufficient or Incorrect Audit Policies ADAudit Plus may lack the necessary audit policies to ensure that events are logged whenever any activity occurs.

2. Desired Events Are Not Getting Logged The required event IDs are not being captured on Windows Domain Controllers, Windows servers, and workstations.

3. Incorrect Search Criteria The specified search criteria for the required data may be incorrect.

4. Unable to Log Events to Security Log (Event ID 521) Arises when the security event log fails to log events.

5. Log Collection Failure This might be due to Access Denied/RPC service unavailable error messages, preventing ADAudit Plus from collecting logs.    

Resolution Steps  

Verify Audit Policy Configuration

1. Log in using domain admin credentials to a computer with the Group Policy Management Console (GPMC).

2. Open GPMC > Right-click on Group Policy Results > Select Group Policy Results Wizard.

3. Select the computer and user (current user) and verify if the desired settings are configured.

4. If audit policies are missing, add and configure them accordingly.

• Audit Object Access – Success

• Audit Object Access – Failure

• Audit Print Service Operational Logs

        5. Run gpupdate /force to apply changes.

Ensure Desired Events Are Logged  

1. 1. Log in with domain admin credentials.

2. 2. Open Event Viewer (eventvwr.msc) and navigate to Windows Logs > Security.

3. 3. Verify if the following event IDs are present

• Event ID 307 A print job was successfully completed.

• Event ID 805 A print job was modified.

• Event ID 842 A print job was deleted.

• Event ID 843 A printer was added or removed.

Verify Search Criteria  

1. Click on Server Audit Tab > Printer Auditing.

2. Choose the Report and select the Domain.

3. Set the Period (Today, Yesterday, This Week, This Month). Define a custom period if needed.

4. Choose the required hours and select the objects for which you need the report.

Unable to Log Events to Security Log (Event ID 521)  

Since ADAudit Plus relies on Event Viewer, it retrieves events from there. A high number of Event ID 521 entries may indicate an issue with event logging. Follow these possible resolutions

1. Restart the Windows Event Log service.

2. Restart the affected server.

3. Check security log retention settings

• Ensure the maximum log size is sufficient and set to overwrite as needed.

Resolve Log Collection Failures  

• Follow the documentation to fix Access Denied/RPC Service Unavailable errors preventing log collection.

If you receive the error "A security package specific error occurred"  

This error is due to conflicting IP addresses with the same SPN for multiple machines. Ensure that

• The domain controller showing the error has forward and reverse lookup entries in DNS.

Preventive Measures and Best Practices  

• Regularly monitor audit policies and object-level auditing.

• Monitor ADAudit Plus for any errors or warnings.

• Keep ADAudit Plus updated to the latest version.

• Periodically verify Group Policy settings to ensure correct configurations.

• Enable centralized log storage to prevent data loss.   

Related Topics and Articles  

• Printer Auditing Guide

• Configure Event Log Settings

• Ports Guide

• Service Account configuration

When to Contact Support  

• If ADAudit Plus shows "No Data Available" even after configuring audit policies and verifying event logs.

• If the report displays repeated failures or data retrieval errors.

• If the dashboard continues to show incorrect or missing data after troubleshooting.

• If you suspect a bug within the ADAudit Plus software.

How to Contact