For the life of me I cannot figure out how to audit SUCCESSFUL print driver installs.
My organization basically has way too many admins (for political reasons I can’t reduce the # and my manager and I just seem to keep losing our fight with this one). Since we have so many admins I want to audit things and one of those is print driver installs.
We want to limit who can install drivers so we’ve defined a group who can. Of course our many admins feel the need to circumvent the system with their elevated privileges so we want to audit driver installs.
I can get my servers to generate an event in the event viewer when a driver install failed or is denied. But I can’t seem to find out how to audit successes. And all my google/bing searches have been fruitless.
Anyone have any suggestions? The would be appreciated.
Servers are Windows 2012 R2. All stand alone. No print clusters.