I have a printer server running on Windows Server 2016 Standard. We use a tool called ADAudit for print job auditing. That tool uses the Print Job Diagnostics to determine attributes of the print job.
In Event Viewer, click Applications and Services Logs --> Microsoft --> Windows --> Print Service --> Operational
Specifically Event ID 805.
Within the tool, it is showing that several of our print jobs are color, when in fact they are not color. Many of the printers are not capable of color printing. In the event viewer log, the Color = 2 which the vendor indicates this equals a color print job. What would cause a event to show Color = 2 when the print job is not in fact color?
<System>
<Provider Name="Microsoft-Windows-PrintService" Guid="{747EFXXXXXX42C90F6873A1}" />
<EventID>805</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>43</Task>
<Opcode>0</Opcode>
<Keywords>0x4004000000000000</Keywords>
<TimeCreated SystemTime="2024-03-05T19:08:07.107871200Z" />
<EventRecordID>16889117</EventRecordID>
<Correlation />
<Execution ProcessID="1876" ThreadID="30116" />
<Channel>Microsoft-Windows-PrintService/Operational</Channel>
<Computer>XXXXXXXX</Computer>
<Security UserID="S-1-5-21-61145XXXXXXXX2791024-4064" />
</System>
- <UserData>
- <RenderJobDiag xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events"> <JobId>43</JobId> <GdiJobSize>92364</GdiJobSize> <ICMMethod>1</ICMMethod> <Color>2</Color> <XRes>600</XRes> <YRes>600</YRes> <Quality>600</Quality> <Copies>1</Copies> <TTOption>3</TTOption> </RenderJobDiag> </UserData> </Event>