Configuration setup

Printing - module for intercepting documents sent to printers.

Enabling this module in case the following requiremnets are met, allows to help:

  • shadow copy of the document sent to print;

  • spooler file, that is formed by the printer before printing.

  • screenshot taken at the monent of printing.

Setup printer spooler interception - this option sets all printers to work through spooler. In case “Files - Shadow copying” is enabled and printers are successfully configured to print on spooler, a printing event will be complemented with the image of the document sent to printer. This image can be dowloaded and view in admin panel or with the help of special software depending on image.

Setup printer to EMF format - module automatically switches printing handler to format NT EMF 1.008. This option helps to view the spooler file in third-party applications.


Automatical configuring enables printing through spooler that makes printing impossible for some model of printers, that’s why you should check all the printer models that are available in your infrastructure are compatible with Windows spooler.


In case printing interception is disabled or agent is stopped, the printer parameter “Save documents after printing” gets disabled. Also the format of the document image gets restored to the one that was installed before the module intevention. Other attributes of the module don’t get restored as they don’t interfere the printing process.


Current implementation of interception of content of printed documents requires saving documents in spooler without their further uninstallation by the OS. This may lead to accumulating of lots of printing evrnts in the printing dispatcher and wasting disk space on the PC with StaffCop agent installed. That’s why StaffCop Agent automatically deletes successfully performed printing tasks right after they got printed which automatically leads to deletion of corresponding files in the spooler catalogue. This information may be of importance for those who use printer’s setting for saving socuments after printing.

Conditions required for full-fledged printing interception.

  1. To intercept screenshots taken at the moment of printing, yous should enable option “Screenshots on changing window focus” in “Screenshots” tab of the required configuration.

  2. For interception you require to perform automatic or Manua printer configuration. Which means that the following options should be enabled in printer’s properties (“Advanced” tab):

  • “Spool print documents”

  • “Print spooled documents first”

  • “Keep printed documents”

  • “Enable advanced printing features”

  1. To intercept shadow copies of documents you require enabling options “File activity” and “Shadow copying” in “Files” and required options in the printer configuration.

There are some exceptions for finding an original file that has been printed:

  • It finds files containing documents that don’t fully match with the one that were printed of they were changed in some way and these changes were not saved before printing.

  • It doesn’t find files in case a new document was created and not saved yet or in case it was removed within 60 seconds right after printing.

  • It doesn’t find files if the printing task doesn’t contain their names.

  • It doesn’t find files in case the software used for printing isn’t on the list of monitored applications. (winword.exe, excel.exe, wordpad.exe, notepad.exe, notepad++.exe, AcroRd32.exe, TOTALCMD64.EXE, TOTALCMD.EXE, SumatraPDF.exe, mspaint.exe, soffice.bin, FoxitReader.EXE, STDUViewerApp.exe, WinDjView.exe, acad.exe, SLDWORKS.exe).

Manul printer configuration for printing events interception

If you are configuring a network printer and you can’t perform automatic configuration, you can do it manually. For this, open printer properties:


Other parameters on “Advanced” tab don’t affect interception process.

View image of printed documents

Image of printed documents are included in “Printing” event type as a zip-archive with the name presented as a number.


This archive contains 3 fies, the image is stored in .spl file. Images of printed documents have extensions depending on printer drivers and require corresponding software to view them.

Printers with XPS drivers

For printers with XPS-drivers (they usually has XPS as a part of their names) images of documents are saved to XPS format and they can viewed in admin panel or with “XPS viewer” tool in Windows.


In case with network printers Windows doesn’t use XPS format for spl files even if XPS driver is installed. Fot this kind of files you can use other viewer tools or reprinting.

View fiels in admin panel

Starting from version 4.6 you can export the intercepted file to PDF. Click the “wrench” icon near and choose “Export to PDF”.


If the archive found in the printing event contains spl-file in XPS or PSL formats you will see an exact copy of the printed file in a new tab. In case there is no archive or spl file or in case the file’s format is unsupported you will see the details on this problem and possible solutions in the new tab.

View with “XPS viewer”

For this you should download the archive included in the printing event, decompress it, and open the .spl file with “XPS viewer”.

To ease this process you can change .spl extention to .xps. If “XPS viewer” is not installed in your system, there are several possible solutions:

Printers without XPS-drivers

We can’t offer a solurion to view all other image formats but there are some free third-party software:

Reprint document from spooler file

In case you get an error while viewing a printed document in admin panel:

It’s impossible to convert the intercepted image as printer uses driver not compatible with XPS or PCS file format.

Download archive with spooler file and the tool for file reprinting from the newly open browser tab.


Choose spooler archive and drag it to the window of the tool.

The tool will offer you to print the document on a printer with the driver that is similar to the driver of the original printer. You can also download log file containing the information about spooler files and suggested drivers. Considering the information found in liogs you can check “Show inappropriate printers” and chose a printer that you think suits best.


Usage of inappropriate printers may lead to impossibility of printing, paper wasting and even to broken printer. Be careful when you are going to use an inappropriate printer.

Commonly known troubles


If “Printing spooler” is disabled in the printer configuration than printing interception is not going to work and logs will receive errors: EnumPrinters() failed, error: [1722, RPC server unavailable]. To solve this issue, enable “Printing spooler” and reboot StaffCop agent.


Printers used by network from other computers can use spooler only of the computer that is directly connected to the printer. That’s why files that are sent to the network printer can’t be intercepted. If the feeding computer runs on Windows, you need to install StaffCop agent there, enable printing interception module and configure printer settings automatically or manually.


Windows can limit the amount of copies in printing tasks to 9999. Some printer drivers don’t have the ability to set the number of copies, for example “Microsoft XPS Document Writer”, for printers of this type the amount if copies is always set to 1. One more thing: in case the number of pages in a printing event exceeds 32 million, it is converted into 1 as this amount of pages for a single file is seemed as an error.