Get-PrintSpoolerCrashes.ps1

param(
    $ComputerList = ("$env:COMPUTERNAME"),
    $Cred = $(Get-Credential "$env:USERDOMAIN\$env:USERNAME")
)

$Result1 = Invoke-Command -ComputerName $ComputerList -Credential $Cred -ScriptBlock {

    $Win32_OperatingSystem = Get-WmiObject -Class 'Win32_OperatingSystem'
    $LastBootUpTime = $Win32_OperatingSystem.ConvertToDateTime($Win32_OperatingSystem.LastBootUpTime)
    
    $Win32_PrinterDriver = get-wmiobject -class 'Win32_PrinterDriver' -namespace 'root\CIMV2'

    $PrinterDriverFiles = ForEach ($Printer in $Win32_PrinterDriver) {
        $Printer.DependentFiles | ForEach-Object {
            [pscustomobject] @{
                "Printer" = $Printer.Name
                "FullName" = $_
                "Name" = Split-Path -Path $_ -Leaf
            }
        }
        if ($Printer.ConfigFile)
        {        
            $Printer.ConfigFile | ForEach-Object {
                [pscustomobject] @{
                    "Printer" = $Printer.Name
                    "FullName" = $_
                    "Name" = Split-Path -Path $_ -Leaf
                }
            }
        }
        if ($Printer.DataFile)
        {
            $Printer.DataFile | ForEach-Object {
                [pscustomobject] @{
                    "Printer" = $Printer.Name
                    "FullName" = $_
                    "Name" = Split-Path -Path $_ -Leaf
                }
            }
        }        
        if ($Printer.DriverPath)
        {
            $Printer.DriverPath | ForEach-Object {
                [pscustomobject] @{
                    "Printer" = $Printer.Name
                    "FullName" = $_
                    "Name" = Split-Path -Path $_ -Leaf
                }
            }
        }
        if ($Printer.FilePath)
        {        
            $Printer.FilePath | ForEach-Object {
                [pscustomobject] @{
                    "Printer" = $Printer.Name
                    "FullName" = $_
                    "Name" = Split-Path -Path $_ -Leaf
                }
            }
        }        
        if ($Printer.HelpFile) { 
            $Printer.HelpFile | ForEach-Object {
                [pscustomobject] @{
                    "Printer" = $Printer.Name
                    "FullName" = $_
                    "Name" = Split-Path -Path $_ -Leaf
                }
            }
        }
    }
    
    Get-WinEvent -FilterHashtable @{logname="application"; providername="Application Error"; data="spoolsv.exe","PrintIsolationHost.exe","splwow64.exe"}  `
        | where {$_.timecreated -ge $LastBootUpTime} `
        | Select-Object `
            TimeCreated, `
            @{Name='ProcessName';Expression={$_.Properties[0].Value}}, `
            @{Name='FaultingDLL';Expression={$_.Properties[11].Value}}, `
            @{Name='Printer_Driver';Expression={$FaultingDLL = $_.Properties[11].Value; $($PrinterDriverFiles | where {($_.FullName -eq $FaultingDLL) -or ($_.Name -eq $FaultingDLL)}).Printer}}
        
} | Sort-Object TimeCreated -Descending

$Result1 | Out-GridView -Title "Print Spooler Crashes - Since Last Boot"

$Result2 = Invoke-Command -ComputerName $ComputerList -Credential $Cred -ScriptBlock {

    $null = New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS 

    Get-ChildItem hku: | where name -NotLike '*_Classes' | ForEach-Object {
        if ($(test-path $( Join-Path $_ 'Printers\Connections'))) {
            $UserName = (New-Object System.Security.Principal.SecurityIdentifier($_.PSChildName)).Translate( [System.Security.Principal.NTAccount])
            Get-ChildItem $( Join-Path $_ 'Printers\Connections' ) | select -expandproperty PSChildName | ForEach-Object {
                [pscustomobject] @{
                    'User' = $UserName
                    'Printer' = $(Join-path $_.Split(',')[2].ToUpper() $_.Split(',')[3].ToUpper())
                    'Driver'  = (gwmi -ComputerName $($_.Split(',')[2]) -query "Select DriverName FROM Win32_Printer WHERE DeviceID='$($_.Split(',')[3])'").DriverName
                }
            }
        }
    }
} 

$Result2 | Out-GridView -Title "Connected Printers"