Skip to content

Instantly share code, notes, and snippets.

@jrwarwick
Last active January 25, 2019 23:30
Show Gist options
  • Save jrwarwick/9719c3c8f35f3be030380beb37facfc9 to your computer and use it in GitHub Desktop.
Save jrwarwick/9719c3c8f35f3be030380beb37facfc9 to your computer and use it in GitHub Desktop.
When you need to find out when or if a user sent a print job through the print server.
#!PowerShell
# Assumes print logging is turned on. This is usually the case on print servers,
# yet usually not the case on desktop workstations.
$searchstring = Read-Host -Prompt 'Target username'
$WinEventXMLFilter = '
<QueryList><Query Id="0" Path="Microsoft-Windows-PrintService/Operational">
<Select Path="Microsoft-Windows-PrintService/Operational">*[System[(Level=4 or Level=0) and (EventID=307)]]</Select>
</Query></QueryList>'
$PrintEvents = Get-WinEvent -FilterXml $WinEventXMLFilter -Computer $(Read-Host -prompt 'Print Server computername')
$PrintEvents | Where-Object {$_.message -like "*$($searchstring)*"}
write-output "Note that log only goes back to $($($PrintEvents[$PrintEvents.Length -1]).TimeCreated)"
$PrintEvents | Out-GridView
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment