Last active
January 25, 2019 23:30
-
-
Save jrwarwick/9719c3c8f35f3be030380beb37facfc9 to your computer and use it in GitHub Desktop.
When you need to find out when or if a user sent a print job through the print server.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!PowerShell | |
# Assumes print logging is turned on. This is usually the case on print servers, | |
# yet usually not the case on desktop workstations. | |
$searchstring = Read-Host -Prompt 'Target username' | |
$WinEventXMLFilter = ' | |
<QueryList><Query Id="0" Path="Microsoft-Windows-PrintService/Operational"> | |
<Select Path="Microsoft-Windows-PrintService/Operational">*[System[(Level=4 or Level=0) and (EventID=307)]]</Select> | |
</Query></QueryList>' | |
$PrintEvents = Get-WinEvent -FilterXml $WinEventXMLFilter -Computer $(Read-Host -prompt 'Print Server computername') | |
$PrintEvents | Where-Object {$_.message -like "*$($searchstring)*"} | |
write-output "Note that log only goes back to $($($PrintEvents[$PrintEvents.Length -1]).TimeCreated)" | |
$PrintEvents | Out-GridView |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment