Script to audit printerservice ID 307-CodePudding

Does anyone know about a printservice audit report script?

I was using the script below, but it informs of all installed printers. The information is ok, but I only need to audit some printers, does anyone know how to do it?

get-WinEvent -ProviderName "Microsoft-Windows-PrintService" | where {$_.Id -eq "307"} | Format-list > c:\relatorio.txt

CodePudding user response：

See if following gets you more info

$PrintEvents = @()
$events = get-WinEvent -ProviderName "Microsoft-Windows-PrintService" 
foreach ($log in $events) {
     $pEvent = "" | Select ID, Created, User, Printer, SizeKB, Pages, Doc
     $pEvent.ID = $log.Properties.Value[0]
     $pEvent.Created = $log.TimeCreated
     $pEvent.User = $log.Properties.Value[2]
     $pEvent.Printer = $log.Properties.Value[4]
     $pEvent.SizeKB = [math]::Round($log.Properties.Value[6]/1024)
     $pEvent.Pages = $log.Properties.Value[7]
     $pEvent.Doc = $log.Properties.Value[1]
     $PrintEvents  = $pEvent
}
$PrintEvents

CodePudding user response：

In set your where clause as follows:

get-WinEvent -ProviderName "Microsoft-Windows-PrintService" | 
  where {$_.Id -eq "307" -and $($_.Properties.Value[1]) -eq "Your Printer Name Here"}} | 
  Format-list > c:\relatorio.txt

Sample fitltering on only Printer Name since I don't have any 307's

get-WinEvent -ProviderName "Microsoft-Windows-PrintService" | 
   where {$($_.Properties.Value[1]) -eq "PrimoPDF"} | 
   Format-list

Output:

TimeCreated  : 3/4/2022 11:26:34 AM
ProviderName : Microsoft-Windows-PrintService
Id           : 823
Message      : The default printer was changed to Brother HL-L2350DW series 
               Printer. See the event user data for context information.

CodePudding user response：

If I put it this way:

get-WinEvent -ProviderName "Microsoft-Windows-PrintService" | where {$.Id -eq "307" -and $($.Properties.Value[1]) -eq "Epson"} | Format-list > c:\report.txt

The output is blank, does not return anything.

If you remove the event ID

get-WinEvent -ProviderName "Microsoft-Windows-PrintService" | where {$($_.Properties.Value[1]) -eq "Epson"} | Format-list > C:\report.txt

the output is something like:

ProviderName: Microsoft-Windows-PrintService

TimeCreated Id LevelDisplayName Message

1/4/2023 5:30:54 PM 848 Information Printer Epson was shared by the print spooler as Epson.

Not bringing anything from ID 307