So, I have my little crude script that reads event logs and gives me the print details, for 2003 & 2008. Enter 2008 R2 and its expanded log files - I'm having difficulty getting its event logs (auditing is enabled). I've tried adding Logfile='Microsoft-Windows-PrintService/Operational' to the Select statement - didn't help. Any thoughts? excerpt: Set objWMIService = GetObject("winmgmts:" _ & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2") Set colOperatingSystems = objWMIService.ExecQuery _ ("Select * from Win32_OperatingSystem") For Each objOperatingSystem in colOperatingSystems OS = objOperatingSystem.Caption & " " & objOperatingSystem.Version Next If InStr(1,OS,"2003") > 0 Then 'this works Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE EventCode=10 And SourceName='Print'") OSver = "2003" ElseIf InStr(1,OS,"2008 R2") > 0 Then 'this no workie Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE EventCode=307 And SourceName='PrintService'") OSver = "2008" ElseIf InStr(1,OS,"2008") > 0 Then 'this works Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE EventCode=10 And SourceName='Microsoft-Windows-PrintSpooler'") OSver = "2008" Else WScript.Echo "Could not identify Operating system for " & strcomputer WScript.Quit End If