[THIN] Re: OT: Vbscript, 2008 R2 and auditing printers

  • From: Dan Dill <DanD@xxxxxxxxxx>
  • To: "thin@xxxxxxxxxxxxx" <thin@xxxxxxxxxxxxx>
  • Date: Tue, 11 Jun 2013 18:47:23 +0000

This looks promising: 
http://mywinsysadm.wordpress.com/2012/07/16/powershell-audit-printer-event-logs/


Dan Dill |Systems Engineer

From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf Of 
Steve Snyder
Sent: Tuesday, June 11, 2013 5:10 AM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] OT: Vbscript, 2008 R2 and auditing printers

So, I have my little crude script that reads event logs and gives me the print 
details, for 2003 & 2008. Enter 2008 R2 and its expanded log files - I'm having 
difficulty getting its event logs (auditing is enabled).
I've tried adding  Logfile='Microsoft-Windows-PrintService/Operational'
to the Select statement - didn't help.

Any thoughts?

excerpt:

Set objWMIService = GetObject("winmgmts:" _ 
    & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & 
"\root\cimv2")

Set colOperatingSystems = objWMIService.ExecQuery _
        ("Select * from Win32_OperatingSystem")

For Each objOperatingSystem in colOperatingSystems
    OS = objOperatingSystem.Caption & " " & objOperatingSystem.Version
Next

If InStr(1,OS,"2003") > 0 Then 'this works
    Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE 
EventCode=10 And SourceName='Print'")
    OSver = "2003"
ElseIf InStr(1,OS,"2008 R2") > 0 Then 'this no workie
    Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE 
EventCode=307 And SourceName='PrintService'")
    OSver = "2008"
ElseIf InStr(1,OS,"2008") > 0 Then 'this works
    Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent WHERE 
EventCode=10 And SourceName='Microsoft-Windows-PrintSpooler'")
    OSver = "2008"
Else
    WScript.Echo "Could not identify Operating system for " & strcomputer
    WScript.Quit
End If

Other related posts: