[THIN] Re: OT: Vbscript, 2008 R2 and auditing printers

  • From: Steve Snyder <kwajalein@xxxxxxxxx>
  • To: thin@xxxxxxxxxxxxx
  • Date: Wed, 12 Jun 2013 08:35:35 +0200

yep, found that as well as another PS script and have semi- got it to do
what I want; been trying to avoid learning powershell up til now.

also found a technet blurb that stated that vbscript cannot and will not
access the enhanced logs (or whatever they're called), guess I will be
assimilated after all

thanks!


On Tue, Jun 11, 2013 at 8:47 PM, Dan Dill <DanD@xxxxxxxxxx> wrote:

>  This looks promising:
> http://mywinsysadm.wordpress.com/2012/07/16/powershell-audit-printer-event-logs/
> ****
>
> ** **
>
> ** **
>
> *Dan Dill** *|*Systems Engineer*  ****
>
> ** **
>
> *From:* thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] *On
> Behalf Of *Steve Snyder
> *Sent:* Tuesday, June 11, 2013 5:10 AM
> *To:* thin@xxxxxxxxxxxxx
> *Subject:* [THIN] OT: Vbscript, 2008 R2 and auditing printers****
>
> ** **
>
> So, I have my little crude script that reads event logs and gives me the
> print details, for 2003 & 2008. Enter 2008 R2 and its expanded log files -
> I'm having difficulty getting its event logs (auditing is enabled).****
>
> I've tried adding  Logfile='Microsoft-Windows-PrintService/Operational'***
> *
>
> to the Select statement - didn't help.
>
> Any thoughts?
>
> excerpt:
>
> Set objWMIService = GetObject("winmgmts:" _
>  & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer &
> "\root\cimv2")
>
> Set colOperatingSystems = objWMIService.ExecQuery _
>  ("Select * from Win32_OperatingSystem")
>
> For Each objOperatingSystem in colOperatingSystems
>  OS = objOperatingSystem.Caption & " " & objOperatingSystem.Version
> Next
>
> If InStr(1,OS,"2003") > 0 Then 'this works
>  Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent
> WHERE EventCode=10 And SourceName='Print'")
>  OSver = "2003"
> ElseIf InStr(1,OS,"2008 R2") > 0 Then 'this no workie
>  Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent
> WHERE EventCode=307 And SourceName='PrintService'")
>  OSver = "2008"
> ElseIf InStr(1,OS,"2008") > 0 Then 'this works
>  Set colEvents=objWMIService.ExecQuery("Select * from Win32_NTLogEvent
> WHERE EventCode=10 And SourceName='Microsoft-Windows-PrintSpooler'")
>  OSver = "2008"
> Else
>  WScript.Echo "Could not identify Operating system for " & strcomputer
>  WScript.Quit
> End If****
>

Other related posts: