One way to audit activity on a print server

When managing a print server with a large number of printers, its nice to know which ones are being used and which are idle/abandoned.

To audit printer activity on a print server:

1. Enable the appropriate event log -> right-click on it and choose “Enable”:

2. Wait a while for events to accumulate in the log.

3. Now, run a Powershell script:

$MyFilter = @{LogName = "Microsoft-Windows-PrintService/Operational";ID=307; StartTime = (Get-Date).AddHours(-24)}
$Events = Get-WinEvent -FilterHashTable $MyFilter
[System.Collections.ArrayList]$PrintJobs = @()

ForEach ($IndividualEvent in $Events)
  {[void]$PrintJobs.Add([regex]::match($IndividualEvent.Message,'(?<=printed on ).*?(?= through port)').Groups[0].Value)}

"Used printers with number of print jobs:"
$PrintJobs | Group-object | Select Name, Count | Sort Name

$UsedPrinters = $PrintJobs | Group-Object | Select Name -Unique | Sort Name
$AllPrinters = Get-Printer | Select Name | Sort Name

"Idle printers:"
Compare-Object $AllPrinters $UsedPrinters -Property "Name" -PassThru | Select Name

…and then you get a nifty little report that shows which shared printers (on this server) were used and which were idle during the audited period of time! 😊