Sign in
 
HomeLibraryLearnDownloadsRepositoryCommunityForumsBlog
Script Center >
> 
> 
get users id from print event for 2008 R2 servers

Answered get users id from print event for 2008 R2 servers

  • Friday, August 10, 2012 7:07 PM
     
     
    Sign In to Vote
    0

    Hey Scripting Guy,

    Need your help to get a powershell script to get users id from print event for 2008 R2 servers. We used to run VBscript on 2003 server and it gives us users id in just few minutes. We use this data to send email for migration notification. We are now moving someI got some powershell script from some online blogs but it take long time and provide lot of information. We just requrie users id from print event from last one month sothat we can send email.

     

All Replies

  • Friday, August 10, 2012 7:29 PM
     
     
    Sign In to Vote
    0

    I would try looking in the Repository as it is full of scripts that manage the R2 print server.

    It is the button on the menu a the top of this page.

    ¯\_(ツ)_/¯

     
  • Friday, August 10, 2012 7:52 PM
     
     
    Sign In to Vote
    0

    Hereis just a quick answer but it demomnstrate how to get at the properties.

    Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName PrintrServer1 |
         Where-Object{$_.id -eq 307}|
         ForEach-Object{"UserId:$($_.Properties[2])"}

    ¯\_(ツ)_/¯

     
  • Monday, August 13, 2012 7:06 PM
     
     
    Sign In to Vote
    0

    Hi irv

    Thanks fro reply, above cmdlet does not  provide desired result. output  is below:

    UserId:System.Diagnostics.Eventing.Reader.EventProperty
    UserId:System.Diagnostics.Eventing.Reader.EventProperty
    UserId:System.Diagnostics.Eventing.Reader.EventProperty
    UserId:System.Diagnostics.Eventing.Reader.EventProperty
    UserId:System.Diagnostics.Eventing.Reader.EventProperty

    what I need is from details of event 307 , userdata-document printed-param3. This provide exact user id.

     UserData

      - DocumentPrinted

       Param1 227
     
       Param2 

       Param3 JW8808

    thanks for your help,


     
  • Monday, August 13, 2012 7:21 PM
     
     Answered Has Code
    Sign In to Vote
    1

    $_.Properties[2] is Param3.  0,1,2,3 parameters.  Properties are the replacement strings that you see in the message.

    I forgot to include the 'Value' property.  

    Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName PrintrServer1 |
     Where-Object{$_.id -eq 307}|
     ForEach-Object{"UserId:$($_.Properties[2].Value)"
}

    ¯\_(ツ)_/¯


     
  • Monday, August 13, 2012 7:55 PM
     
      Has Code
    Sign In to Vote
    0

    This will get you all of the data in XML so you can just query it for what you need.  It will pop up in IE so you can browse the structure which is useful for seeing how to query for the nodes you want.

    $printserver='pserver'
$xmlout="$pwd\event307.xml"
$events=[xml]'<?xml version="1.0" encoding="utf-8"?><events/>'
$events.PreserveWhitespace=$true
Get-WinEvent -Max 50 -LogName Microsoft-Windows-PrintService/Operational -ComputerName $printserver |
     Where-Object{$_.id -eq 307} |
     ForEach-Object{
          $frag=$events.CreateDocumentFragment()
          $frag.InnerXml=$_.TOXml()
          [void]$events.DocumentElement.AppendChild($frag.event)
     }
$events.Save($xmlout)
&$xmlout

    ¯\_(ツ)_/¯



     
  • Monday, August 13, 2012 9:02 PM
     
      Has Code
    Sign In to Vote
    0

    Sorry - I forgot to post the XPath.  It was a good thing becuse it was wrong.  This works

    $events=[xml](Get-Content $xmlout)
$nsmgr = New-Object System.XML.XmlNamespaceManager($events.NameTable)
$nsmgr.AddNamespace('ev','http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events')
$events.SelectNodes('//ev:*/ev:Param3',$nsmgr)

    Notice that now we are querying the 'Param3' . This produces the same results but it shows you how we can expose all of the data in the events. In some events the data is actually named instead of using the old defaults like Param<n>.

    ¯\_(ツ)_/¯

     
  • Tuesday, August 14, 2012 4:58 PM
     
     
    Sign In to Vote
    0

    Get-WinEvent -LogName Microsoft-Windows-PrintService/Operational -ComputerName PrintrServer1 |
             Where-Object{$_.id -eq 307}|
             ForEach-Object{"UserId:$($_.Properties[2].Value)"

    Thanks irv for your help,
    Above work for me but need little more help. It is repeating users id.  Is there way to have user id only once in csv format so that I can just copy users id and paste in our emailing tool.

    One more queustion, can we make it to query last 30 days events.

     
  • Tuesday, August 14, 2012 6:49 PM
     
     Answered
    Sign In to Vote
    1

    Sort-Object -unique

    ¯\_(ツ)_/¯

    • Marked As Answer by Vivek K Sharma Tuesday, August 14, 2012 9:03 PM
    •  
     
  • Tuesday, August 14, 2012 9:03 PM
     
     
    Sign In to Vote
    0

    Thanks irv, you rocks. it working for me.