This project is read-only.

Trying to capture Print Jobs

Jul 16, 2009 at 10:44 PM

I am trying to create a Powershell monitor to capture all Print Job information processed on a Print Server. I used the example at the following URL as a basis for my code:

I was successful in getting the Windows process example to work, but converting the code to capture Win32_PrintJob not so much... Here is my code:


Add-PSSnapin psEventing 
$query = New-Object System.Management.WQLEventQuery                                                               
$query.EventClassName = "__InstanceCreationEvent"                                                                 
$query.WithinInterval = New-TimeSpan -seconds 1                                                                   
$query.Condition = "TargetInstance ISA 'Win32_PrintJob'"                                                           
$watcher = New-Object System.Management.ManagementEventWatcher($query)
Connect-Event watcher EventArrived -Verbose

while ($events = @(read-event -wait)) {
	write-output "Event Count = ",$events.Count
	# read-event always returns a collection
	foreach ($event in $events) {
		write-host "Print Job = " $event.Args.NewEvent.TargetInstance.Document
Any help in solving this dilemna would be greatly appreciated!
Jul 21, 2009 at 4:15 PM

I've tested that code on my local machine and it works fine when I print a page. I think the problem is that you are running that code on the print _server_. Win32_PrintJobs are generated on the *client* doing the printing, not the server AFAIK.



Jul 22, 2009 at 6:50 PM

I'm running this on my client box... I retried the script, and it does capture the first print job but no subsequent jobs. Ideally I would like to run this on the Print Server to capture all print jobs - am I going down the wrong path?


Jul 22, 2009 at 8:15 PM
Edited Jul 22, 2009 at 8:38 PM

edit: replaced "registry" with "event log" (brainfart... pffrp!)

I'm not really an expert in that area at all, but if it's only capturing one then perhaps there's something else that's going on.

My gut instinct is that you might be going down a dead-end. Aren't print jobs logged to the Event Log? If so, you can use the same watcher trick to watch the Event Log and keep an eye out for print jobs being logged there. If they are not logged, you may have to switch on Auditing for that event - this will ensure they appear in the security event log which you can monitor with pseventing. Make sense?