How to get print server report using PowerShell?

Organizations need to audit their print server to analyze what data is being printed, the volumes of data that is being printed, and who is printing sensitive data. Such audits also help organizations understand their printing costs. A printer audit report can help you prevent data exfiltration, and insider attacks. For example, you can immediately get to know if your most sensitive data ends up in the wrong hands. It can also help you optimize your printer usage as you get to know what printers are being used the most. Regular auditing will help an organization to identify points of vulnerability and focus on working on necessary security measures. Hence, print server audit reports are as important as user management reports.

This article compares how you can get print server reports using Windows PowerShell, and ADAudit Plus, a comprehensive Active Directory auditing solution.

Windows PowerShell

Steps to get Print Server Reports:

• The very first step is to enable print event logging.

  • On the Print Server, access Event Viewer.
  • Click on Application and Services Logs > Microsoft > Windows > PrintService.
  • Right Click on the Operational log.
  • Select Properties from the pop-up menu.
  • Check the box to Enable Logging.
• The Get-WinEvent command can be used for retrieving print server reports after enabling print event logging.

  Sample script:

  $aPrinterList = @()
   $StartTime = "22/04/2020 00:00:01 AM"
   $EndTime = "23/04/2020 6:00:01 PM"
   $Results = Get-WinEvent -FilterHashTable @{LogName="Print Server03/Operational"; ID=307; StartTime=$StartTime; EndTime=$EndTime;} -ComputerName "print-03"
   ForEach($Result in $Results){
   $ProperyData = [xml]$Result.ToXml()
   $PrinterName = $ProperyData.Event.UserData.DocumentPrinted.Param5
   If($PrinterName.Contains("HP-6850-03")){
  
   $hItemDetails = New-Object -TypeName psobject -Property @{
   DocName = $ProperyData.Event.UserData.DocumentPrinted.Param2
   UserName = $ProperyData.Event.UserData.DocumentPrinted.Param3
   MachineName = $ProperyData.Event.UserData.DocumentPrinted.Param4  
   PrinterName = $PrinterName
   PageCount = $ProperyData.Event.UserData.DocumentPrinted.Param8
   TimeCreated = $Result.TimeCreated
      }
   $aPrinterList += $hItemDetails
    }
  }
   $aPrinterList | Export-Csv -LiteralPath C:\PrintServer\PrintAuditReport.csv 

   Copied
  Click to copy entire script
• The report will be exported in CSV format.
• To obtain the report in a different format, modify the script accordingly.

ADAudit Plus

To obtain the report,

• Log in to the ADAudit Plus web console.
• Click on the Server Audit Tab > Printer Auditing.
• Select the Domain from the drop down.

• Under the Printer Auditing Tab, we can find the below reports:

  • Recent Jobs
  • User based reports
  • Printer Usage
  • Printer Based Reports

• These reports help you:

  • Identify all the files printed over the Windows network.
  • List file details with time and date, and the name of the user who printed it.
  • Keep a track of the number of pages, number of copies, file size, printer name and server details.
• Select Export As to export the report in any of the preferred formats (CSV, PDF, HTML, CSVDE and XLSX).

Why ADAudit Plus is the better solution for you?