Public/Get-PrintDocumentEvent.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
function Get-PrintDocumentEvent {
    [CmdLetBinding()]
    param(
        [Parameter(ValueFromPipelineByPropertyName=$true,ValueFromPipeline=$true)]
        [Alias('IPAddress','__Server','CN')]
        [string]$ComputerName='localhost',
        [ValidateNotNull()]
        [System.Management.Automation.PSCredential]
        [System.Management.Automation.Credential()]$Credential = [System.Management.Automation.PSCredential]::Empty,
        [datetime]$StartTime,
        [datetime]$EndTime,
        [int64]$MaxEvents,
        [switch]$Oldest,
        [switch]$Raw,
        [string]$UserName,
        [string]$ClientMachineName,
        [string]$PrinterName,
        [string]$PrinterPort
    )

    begin {

        if ($StartTime -and $EndTime) {
            $TimeCreatedFilter = "and (System/TimeCreated[@SystemTime>='$($StartTime.ToUniversalTime().ToString("s"))' and @SystemTime<='$($EndTime.ToUniversalTime().ToString("s"))'])"
        } elseif ($StartTime) {
            $TimeCreatedFilter = "and (System/TimeCreated[@SystemTime>='$($StartTime.ToUniversalTime().ToString("s"))'])"
        } elseif ($EndTime) {
            $TimeCreatedFilter = "and (System/TimeCreated[@SystemTime<='$($EndTime.ToUniversalTime().ToString("s"))'])"
        } else {
            $TimeCreatedFilter = $null
        }

        $DocumentPrintedFilterCount = 0
        if ($UserName) { $DocumentPrintedFilterCount++ }
        if ($ClientMachineName) { $DocumentPrintedFilterCount++ }
        if ($PrinterName) { $DocumentPrintedFilterCount++ }
        if ($PrinterPort) { $DocumentPrintedFilterCount++ }

        if ($DocumentPrintedFilterCount -gt 0) {
            $DocumentPrintedFilter = " and *[UserData[DocumentPrinted["

            if ($UserName) {
                $DocumentPrintedFilter += " (Param3='" + $UserName + "') "
            }
            if ($ClientMachineName) {
                if ($DocumentPrintedFilterCount -eq 1) {
                    $DocumentPrintedFilter += " (Param4='" + $ClientMachineName + "') "
                } else {
                    $DocumentPrintedFilter += " and (Param4='" + $ClientMachineName + "') "
                }
            }
            if ($PrinterName) {
                if ($DocumentPrintedFilterCount -eq 1) {
                    $DocumentPrintedFilter += " (Param5='" + $PrinterName + "') "
                } else {
                    $DocumentPrintedFilter += " and (Param5='" + $PrinterName + "') "
                }
            }
            if ($PrinterPort) {
                if ($DocumentPrintedFilterCount -eq 1) {
                    $DocumentPrintedFilter += " (Param6='" + $PrinterPort + "') "
                } else {
                    $DocumentPrintedFilter += " and (Param6='" + $PrinterPort + "') "
                }
            }

            $DocumentPrintedFilter += "]]] "

        } else {
            $DocumentPrintedFilter = $null
        }

        $FilterXmlText = '<QueryList>'
        $FilterXmlText += '<Query Id="0" Path="Microsoft-Windows-PrintService/Operational">'
        $FilterXmlText += '<Select Path="Microsoft-Windows-PrintService/Operational">'
        $FilterXmlText += '*[System[(EventID=307)]]'
        $FilterXmlText += $TimeCreatedFilter
        $FilterXmlText += $DocumentPrintedFilter
        $FilterXmlText += '</Select>'
        $FilterXmlText += '</Query>'
        $FilterXmlText += '</QueryList>'

        [xml]$FilterXml = $FilterXmlText

        $ParameterSplat = @{}
        if ($Credential) {
            $ParameterSplat['Credential'] = $Credential
        }
        if ($MaxEvents) {
            $ParameterSplat['MaxEvents'] = $MaxEvents
        }
        if ($Oldest) {
            $ParameterSplat['Oldest'] = $true
        }
    }

    process {
        if ($Raw) {
            Get-MyEvent -ComputerName $ComputerName -FilterXml $FilterXml @ParameterSplat
        } else {
            Get-MyEvent -ComputerName $ComputerName -FilterXml $FilterXml @ParameterSplat | ConvertFrom-EventLogRecord -EventRecordType 'PrintDocument'
        }
    }

    end {

    }
}