Powershell print logging

archive_pdf.ps1

# Printer *MUST* be configured to "Store print jobs". This script will delete them later.
# Trigger this script on event 307 and pass in the 5 variables below(See the xml file here for the task scheduler definition)
#
# JOBID formatted as 5 digit number
#create c:\scripts\tmp\JOBID_DIR
$JOBID=$args[0]
$TIMESTAMP=$args[1]
$USER=$args[2]
$PRINTER=$args[3]
$DOCTITLE=$args[4]

$TIMESTAMP=$TIMESTAMP.replace(':','_')

# Ignore printers we don't care about
if ($PRINTER -ne "YOUR_PRINTER_NAME") {
	Exit 0
}

$OUTDIR="c:\scripts\pdf_prints\$PRINTER"
New-Item -Force -Path "$OUTDIR" -ItemType directory

# Create a copy of the SPL file from the print spooler
$SPLFile = "$OUTDIR\$TIMESTAMP-$USER-$JOBID.spl"
$SOURCEFILE="c:\windows\system32\spool\printers\" + $JOBID.ToString("00000") + ".spl"
#write-host $SPLFile
#write-host $SOURCEFILE

Copy-Item "$SOURCEFILE" "$SPLFile"

Write-Host "Creating thumbnail for this job"
# run ghostscript to make a pdf(Only caring about first 10 pages)
c:\scripts\ghostpcl\gpcl6win64-9.18.exe -o "$OUTDIR\$TIMESTAMP-$USER-$JOBID.pdf" -dFirstPage=1 -dLastPage=10 -sDEVICE=pdfwrite $SPLFile

# delete the print job
Write-Host "Deleting print job $JOBID"
wmic printjob where jobid=$JOBID delete

archive_print.cmd

powershell.exe -command c:\scripts\archive_pdf.ps1 "%1" "%2" "%3" "%4" "%5" >> c:\scripts\archive_pdf.log

task_scheduler_event.xml

<?xml version="1.0" encoding="UTF-16"?>
<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
  <RegistrationInfo>
    <Date>2016-02-29T13:35:48.3364142</Date>
    <Author>ubergeek42</Author>
  </RegistrationInfo>
  <Triggers>
    <EventTrigger>
      <Enabled>true</Enabled>
      <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Microsoft-Windows-PrintService/Operational"&gt;&lt;Select Path="Microsoft-Windows-PrintService/Operational"&gt;*[System[Provider[@Name='Microsoft-Windows-PrintService'] and EventID=307]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
      <ValueQueries>
        <Value name="doctitle">Event/UserData/DocumentPrinted/Param2</Value>
        <Value name="jobid">Event/UserData/DocumentPrinted/Param1</Value>
        <Value name="printername">Event/UserData/DocumentPrinted/Param5</Value>
        <Value name="timestamp">Event/System/TimeCreated/@SystemTime</Value>
        <Value name="username">Event/UserData/DocumentPrinted/Param3</Value>
      </ValueQueries>
    </EventTrigger>
  </Triggers>
  <Principals>
    <Principal id="Author">
      <UserId>S-1-5-18</UserId>
      <RunLevel>LeastPrivilege</RunLevel>
    </Principal>
  </Principals>
  <Settings>
    <MultipleInstancesPolicy>Queue</MultipleInstancesPolicy>
    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
    <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
    <AllowHardTerminate>true</AllowHardTerminate>
    <StartWhenAvailable>false</StartWhenAvailable>
    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>
    <IdleSettings>
      <StopOnIdleEnd>true</StopOnIdleEnd>
      <RestartOnIdle>false</RestartOnIdle>
    </IdleSettings>
    <AllowStartOnDemand>true</AllowStartOnDemand>
    <Enabled>true</Enabled>
    <Hidden>false</Hidden>
    <RunOnlyIfIdle>false</RunOnlyIfIdle>
    <WakeToRun>false</WakeToRun>
    <ExecutionTimeLimit>PT1H</ExecutionTimeLimit>
    <Priority>7</Priority>
  </Settings>
  <Actions Context="Author">
    <Exec>
      <Command>c:\scripts\archive_pdf.cmd</Command>
      <Arguments>"$(jobid)" "$(timestamp)" "$(username)" "$(printername)" "$(doctitle)"</Arguments>
    </Exec>
  </Actions>
</Task>