Identify printer usage statistics in a certain server?

Question

As part of the due diligence process, I need evidence or a way of identifying printer usage without causing a massive outage.

I can see some network printers shared and available when I browse some of the servers in my domain using \Server1. 

Is it possible to determine whether a printer has been shared from a server but it is still in use?

Answer 1

Event ID 307 displays information about the jobs printed.

The following PowerShell should get you started (although note I'm not in front of my environment to test) with being able to query those events, and return the printer names:

$printLog = Get-WinEvent -FilterHashTable @{LogName='Microsoft-Windows-PrintService/Operational'; ID=307;}

$printers = $printLog | ForEach-Object {
    $propertyData = [xml]$_.ToXml()
    $printerName = $propertyData.Event.UserData.DocumentPrinted.Param5
    $printerName
} | Select-Object -Unique

Write-Host "Printers Used:"
$printers | ForEach-Object {
    Write-Host $_
}