Microsoft-Windows-PrintService

218 events across 3 channels

Event IDTitleChannel
1The print spooler failed to import the printer driver that was downloaded from …Operational
22Failed to upgrade printer settings for printer <PrinterName> driver …Operational
23Printer <PrinterName> failed to initialize because a suitable <DriverName> …Operational
99The print spooler encountered a fatal error while executing a critical operation …Admin
100Printer %3 successfully added.Debug
101Failed to add printer %3, error code %2.Debug
104Deleting printer %3 succeeded.Debug
105Deleting printer %3 failed, error code %2.Debug
106Starting document job %3 for printer %4 succeeded.Debug
107Starting document job %3 for printer %4 failed, error code %2.Debug
110Ending document job %3 for printer %4 succeeded.Debug
111Ending document job %3 for printer %4 failed, error code %2.Debug
114Adding printer driver %3 succeeded.Debug
115Adding printer driver %3 failed, error code %2.Debug
118Opening printer %3 succeeded.Debug
119Opening printer %3 failed, error code %2.Debug
122Starting page job %3 at printer %4 succeeded.Debug
123Starting page failed at printer %3, error code %2.Debug
124Ending page job %3 at printer %4 succeeded.Debug
125Ending page job %3 at printer %4 failed, error code %2.Debug
131Setting printer %3 failed, error code %2.Debug
200Adding CSR printer connection %3 succeeded.Debug
201Adding CSR printer connection %3 failed, error code %2.Debug
204Deleting CSR printer connection %3 succeeded.Debug
205Deleting CSR printer connection %3 failed, error code %2.Debug
207Opening CSR printer %3 failed, error code %2.Debug
210Closing CSR printer %3 succeeded.Debug
211Closing CSR printer %3 failed, error code %2.Debug
212Parsing inf (%4) for printer driver %5 succeeded (processor architecture %7).Debug
213Parsing inf (%4) for printer driver %5 failed (processor architecture %7), error …Operational
214Installing printer driver %5 succeeded.Debug
215Installing printer driver %5 failed, error code %10, HRESULT %11.Admin
216A printer setup operation succeeded during the installation process.Debug
217A printer setup operation failed during the installation process, error code %5, …Operational
218Copying printer driver package %5 succeeded.Operational
219Copying printer driver package %5 failed, error code %8, HRESULT %9.Operational
220Retrieving CSR cache information for printer %3 succeeded.Operational
221Retrieving CSR cache information for printer %3 failed, error code %2.Operational
222Debug
223Debug
224A remote print driver package operation %1 failed with error code %2, server …Operational
225An error occurred while installing printer driver '.Admin
226An error occurred while installing printer driver '.Admin
227An error occurred while installing printer driver '.Admin
228An error occurred while installing printer driver '.Admin
229An error occurred while installing printer driver '.Operational
230A problem was encountered while installing printer driver '.Admin
231An attempt was made to upgrade installed class driver '.Operational
232An attempt was made to upgrade installed printer driver '.Admin
233An attempt was made to upgrade installed printer driver '.Admin
234A problem was encountered while deleting printer driver '.Operational
235An error occurred while installing printer driver '.Operational
236An error occurred while installing printer driver '.Operational
237An error occurred while installing printer driver '.Operational
238An error occurred while installing printer driver '.Operational
239An error occurred while installing printer driver '.Operational
240An error occurred while installing printer driver '.Operational
241An attempt was made to upgrade installed printer driver '.Admin
242An error occurred while configuring print queue '.Admin
300Printer %1 was created.Operational
301Printer %1 was deleted, and users will no longer be able to print to this …Operational
302Printer %1 will be deleted.Operational
303Printer %1 was paused.Operational
304Printer %1 was resumed.Operational
305The jobs in the print queue for printer %1 were deleted.Operational
306Settings for printer %1 were changed.Operational
307Document %1, %2 owned by %3 on %4 was printed on %5 through port %6.Operational
308Document %1, %2 owned by %3 was paused on %4.Operational
309Document %1, %2 owned by %3 was resumed on %4.Operational
310Document %1, %2 owned by %3 was deleted on %4.Operational
311An administrator moved document %1, %2 owned by %3 to position %4 on %5.Operational
312Form %1 was added.Operational
313Form %1 was removed.Operational
314Document %1, %2 owned by %3 timed out while printing on %4.Admin
315The print spooler failed to share printer %2 with shared resource name %3.Admin
316Printer driver %1 for %2 %3 was added or updated.Operational
317Printer driver %1 was deleted.Operational
318Failed to upgrade printer settings for printer %1 driver %2.Admin
319Printer %1 failed to initialize because a suitable %2 driver could not be found.Admin
320Printer %1 failed to initialize because none of its ports (%2) could be found.Admin
321File(s) %1 associated with printer %2 were added or updated.Operational
322While attempting to publish the printer to the Active Directory directory …Admin
323While attempting to publish the printer to the Active Directory directory …Admin
325While attempting to remove the printer from the Active Directory directory …Admin
326While attempting to publish the printer to the Active Directory directory …Admin
327While attempting to publish the printer to the Active Directory directory …Admin
328While attempting to publish the printer to the Active Directory directory …Admin
329While attempting to publish the printer to the Active Directory directory …Admin
331While attempting to publish the printer to the Active Directory directory …Admin
332The printer was successfully published to the Active Directory directory …Operational
333While attempting to publish the printer to the Active Directory directory …Admin
334The printer was successfully removed from the Active Directory directory …Operational
335While attempting to remove the printer from the Active Directory directory …Admin
336Print queue %1 was successfully updated in the Active Directory directory …Operational
337The print queue could not be found on domain %1.Admin
338Printer %1 was successfully removed from the Active Directory directory service.Operational
342The print spooler removed print queue %1 from the Active Directory directory …Operational
343The print spooler was unable to connect to print queue %1 based on the …Operational
344The print spooler removed print queue %1 from the Active Directory directory …Operational
345The print spooler removed print queue %1 from the Active Directory directory …Operational
346The print spooler removed print queue %1 from the Active Directory directory …Operational
347Print queue %1 could not be deleted (pruned) from the Active Directory directory …Admin
348This version of %1 is incompatible with this version of Windows.Admin
349The print spooler failed to create a symbolic link between …Admin
350Document %1 failed to print and was deleted because of corruption in the spooled …Admin
351The attempt for %1 to use a Windows NT 4.Admin
352The priority of document %1, %2 owned by %3 was changed to %4 on %5.Operational
353The document failed to print because the user did not have the necessary …Admin
354%1 initialization failed at %2.Admin
356Failed to install or update driver %1 on cluster spooler resource %2.Admin
359The attempt to install printer %1 into an offline operating system image failed …Admin
360Updating the color profile failed for printer %1 with Win32 error code %2.Admin
361Printer %1 failed to initialize its ports.Admin
362The print spooler could not initialize because resolving the local machine name …Admin
363The print spooler %1 failed to start.Admin
364Windows could not load print processor %1 because EnumDatatypes did not return …Admin
365Windows could not load print processor %1 because EnumDatatypes failed.Admin
366The print server security descriptor for %1 is invalid.Admin
367Windows could not initialize printer %1 because the print processor %2 could not …Admin
368The print spooler failed to verify printer driver package %1 for environment %2.Operational
369The print spooler failed to verify printer driver package for environment %1.Admin
370The print spooler failed to regenerate the printer driver information for driver …Admin
371The print spooler failed to unshare printer %2 which is shared as %3.Admin
372The document %1, owned by %2, failed to print on printer %3.Admin
373The spooler has detected that a component has an unusually large number of open …Admin
502The print spooler failed to get the computer name.Admin
503The system failed to initialize the local print provider: Error %2.Admin
504Failed to initialize the router work crew: Error %2.Admin
505Failed to create Phase2Init event in WaitForSpoolerInitialization: Error %2.Admin
507The system failed to initialize the name cache: Error %2.Admin
508Failed to initialize the router cache: Error %2.Admin
509The print spooler cannot start because the PrinterBusEnumerator could not start.Admin
510InitializeProvider cannot allocate memory for %1.Admin
511The print spooler failed to load print provider %1.Admin
512InitializePrintProvider failed for provider %1.Admin
513Group Policy was unable to add per computer connection %1.Admin
514Group Policy was unable to delete per computer connection %1.Admin
515Group Policy was unable to delete per computer printer connection %1.Admin
516Group Policy was unable to deploy per computer printer connection %1.Admin
517Group Policy was unable to update per computer printer connection %1.Admin
518Group Policy was unable to delete the per user printer connection %1.Admin
519Group Policy was unable to deploy per user printer connection %1.Admin
520Group Policy was unable to update per user printer connection %1.Admin
600The print spooler failed to import the printer driver that was downloaded from …Admin
601The print spooler failed to download and import the printer driver from %1 into …Admin
602The print spooler failed to reopen an existing printer connection because it …Admin
603The print spooler failed to reopen an existing printer connection because it …Operational
604The print spooler encountered an unknown driver type while saving %1 cache …Admin
701The print filter pipeline host cannot initialize with the Component Object Model …Operational
702The print filter pipeline host is shutting down due to the following error: …Operational
703The print filter pipeline host is shutting down due to an error in signaling the …Operational
704The print filter pipeline host is shutting down because the query interface for …Operational
800Spooling job %1.Operational
801Printing job %1.Operational
802Deleting job %1.Operational
805Rendering job %1.Operational
806Pausing job %1.Debug
807Resuming job %1.Debug
808The print spooler failed to load a plug-in module %1, error code %2.Admin
809The print spooler failed to recursively delete the directory %1, error code %2.Operational
810The print spooler failed to delete the directory %1 and the contained files, …Operational
811The print spooler failed to move the file %1 to %2, error code %4.Operational
812The print spooler failed to delete the file %1, error code %4.Operational
813The print spooler failed to copy the file %1 to %2, error code %4.Operational
814The print spooler failed to install the print processor %1 %2 %3, error code %4.Operational
815The print spooler service failed to register the RPC server protocol sequence …Operational
816The print spooler service detected an invalid RPC protocol sequence %1, …Operational
817The RPC end-point policy for the print spooler service is disabled.Operational
818The print spooler RPC server failed to start, error code %1.Operational
819Client Side Rendering is currently disabled by policy.Operational
820Client side rendering to %1 failed, error code %4.Operational
821The print spooler Client Side Rendering is attempting to render the job %1 on …Operational
822Unknown print processor (%1) or invalid data type (%4), error %7, Client Side …Operational
823The default printer was changed to %3.Admin
824A fatal error occurred while printing job %1, id %2 on the print queue %3.Operational
825Client side rendering to %1 failed, error code %4.Operational
826Force Client Side Rendering policy was successfully set on printer %1, path %2, …Operational
827The specified print queue %1 is invalid.Operational
828The print job %1 failed with error code %2.Operational
829XPS API call %1 (%2) started.Debug
830XPS API call %1 (%2) ended, status %3.Debug
831XPS API dependency %1 (%2) started.Debug
832XPS API dependency %1 (%2) ended, status %3.Debug
833Print spooler operation %1 (%2) started.Debug
834Print spooler operation %1 (%2) ended, status %3.Debug
842The print job %1 was sent through the print processor %2 on printer %3, driver …Operational
843The print spooler service recorded %1 successful and %2 failed RPC requests for …Debug
844The print spooler selected the isolation mode %1 (0 - loaded in the spooler, 1 - …Debug
845Attempted to load module %1 for printer %2, printer driver %3.Debug
846Cached printer %1 has been scavenged and deleted.Operational
847Cached printer %1 has been scheduled for deletion due to a logon scavenging …Operational
848Printer %1 was shared by the print spooler as %2.Operational
849Printer %1 shared as %2 was unshared by the print spooler.Operational
850The print spooler called the function %2 in print driver module %1.Operational
851Point and Print not allowed by policy for queue %1.Operational
852Driver %1 could not be installed for printer connection %3.Admin
853Print Client Side Rendering synchronization for print job cache completed with …Debug
854Print Client Side Rendering synchronization for printer information cache …Debug
855OpenPrinter cache entry added for printer %1 with access code %2.Debug
856Connection '.Operational
857Connection '.Operational
858Connection '.Admin
859Connection '.Operational
860Connection '.Operational
861Connection '.Operational
862Connection '.Admin
863Connection '.Operational
864The Windows Fax and Scan servicing operation failed, HRESULT %1.Operational
865There were %1 print job failures out of %2 jobs sent to printer '%3' using …Admin
866The print spooler failed to create a Plug and Play printer device object for the …Admin
867The WS-Print Port Monitor failed to initialize correctly.Admin
868The Offline EventLog on machine '.Admin
869In VALIDATINGDRVINFO, Adding printer driver %3 failed, error code %2.Admin
870The print spooler failed to download package for driver %1.Admin
871The current print job was rejected due to Device Control Print Restrictions.Admin
1111Driver <DriverName> required for printer <PrinterName> is unknown.Operational
4098The computer <ComputerName or IP> preference item in the '{GUID}' Group Policy …Operational
8192The user <UserName> preference item in the '{GUID}' Group Policy object did not …Operational

Event ID 1 — The print spooler failed to import the printer driver that was downloaded from <ServerName> into the driver store for driver <DriverName>.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Event ID 22 — Failed to upgrade printer settings for printer <PrinterName> driver <DriverName>.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Event ID 23 — Printer <PrinterName> failed to initialize because a suitable <DriverName> driver could not be found.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Event ID 99 — The print spooler encountered a fatal error while executing a critical operation (%1, error %2) and must immediately terminate.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler encountered a fatal error while executing a critical operation (%1, error %2) and must immediately terminate. Try to manually restart the print spooler service (from Control Panel | Administrative Tools | Services or from an elevated command prompt running: net start spooler).

Fields

NameDescription
OperationCode
Error

Event ID 100 — Printer %3 successfully added.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Printer %3 successfully added. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
PrinterName
Status

Event ID 101 — Failed to add printer %3, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Failed to add printer %3, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
PrinterName
Status

Event ID 104 — Deleting printer %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Deleting printer %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
PrinterName
Status

Event ID 105 — Deleting printer %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Deleting printer %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
PrinterName
Status

Event ID 106 — Starting document job %3 for printer %4 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Starting document job %3 for printer %4 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 107 — Starting document job %3 for printer %4 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Starting document job %3 for printer %4 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 110 — Ending document job %3 for printer %4 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Ending document job %3 for printer %4 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 111 — Ending document job %3 for printer %4 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Ending document job %3 for printer %4 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 114 — Adding printer driver %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Adding printer driver %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 115 — Adding printer driver %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Adding printer driver %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 118 — Opening printer %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Opening printer %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 119 — Opening printer %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Opening printer %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 122 — Starting page job %3 at printer %4 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Starting page job %3 at printer %4 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 123 — Starting page failed at printer %3, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Starting page failed at printer %3, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 124 — Ending page job %3 at printer %4 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Ending page job %3 at printer %4 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 125 — Ending page job %3 at printer %4 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Ending page job %3 at printer %4 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
JobID
PrinterName
Status

Event ID 131 — Setting printer %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Setting printer %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
PrinterName
Status

Event ID 200 — Adding CSR printer connection %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Adding CSR printer connection %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 201 — Adding CSR printer connection %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Adding CSR printer connection %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 204 — Deleting CSR printer connection %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Deleting CSR printer connection %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 205 — Deleting CSR printer connection %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Deleting CSR printer connection %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 207 — Opening CSR printer %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Opening CSR printer %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 210 — Closing CSR printer %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Closing CSR printer %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 211 — Closing CSR printer %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Closing CSR printer %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 212 — Parsing inf (%4) for printer driver %5 succeeded (processor architecture %7).

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Parsing inf (%4) for printer driver %5 succeeded (processor architecture %7). See the event user data for context information.

Fields

NameDescription
Label
Message
AdditionalInfo
InfPath
DriverName
InstallSection
ProcessorArchitecture
LastError
HResult

Event ID 213 — Parsing inf (%4) for printer driver %5 failed (processor architecture %7), error code %8, HRESULT %9.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Parsing inf (%4) for printer driver %5 failed (processor architecture %7), error code %8, HRESULT %9. See the event user data for context information.

Fields

NameDescription
Label
Message
AdditionalInfo
InfPath
DriverName
InstallSection
ProcessorArchitecture
LastError
HResult

Event ID 214 — Installing printer driver %5 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Installing printer driver %5 succeeded. See the event user data for context information.

Fields

NameDescription
Label
Message
AdditionalInfo
InfPath
DriverName
InstallSection
ProcessorArchitecture
PackageAware
CoreDriverDependencies
LastError
HResult

Event ID 215 — Installing printer driver %5 failed, error code %10, HRESULT %11.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Installing printer driver %5 failed, error code %10, HRESULT %11. See the event user data for context information.

Fields

NameDescription
Label
Message
AdditionalInfo
InfPath
DriverName
InstallSection
ProcessorArchitecture
PackageAware
CoreDriverDependencies
LastError
HResult

Event ID 216 — A printer setup operation succeeded during the installation process.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

A printer setup operation succeeded during the installation process. See the event user data for context information.

Fields

NameDescription
Context
Message
AdditionalInfo
ProcessorArchitecture
LastError
HResult

Event ID 217 — A printer setup operation failed during the installation process, error code %5, HRESULT %6.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

A printer setup operation failed during the installation process, error code %5, HRESULT %6. See the event user data for context information.

Fields

NameDescription
Context
Message
AdditionalInfo
ProcessorArchitecture
LastError
HResult

Event ID 218 — Copying printer driver package %5 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Copying printer driver package %5 succeeded. See the event user data for context information.

Fields

NameDescription
Label
Message
AdditionalInfo
Server
InfPath
DestInfPath
ProcessorArchitecture
LastError
HResult

Event ID 219 — Copying printer driver package %5 failed, error code %8, HRESULT %9.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Copying printer driver package %5 failed, error code %8, HRESULT %9. See the event user data for context information.

Fields

NameDescription
Label
Message
AdditionalInfo
Server
InfPath
DestInfPath
ProcessorArchitecture
LastError
HResult

Event ID 220 — Retrieving CSR cache information for printer %3 succeeded.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Retrieving CSR cache information for printer %3 succeeded. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 221 — Retrieving CSR cache information for printer %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Retrieving CSR cache information for printer %3 failed, error code %2. See the event user data for context information.

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 222 —

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

%1

Fields

NameDescription
Message
LastError

Event ID 223 —

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

%1

Fields

NameDescription
Message
LastError

Event ID 224 — A remote print driver package operation %1 failed with error code %2, server name %3.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

A remote print driver package operation %1 failed with error code %2, server name %3. This was most likely caused by an unexpected error in the protocol communication between the client and the print server.

Fields

NameDescription
Function
Error
Server

Event ID 225 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An error occurred while installing printer driver '%1'. Error code: %4. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 226 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An error occurred while installing printer driver '%1'. The driver being installed is incompatible with this version of Windows. Please obtain and install a compatible version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device. See the event user data for context information.

Fields

NameDescription
DriverName
InfPath
DriverModelVersion

Event ID 227 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An error occurred while installing printer driver '%1'. Error code: %4. The driver being installed relies on class driver '%3', which is not present on this computer. The class driver may be available on Windows Update. Please ensure that Windows Update is enabled in Device Installation Settings and that a connection can be established, and try again, or choose an alternate driver that works with this print device.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 228 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An error occurred while installing printer driver '%1'. The driver being installed relies on class driver '%3', which failed to install. Error code: %4. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 229 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. The driver must contain a pipelineconfig.xml file.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 230 — A problem was encountered while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

A problem was encountered while installing printer driver '%1'. A printer extension bundled with the driver failed to register, and will be unavailable. Error code: %4. The driver will still be functional. Please obtain and install a new version of the printer extension or printer driver from the manufacturer (if available).

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 231 — An attempt was made to upgrade installed class driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An attempt was made to upgrade installed class driver '%1' to a non-class driver. Doing so will prevent any driver that relies on the class driver to stop functioning. The class driver will remain installed.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 232 — An attempt was made to upgrade installed printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An attempt was made to upgrade installed printer driver '%1' to an older version of the driver, which is unsupported. If the older version of the driver is required, please delete the current version (via Print Management or Print Server Properties) and try again.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 233 — An attempt was made to upgrade installed printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An attempt was made to upgrade installed printer driver '%1' to a version that does not support printer sharing, or may cause compatibility problems when sharing to some computers. In order to use the new driver, please disable sharing for all print queues that are using this driver (via Print Management or the Sharing tab in Printer Properties) and try again.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 234 — A problem was encountered while deleting printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

A problem was encountered while deleting printer driver '%1'. A printer extension bundled with the driver failed to unregister. Error code: %4. The driver will still be deleted.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 235 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. The file '%5' referenced by the %4 directive could not be found.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
Directive
Value

Event ID 236 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. The %4 directive is not allowed for this type of driver. See the event user data for context information.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
Directive
ClassDriverOnly
NonClassDriverOnly

Event ID 237 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. The %4 directive is malformed, by having either an empty token or an incorrect number of tokens. See the event user data for context information.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
Directive
EmptyToken
IncorrectNumberOfTokens

Event ID 238 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. The %4 must be a GUID, but '%5' was provided.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
Directive
Value

Event ID 239 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. The %4 directive must be present in the manifest.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
Directive
Value

Event ID 240 — An error occurred while installing printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An error occurred while installing printer driver '%1'. There must be only one manifest per driver. Either no manifest was found, or too many manifests were found. See the event user data for context information.

Fields

NameDescription
DriverName
InfPath
MissingManifest
MultipleManifests

Event ID 241 — An attempt was made to upgrade installed printer driver '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An attempt was made to upgrade installed printer driver '%1' to a driver that does not support non-inbox port monitors. In order to use the new driver, please remove or reconfigure all print queues that are using this driver and try again.

Fields

NameDescription
DriverName
InfPath
RequiredClassDriver
HResult

Event ID 242 — An error occurred while configuring print queue '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

An error occurred while configuring print queue '%1'. Printer driver '%2' may not be used in conjunction with a non-inbox port monitor.

Fields

NameDescription
PrinterName
DriverName

Event ID 300 — Printer %1 was created.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer %1 was created. No user action is required.

Fields

NameDescription
param1

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 300
  version: 0
  level: 4
  task: 4
  opcode: 11
  keywords: 4611686018427389984
  time_created: '2021-10-27T10:14:27.559950Z'
  event_record_id: 155
  correlation: {}
  execution:
    process_id: 2552
    thread_id: 4028
  channel: Microsoft-Windows-PrintService/Operational
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  PrinterCreated:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: Kiwi Legit Printer

References

Event ID 301 — Printer %1 was deleted, and users will no longer be able to print to this printer.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer %1 was deleted, and users will no longer be able to print to this printer. No user action is required.

Fields

NameDescription
param1

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 301
  version: 0
  level: 4
  task: 5
  opcode: 11
  keywords: 4611686018427389984
  time_created: '2021-10-27T10:14:21.369976Z'
  event_record_id: 152
  correlation:
    '#attributes':
      ActivityID: C43202E9-CB0F-0000-D030-32C40FCBD701
  execution:
    process_id: 2552
    thread_id: 4028
  channel: Microsoft-Windows-PrintService/Operational
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-18
user_data:
  PrinterDeleted:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: Kiwi Legit Printer

References

Event ID 302 — Printer %1 will be deleted.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer %1 will be deleted. No user action is required.

Fields

NameDescription
param1

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 302
  version: 0
  level: 4
  task: 5
  opcode: 10
  keywords: 4611686018427389984
  time_created: '2021-10-27T10:14:21.369976Z'
  event_record_id: 150
  correlation:
    '#attributes':
      ActivityID: C43202E9-CB0F-0000-D030-32C40FCBD701
  execution:
    process_id: 2552
    thread_id: 4028
  channel: Microsoft-Windows-PrintService/Operational
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-18
user_data:
  PrinterDeletionPending:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: Kiwi Legit Printer

References

Event ID 303 — Printer %1 was paused.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Printer %1 was paused. No user action is required.

Fields

NameDescription
param1

Event ID 304 — Printer %1 was resumed.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer %1 was resumed. No user action is required.

Fields

NameDescription
param1

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 304
  version: 0
  level: 4
  task: 24
  opcode: 11
  keywords: 4611686018427389984
  time_created: '2021-10-27T10:28:26.229212Z'
  event_record_id: 3
  correlation: {}
  execution:
    process_id: 1048
    thread_id: 3836
  channel: Microsoft-Windows-PrintService/Operational
  computer: FS03.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  PrinterUnPaused:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: '{BABBC1A0-F75A-44B0-92BC-57E20CEDA1D8}'

References

Event ID 305 — The jobs in the print queue for printer %1 were deleted.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The jobs in the print queue for printer %1 were deleted. No user action is required.

Fields

NameDescription
param1

Event ID 306 — Settings for printer %1 were changed.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Settings for printer %1 were changed. No user action is required.

Fields

NameDescription
param1

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 306
  version: 0
  level: 4
  task: 17
  opcode: 11
  keywords: 4611686018427389984
  time_created: '2021-10-27T10:28:26.229212Z'
  event_record_id: 4
  correlation: {}
  execution:
    process_id: 1048
    thread_id: 3836
  channel: Microsoft-Windows-PrintService/Operational
  computer: FS03.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  PrinterSet:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: '{BABBC1A0-F75A-44B0-92BC-57E20CEDA1D8}'

References

Event ID 307 — Document %1, %2 owned by %3 on %4 was printed on %5 through port %6.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Document %1, %2 owned by %3 on %4 was printed on %5 through port %6.  Size in bytes: %7. Pages printed: %8. No user action is required.

Fields

NameDescription
param1
param2
param3
param4
param5
param6
param7
param8

References

Event ID 308 — Document %1, %2 owned by %3 was paused on %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Document %1, %2 owned by %3 was paused on %4. This document will not print until the document owner resumes the print job. No user action is required.

Fields

NameDescription
param1
param2
param3
param4

Event ID 309 — Document %1, %2 owned by %3 was resumed on %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Document %1, %2 owned by %3 was resumed on %4. No user action is required.

Fields

NameDescription
param1
param2
param3
param4

Event ID 310 — Document %1, %2 owned by %3 was deleted on %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Document %1, %2 owned by %3 was deleted on %4. No user action is required.

Fields

NameDescription
param1
param2
param3
param4

Event ID 311 — An administrator moved document %1, %2 owned by %3 to position %4 on %5.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

An administrator moved document %1, %2 owned by %3 to position %4 on %5. This changes when the document will print. No user action is required.

Fields

NameDescription
param1
param2
param3
param4
param5

Event ID 312 — Form %1 was added.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Form %1 was added. No user action is required.

Fields

NameDescription
param1

Event ID 313 — Form %1 was removed.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Form %1 was removed. No user action is required.

Fields

NameDescription
param1

Event ID 314 — Document %1, %2 owned by %3 timed out while printing on %4.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Document %1, %2 owned by %3 timed out while printing on %4. The spooler waited for %5 milliseconds and no data was received.

Fields

NameDescription
param1
param2
param3
param4
param5

Event ID 315 — The print spooler failed to share printer %2 with shared resource name %3.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to share printer %2 with shared resource name %3. Error %1. The printer cannot be used by others on the network.

Fields

NameDescription
param1
param2
param3

Event ID 316 — Printer driver %1 for %2 %3 was added or updated.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer driver %1 for %2 %3 was added or updated. Files:- %4. No user action is required.

Fields

NameDescription
param1
param2
param3
param4

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 316
  version: 0
  level: 4
  task: 8
  opcode: 11
  keywords: 4611686018427390208
  time_created: '2021-10-27T10:14:27.309949Z'
  event_record_id: 153
  correlation: {}
  execution:
    process_id: 2552
    thread_id: 4028
  channel: Microsoft-Windows-PrintService/Operational
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-18
user_data:
  DriverAdded:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: Generic / Text Only
    Param2: Windows x64
    Param3: Version-3
    Param4: UNIDRV.DLL, UNIDRVUI.DLL, TTY.GPD, UNIDRV.HLP, TTYRES.DLL, TTY.INI, TTY.DLL,
      TTYUI.DLL, TTYUI.HLP, UNIRES.DLL, STDNAMES.GPD, STDDTYPE.GDL, STDSCHEM.GDL,
      STDSCHMX.GDL

References

Event ID 317 — Printer driver %1 was deleted.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer driver %1 was deleted. No user action is required.

Fields

NameDescription
param1

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 317
  version: 0
  level: 4
  task: 9
  opcode: 11
  keywords: 4611686018427390208
  time_created: '2021-10-27T10:28:26.494838Z'
  event_record_id: 10
  correlation: {}
  execution:
    process_id: 1048
    thread_id: 3768
  channel: Microsoft-Windows-PrintService/Operational
  computer: FS03.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  DriverDeleted:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: Generic / Text Only

References

Event ID 318 — Failed to upgrade printer settings for printer %1 driver %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Failed to upgrade printer settings for printer %1 driver %2. Error: %3. The device settings for the printer are set to those configured by the manufacturer.

Fields

NameDescription
param1
param2
param3

Event ID 319 — Printer %1 failed to initialize because a suitable %2 driver could not be found.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Printer %1 failed to initialize because a suitable %2 driver could not be found. The new printer settings that you specified have not taken effect. Install or reinstall the printer driver. You might need to contact the vendor for an updated driver.

Fields

NameDescription
param1
param2

Event ID 320 — Printer %1 failed to initialize because none of its ports (%2) could be found.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Printer %1 failed to initialize because none of its ports (%2) could be found. This can occur if the ports were deleted or the port information is invalid.

Fields

NameDescription
param1
param2

Event ID 321 — File(s) %1 associated with printer %2 were added or updated.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

File(s) %1 associated with printer %2 were added or updated. No user action is required.

Fields

NameDescription
param1
param2

Event ID 322 — While attempting to publish the printer to the Active Directory directory service, Windows failed to publish property %1 at %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, Windows failed to publish property %1 at %2.  Error: %3

Fields

NameDescription
param1
param2
param3

Event ID 323 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not create or update the print queue bec...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler could not create or update the print queue because Windows failed to bind to container: %1.  Error: %2. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1
param2

Event ID 325 — While attempting to remove the printer from the Active Directory directory service, Windows failed to delete print queue %1 at %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to remove the printer from the Active Directory directory service, Windows failed to delete print queue %1 at %2.  Error: %3

Fields

NameDescription
param1
param2
param3

Event ID 326 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not create or update the print queue und...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler could not create or update the print queue under container %1.  Error: %2. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1
param2

Event ID 327 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not create print queue %1 under containe...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler could not create print queue %1 under container %2 because Mandatory properties could not be set.  Error: %3. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1
param2
param3

Event ID 328 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue con...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue container because the primary domain query failed. Error: %1. This can occur if Domain Name System (DNS) cannot resolve the domain controller IP address, or if the domain controller or directory service is not functioning correctly. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1

Event ID 329 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue con...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue container because the Domain Name System (DNS) domain name could not be retrieved. Error: %1. This can occur if DNS cannot resolve the domain controller IP address, or if the domain controller or directory service is not functioning correctly. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1

Event ID 331 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue con...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue container on domain %1.  Error: %2. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1
param2

Event ID 332 — The printer was successfully published to the Active Directory directory service.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The printer was successfully published to the Active Directory directory service. The print queue %1 was successfully created in container %2. No user action is required.

Fields

NameDescription
param1
param2

Event ID 333 — While attempting to publish the printer to the Active Directory directory service, the print spooler failed to create or update print queue %1 in c...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to publish the printer to the Active Directory directory service, the print spooler failed to create or update print queue %1 in container %2.  Error: %3. The printer is not published in Active Directory and cannot be located by searching Active Directory.

Fields

NameDescription
param1
param2
param3

Event ID 334 — The printer was successfully removed from the Active Directory directory service.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The printer was successfully removed from the Active Directory directory service. Print queue %1 was successfully deleted from container %2. The printer can no longer be located by searching Active Directory. No user action is required.

Fields

NameDescription
param1
param2

Event ID 335 — While attempting to remove the printer from the Active Directory directory service, the print spooler failed to delete print queue %1 from containe...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

While attempting to remove the printer from the Active Directory directory service, the print spooler failed to delete print queue %1 from container %2.  Error: %3

Fields

NameDescription
param1
param2
param3

Event ID 336 — Print queue %1 was successfully updated in the Active Directory directory service container %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Print queue %1 was successfully updated in the Active Directory directory service container %2. No user action is required.

Fields

NameDescription
param1
param2

Event ID 337 — The print queue could not be found on domain %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print queue could not be found on domain %1.  It may have been deleted from the Active Directory directory service. Windows will attempt to republish the print queue.  Error: %2

Fields

NameDescription
param1
param2

Event ID 338 — Printer %1 was successfully removed from the Active Directory directory service.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Printer %1 was successfully removed from the Active Directory directory service. The printer can no longer be located by searching Active Directory. No user action is required.

Fields

NameDescription
param1

Event ID 342 — The print spooler removed print queue %1 from the Active Directory directory service because it does not have a Universal Naming Convention (UNC) n...

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler removed print queue %1 from the Active Directory directory service because it does not have a Universal Naming Convention (UNC) name or server name listed. No user action is required.

Fields

NameDescription
param1

Event ID 343 — The print spooler was unable to connect to print queue %1 based on the information published in the Active Directory.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler was unable to connect to print queue %1 based on the information published in the Active Directory. Error %2. No user action is required. If this print queue continues to be unreachable it may be removed from Active Directory.

Fields

NameDescription
param1
param2

Event ID 344 — The print spooler removed print queue %1 from the Active Directory directory service.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler removed print queue %1 from the Active Directory directory service. No user action is required.

Fields

NameDescription
param1

Event ID 345 — The print spooler removed print queue %1 from the Active Directory directory service because it is a duplicate of another print queue.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler removed print queue %1 from the Active Directory directory service because it is a duplicate of another print queue. No user action is required.

Fields

NameDescription
param1

Event ID 346 — The print spooler removed print queue %1 from the Active Directory directory service.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler removed print queue %1 from the Active Directory directory service. No user action is required.

Fields

NameDescription
param1

Event ID 347 — Print queue %1 could not be deleted (pruned) from the Active Directory directory service.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Print queue %1 could not be deleted (pruned) from the Active Directory directory service.  Error: %2. The spooler will periodically try to remove the entry until it is successful. Continued failures may indicate an Active Directory problem, a basic network problem, or a communication problem between the domain controller and the print server.

Fields

NameDescription
param1
param2

Event ID 348 — This version of %1 is incompatible with this version of Windows.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

This version of %1 is incompatible with this version of Windows. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
param1

Event ID 349 — The print spooler failed to create a symbolic link between HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Print\\Printers and HKEY_LOCAL_M...

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to create a symbolic link between HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Print\\Printers and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers. Error %1. This only affects older applications, but is probably a sign that the system itself is in a poor condition or that the print spooler does not have the proper registry permissions.

Fields

NameDescription
param1

Event ID 350 — Document %1 failed to print and was deleted because of corruption in the spooled file.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Document %1 failed to print and was deleted because of corruption in the spooled file. The associated driver is: %2. Try printing the document again.

Fields

NameDescription
param1
param2

Event ID 351 — The attempt for %1 to use a Windows NT 4.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The attempt for %1 to use a Windows NT 4.0 (kernel mode) driver failed because this version of Windows does not support Windows NT 4.0 printer drivers. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
param1

Event ID 352 — The priority of document %1, %2 owned by %3 was changed to %4 on %5.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The priority of document %1, %2 owned by %3 was changed to %4 on %5. Windows prints the document with the highest priority number before other print jobs with lower priority numbers. Documents that are currently printing are unaffected by changes in priority. No user action is required.

Fields

NameDescription
param1
param2
param3
param4
param5

Event ID 353 — The document failed to print because the user did not have the necessary privileges.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The document failed to print because the user did not have the necessary privileges.

Event ID 354 — %1 initialization failed at %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin
Level
2
Samples
1

Message

%1 initialization failed at %2. Error: %3. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
param1
param2
Error

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 354
  version: 0
  level: 2
  task: 36
  opcode: 12
  keywords: 9223372036854777856
  time_created: '2021-10-27T10:28:26.260460Z'
  event_record_id: 10
  correlation: {}
  execution:
    process_id: 1048
    thread_id: 3836
  channel: Microsoft-Windows-PrintService/Admin
  computer: FS03.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  InitFailed:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    Param1: \\fs03vuln\Kiwi Legit Printer
    Param2: \\fs03vuln\print$\W32X86\3\mimispool.dll
    Param3: "2. The system cannot find the file specified.\r\n"

References

Event ID 356 — Failed to install or update driver %1 on cluster spooler resource %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Failed to install or update driver %1 on cluster spooler resource %2. Win32 error: %3. The printer driver is different from the driver in use on other computers (nodes) in the cluster. This can occur because of a transient failure in replication between nodes.

Fields

NameDescription
param1
param2
param3

Event ID 359 — The attempt to install printer %1 into an offline operating system image failed with Win32 error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The attempt to install printer %1 into an offline operating system image failed with Win32 error code %2. This can occur if the printer driver requires user input or displays a user interface (UI) during installation.

Fields

NameDescription
param1
param2

Event ID 360 — Updating the color profile failed for printer %1 with Win32 error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Updating the color profile failed for printer %1 with Win32 error code %2. The colors printed may not be correctly matched to the colors in the document being printed.

Fields

NameDescription
param1
param2

Event ID 361 — Printer %1 failed to initialize its ports.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Printer %1 failed to initialize its ports. Win32 error: %2. This error usually occurs because of a problem with the port monitor. Try recreating the port using a standard TCP/IP printer port, if possible. This problem does not affect other printers.

Fields

NameDescription
param1
param2

Event ID 362 — The print spooler could not initialize because resolving the local machine name to IP addresses failed with error code %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler could not initialize because resolving the local machine name to IP addresses failed with error code %1. This may be a transient error. Try to manually restart the print spooler service (from Control Panel | Administrative Tools | Services or from an elevated command prompt running: net start spooler).

Fields

NameDescription
param1

Event ID 363 — The print spooler %1 failed to start.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler %1 failed to start. To determine the cause of this error, examine the preceding events in the Event Log.

Fields

NameDescription
param1

Event ID 364 — Windows could not load print processor %1 because EnumDatatypes did not return any data.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Windows could not load print processor %1 because EnumDatatypes did not return any data. Module: %2. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
param1
param2

Event ID 365 — Windows could not load print processor %1 because EnumDatatypes failed.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Windows could not load print processor %1 because EnumDatatypes failed. Error code %2. Module: %3. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
param1
param2
param3

Event ID 366 — The print server security descriptor for %1 is invalid.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print server security descriptor for %1 is invalid. The default print server security descriptor will be used.

Fields

NameDescription
param1

Event ID 367 — Windows could not initialize printer %1 because the print processor %2 could not be found.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Windows could not initialize printer %1 because the print processor %2 could not be found. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields

NameDescription
param1
param2

Event ID 368 — The print spooler failed to verify printer driver package %1 for environment %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to verify printer driver package %1 for environment %2. Win32 system error code %3. This can occur after an operating system upgrade or because of data loss on the hard drive. The print spooler will try to regenerate the driver information from the driver store, which is where drivers are saved before they are installed. No user action is required.

Fields

NameDescription
param1
param2
param3

Event ID 369 — The print spooler failed to verify printer driver package for environment %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to verify printer driver package for environment %1. Win32 system error code %2. This can occur because of insufficient memory or other system failures. No user action is required.

Fields

NameDescription
param1
param2

Event ID 370 — The print spooler failed to regenerate the printer driver information for driver %1 for environment %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to regenerate the printer driver information for driver %1 for environment %2. Win32 system error code %3. This can occur after an operating system upgrade or because of data loss on the hard drive.

Fields

NameDescription
param1
param2
param3

Event ID 371 — The print spooler failed to unshare printer %2 which is shared as %3.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to unshare printer %2 which is shared as %3. Error %1.

Fields

NameDescription
param1
param2
param3

Event ID 372 — The document %1, owned by %2, failed to print on printer %3.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The document %1, owned by %2, failed to print on printer %3. Try to print the document again, or restart the print spooler. 
Data type: %4. Size of the spool file in bytes: %5. Number of bytes printed: %6. Total number of pages in the document: %7. Number of pages printed: %8. Client computer: %9. Win32 error code returned by the print processor: %10. %11

Fields

NameDescription
param1
param2
param3
param4
param5
param6
param7
param8
param9
param10
param11

Event ID 373 — The spooler has detected that a component has an unusually large number of open Graphical Device Interface (GDI) objects.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The spooler has detected that a component has an unusually large number of open Graphical Device Interface (GDI) objects. As a result, some enhanced metafile (EMF) print jobs might not print until the spooler is restarted.

Event ID 502 — The print spooler failed to get the computer name.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to get the computer name. Error %2. This can occur due to system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 503 — The system failed to initialize the local print provider: Error %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The system failed to initialize the local print provider: Error %2. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 504 — Failed to initialize the router work crew: Error %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Failed to initialize the router work crew: Error %2. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 505 — Failed to create Phase2Init event in WaitForSpoolerInitialization: Error %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Failed to create Phase2Init event in WaitForSpoolerInitialization: Error %2. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 507 — The system failed to initialize the name cache: Error %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The system failed to initialize the name cache: Error %2. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 508 — Failed to initialize the router cache: Error %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Failed to initialize the router cache: Error %2. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 509 — The print spooler cannot start because the PrinterBusEnumerator could not start.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler cannot start because the PrinterBusEnumerator could not start. Error code %2. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 510 — InitializeProvider cannot allocate memory for %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

InitializeProvider cannot allocate memory for %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 511 — The print spooler failed to load print provider %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to load print provider %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 512 — InitializePrintProvider failed for provider %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

InitializePrintProvider failed for provider %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
Name
Error

Event ID 513 — Group Policy was unable to add per computer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to add per computer connection %1. Error code %2. This can occur if the name of the printer connection is incorrect, or if the print spooler cannot contact the print server.

Fields

NameDescription
Name
Error

Event ID 514 — Group Policy was unable to delete per computer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to delete per computer connection %1. Error %2. This can occur if the name of the printer connection is incorrect, or if the print spooler cannot contact the print server.

Fields

NameDescription
Name
Error

Event ID 515 — Group Policy was unable to delete per computer printer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to delete per computer printer connection %1. Error %2. The printer connection is still available to users on this computer. This can occur if the name of the printer connection is incorrect, if there is a Group Policy problem, or if the print spooler cannot contact the print server. Group Policy will periodically retry deleting the printer connection.

Fields

NameDescription
Name
Error

Event ID 516 — Group Policy was unable to deploy per computer printer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to deploy per computer printer connection %1. Error %2. The printer connection is not available to users on this computer. This can occur if the name of the printer connection is incorrect, if there is a Group Policy problem, or if the print spooler cannot contact the print server. Group Policy will periodically retry adding the printer connection.

Fields

NameDescription
Name
Error

Event ID 517 — Group Policy was unable to update per computer printer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to update per computer printer connection %1. Error code %2. This can occur if the name of the printer connection is incorrect, if there is a Group Policy problem, or if the print spooler cannot contact the print server. Group Policy will periodically retry updating the printer connection.

Fields

NameDescription
Name
Error

Event ID 518 — Group Policy was unable to delete the per user printer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to delete the per user printer connection %1. Error code %2. The printer connection is still available to users on this computer. This can occur if the name of the printer connection is incorrect, if there is a Group Policy problem, or if the print spooler cannot contact the print server. Group Policy will periodically retry deleting the printer connection.

Fields

NameDescription
Name
Error

Event ID 519 — Group Policy was unable to deploy per user printer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to deploy per user printer connection %1. Error code %2. The printer connection is not available to the users on this computer to which the Group Policy object applies. This can occur if the name of the printer connection is incorrect, if there is a Group Policy problem, or if the print spooler cannot contact the print server. Group Policy will periodically retry adding the printer connection.

Fields

NameDescription
Name
Error

Event ID 520 — Group Policy was unable to update per user printer connection %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Group Policy was unable to update per user printer connection %1. Error code %2. This can occur if the name of the printer connection is incorrect, if there is a Group Policy problem, or if the print spooler cannot contact the print server. Group Policy will periodically retry updating the printer connection.

Fields

NameDescription
Name
Error

Event ID 600 — The print spooler failed to import the printer driver that was downloaded from %1 into the driver store for driver %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to import the printer driver that was downloaded from %1 into the driver store for driver %2. Error code= %3. This can occur if there is a problem with the driver or the digital signature of the driver.

Fields

NameDescription
DriverSource
Driver
Error

Event ID 601 — The print spooler failed to download and import the printer driver from %1 into the driver store for driver %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to download and import the printer driver from %1 into the driver store for driver %2. Error code= %3.

Fields

NameDescription
DriverSource
Driver
Error

Event ID 602 — The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key %1\%2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key %1\%2. This can occur if the key name or values are malformed or missing.

Fields

NameDescription
RegistryKey1
RegistryKey2

Event ID 603 — The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key %1. The print spooler could not open the registry key. This can occur if the registry key is corrupt or missing, or if the registry recently became unavailable.

Fields

NameDescription
RegistryKey

Event ID 604 — The print spooler encountered an unknown driver type while saving %1 cache information.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler encountered an unknown driver type while saving %1 cache information. This can occur because of a protocol or network error.

Fields

NameDescription
Name

Event ID 701 — The print filter pipeline host cannot initialize with the Component Object Model (COM) system.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print filter pipeline host cannot initialize with the Component Object Model (COM) system. Error %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
HResult

Event ID 702 — The print filter pipeline host is shutting down due to the following error: Error %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print filter pipeline host is shutting down due to the following error: Error %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
HResult

Event ID 703 — The print filter pipeline host is shutting down due to an error in signaling the Component Object Model (COM) proxy in the spooler.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print filter pipeline host is shutting down due to an error in signaling the Component Object Model (COM) proxy in the spooler. Error %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
HResult

Event ID 704 — The print filter pipeline host is shutting down because the query interface for ISignal in the Component Object Model (COM) proxy in the spooler fa...

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print filter pipeline host is shutting down because the query interface for ISignal in the Component Object Model (COM) proxy in the spooler failed. Error %1. This can occur because of system instability or a lack of system resources.

Fields

NameDescription
HResult

Event ID 800 — Spooling job %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Spooling job %1.

Fields

NameDescription
JobId

Event ID 801 — Printing job %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Printing job %1.

Fields

NameDescription
JobId

Event ID 802 — Deleting job %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Deleting job %1.

Fields

NameDescription
JobId
JobSize
DataType
Pages
PagesPerSide
FilesOpened
JobSizeHigh

Event ID 805 — Rendering job %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Rendering job %1.

Fields

NameDescription
JobId
GdiJobSize
ICMMethod
Color
XRes
YRes
Quality
Copies
TTOption

References

Event ID 806 — Pausing job %1.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Pausing job %1.

Fields

NameDescription
JobId

Event ID 807 — Resuming job %1.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Resuming job %1.

Fields

NameDescription
JobId

Event ID 808 — The print spooler failed to load a plug-in module %1, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin
Level
2
Samples
1

Message

The print spooler failed to load a plug-in module %1, error code %2. See the event user data for context information.

Fields

NameDescription
PluginDllName
ErrorCode
Context

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 808
  version: 0
  level: 2
  task: 36
  opcode: 12
  keywords: 9223372036854906880
  time_created: '2021-10-27T10:28:26.322960Z'
  event_record_id: 12
  correlation:
    '#attributes':
      ActivityID: 8811EC75-6F9C-4103-BB8A-EEED31FA139D
  execution:
    process_id: 1656
    thread_id: 1572
  channel: Microsoft-Windows-PrintService/Admin
  computer: FS03.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  LoadPluginFailed:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    PluginDllName: C:\Windows\system32\spool\DRIVERS\x64\3mimispool.dll
    ErrorCode: '0x7e'
    Context: 110

References

Event ID 809 — The print spooler failed to recursively delete the directory %1, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to recursively delete the directory %1, error code %2. See the event user data for context information.

Fields

NameDescription
DirectoryName
WaitForReboot
ErrorCode
Context

Event ID 810 — The print spooler failed to delete the directory %1 and the contained files, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to delete the directory %1 and the contained files, error code %2. See the event user data for context information.

Fields

NameDescription
DirectoryName
WaitForReboot
ErrorCode
Context

Event ID 811 — The print spooler failed to move the file %1 to %2, error code %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to move the file %1 to %2, error code %4. See the event user data for context information.

Fields

NameDescription
Source
Destination
Flags
ErrorCode
Context

Event ID 812 — The print spooler failed to delete the file %1, error code %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to delete the file %1, error code %4. See the event user data for context information.

Fields

NameDescription
Source
Destination
Flags
ErrorCode
Context

References

Event ID 813 — The print spooler failed to copy the file %1 to %2, error code %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to copy the file %1 to %2, error code %4. See the event user data for context information.

Fields

NameDescription
Source
Destination
Flags
ErrorCode
Context

Event ID 814 — The print spooler failed to install the print processor %1 %2 %3, error code %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler failed to install the print processor %1 %2 %3, error code %4.

Fields

NameDescription
Processor
Environment
Path
ErrorCode

Event ID 815 — The print spooler service failed to register the RPC server protocol sequence %1, error code %3.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler service failed to register the RPC server protocol sequence %1, error code %3. See the event user data for context information.

Fields

NameDescription
ProtocolSequence
EndPoint
ErrorCode
Context

Event ID 816 — The print spooler service detected an invalid RPC protocol sequence %1, expecting %2, error code %3.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler service detected an invalid RPC protocol sequence %1, expecting %2, error code %3.

Fields

NameDescription
ValidatedProtocolSequence
ExpectedProtocolSequence
ErrorCode

Event ID 817 — The RPC end-point policy for the print spooler service is disabled.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The RPC end-point policy for the print spooler service is disabled. See the event user data for context information.

Fields

NameDescription
WindowsStarterEdition
SuiteStorageServer
SystemPrintingDisabled
SuiteBlade
SuiteEmbeddedRestricted
SuiteComputerServer

Event ID 818 — The print spooler RPC server failed to start, error code %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler RPC server failed to start, error code %1. See the event user data for context information.

Fields

NameDescription
ErrorCode
Context

Event ID 819 — Client Side Rendering is currently disabled by policy.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Client Side Rendering is currently disabled by policy (%1).

Fields

NameDescription
Policy

Event ID 820 — Client side rendering to %1 failed, error code %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Client side rendering to %1 failed, error code %4. The print spooler service will retry server side rendering. See the event user data for more context information.

Fields

NameDescription
PrintProcessor
Connection
IsXpsPrinter
ErrorCode

Event ID 821 — The print spooler Client Side Rendering is attempting to render the job %1 on the server (Server Side Rendering), status %3.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler Client Side Rendering is attempting to render the job %1 on the server (Server Side Rendering), status %3. See the event user data for context information.

Fields

NameDescription
JobId
Level
Status

Event ID 822 — Unknown print processor (%1) or invalid data type (%4), error %7, Client Side Rendering is disabled.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Unknown print processor (%1) or invalid data type (%4), error %7, Client Side Rendering is disabled. See the event user data for more context information.

Fields

NameDescription
LocalPrintProcessor
RemotePrintProcessor
DefaultPrintProcessor
LocalDataType
RemoteDataType
DefaultDataType
ErrorCode

Event ID 823 — The default printer was changed to %3.

Provider
Microsoft-Windows-PrintService
Channel
Admin
Level
4
Samples
1

Message

The default printer was changed to %3. See the event user data for context information.

Fields

NameDescription
DefaultPrinterSelectedBySpooler
OldDefaultPrinter
NewDefaultPrinter
Status
Module

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 823
  version: 0
  level: 4
  task: 49
  opcode: 11
  keywords: 9223372036854906880
  time_created: '2021-10-27T10:09:16.280929Z'
  event_record_id: 4
  correlation: {}
  execution:
    process_id: 2552
    thread_id: 4012
  channel: Microsoft-Windows-PrintService/Admin
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
  ChangingDefaultPrinter:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    DefaultPrinterSelectedBySpooler: 1
    OldDefaultPrinter: '-'
    NewDefaultPrinter: Kiwi Legit Printer
    Status: '0x0'
    Module: spoolsv.exe

References

Event ID 824 — A fatal error occurred while printing job %1, id %2 on the print queue %3.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

A fatal error occurred while printing job %1, id %2 on the print queue %3. The print filter pipeline process was terminated. Error information: %4.

Fields

NameDescription
DocumentName
JobId
PrintQueue
ErrorInfo

Event ID 825 — Client side rendering to %1 failed, error code %4.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Client side rendering to %1 failed, error code %4. The print spooler service will not retry server side rendering. See the event user data for more context information.

Fields

NameDescription
PrintProcessor
Connection
IsXpsPrinter
ErrorCode

Event ID 826 — Force Client Side Rendering policy was successfully set on printer %1, path %2, port %3.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Force Client Side Rendering policy was successfully set on printer %1, path %2, port %3.

Fields

NameDescription
PrinterName
PrinterPath
PortName

Event ID 827 — The specified print queue %1 is invalid.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The specified print queue %1 is invalid.

Fields

NameDescription
QueueName

Event ID 828 — The print job %1 failed with error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print job %1 failed with error code %2.

Fields

NameDescription
JobId
ErrorCode

Event ID 829 — XPS API call %1 (%2) started.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

XPS API call %1 (%2) started.

Fields

NameDescription
Name
Context
StatusCode

Event ID 830 — XPS API call %1 (%2) ended, status %3.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

XPS API call %1 (%2) ended, status %3.

Fields

NameDescription
Name
Context
StatusCode

Event ID 831 — XPS API dependency %1 (%2) started.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

XPS API dependency %1 (%2) started.

Fields

NameDescription
Name
Context
StatusCode

Event ID 832 — XPS API dependency %1 (%2) ended, status %3.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

XPS API dependency %1 (%2) ended, status %3.

Fields

NameDescription
Name
Context
StatusCode

Event ID 833 — Print spooler operation %1 (%2) started.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Print spooler operation %1 (%2) started.

Fields

NameDescription
Name
Context
StatusCode

Event ID 834 — Print spooler operation %1 (%2) ended, status %3.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Print spooler operation %1 (%2) ended, status %3.

Fields

NameDescription
Name
Context
StatusCode

Event ID 842 — The print job %1 was sent through the print processor %2 on printer %3, driver %4, in the isolation mode %5.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print job %1 was sent through the print processor %2 on printer %3, driver %4, in the isolation mode %5 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox). Win32 error code returned by the print processor: %6.

Fields

NameDescription
JobId
Processor
Printer
Driver
IsolationMode
Error

References

Event ID 843 — The print spooler service recorded %1 successful and %2 failed RPC requests for all active print driver sandbox hosts.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

The print spooler service recorded %1 successful and %2 failed RPC requests for all active print driver sandbox hosts.

Fields

NameDescription
SucceededRpcCalls
FailedRpcCalls

Event ID 844 — The print spooler selected the isolation mode %1 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox) for prin...

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

The print spooler selected the isolation mode %1 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox) for printer %2, printer driver %3.

Fields

NameDescription
IsolationMode
Printer
Driver

Event ID 845 — Attempted to load module %1 for printer %2, printer driver %3.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Attempted to load module %1 for printer %2, printer driver %3. Win32 error code %4.

Fields

NameDescription
Module
Printer
Driver
Error

Event ID 846 — Cached printer %1 has been scavenged and deleted.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Cached printer %1 has been scavenged and deleted. This printer's age (%2 seconds) has surpassed the expiry age of %3 seconds.

Fields

NameDescription
PrinterName
PrinterAge
ExpiryAge

Event ID 847 — Cached printer %1 has been scheduled for deletion due to a logon scavenging operation.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Cached printer %1 has been scheduled for deletion due to a logon scavenging operation. This printer is no longer referenced in the registry.

Fields

NameDescription
PrinterName

Event ID 848 — Printer %1 was shared by the print spooler as %2.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer %1 was shared by the print spooler as %2.

Fields

NameDescription
PrinterName
ShareName

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 848
  version: 0
  level: 4
  task: 30
  opcode: 11
  keywords: 4611686018427387936
  time_created: '2021-10-27T10:14:27.466200Z'
  event_record_id: 154
  correlation: {}
  execution:
    process_id: 2552
    thread_id: 4028
  channel: Microsoft-Windows-PrintService/Operational
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-18
user_data:
  PrinterSharing:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    PrinterName: Kiwi Legit Printer
    ShareName: Kiwi Legit Printer

References

Event ID 849 — Printer %1 shared as %2 was unshared by the print spooler.

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
4
Samples
1

Message

Printer %1 shared as %2 was unshared by the print spooler.

Fields

NameDescription
PrinterName
ShareName

Example Event

system:
  provider: Microsoft-Windows-PrintService
  guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
  event_source_name: ''
  event_id: 849
  version: 0
  level: 4
  task: 31
  opcode: 11
  keywords: 4611686018427387936
  time_created: '2021-10-27T10:14:21.369976Z'
  event_record_id: 151
  correlation:
    '#attributes':
      ActivityID: C43202E9-CB0F-0000-D030-32C40FCBD701
  execution:
    process_id: 2552
    thread_id: 4028
  channel: Microsoft-Windows-PrintService/Operational
  computer: fs03vuln.offsec.lan
  security:
    user_id: S-1-5-18
user_data:
  PrinterSharing:
    '#attributes':
      xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
    PrinterName: Kiwi Legit Printer
    ShareName: Kiwi Legit Printer

References

Event ID 850 — The print spooler called the function %2 in print driver module %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The print spooler called the function %2 in print driver module %1. This call initialized the Component Object Model (COM) system without properly un-initializing it.

Fields

NameDescription
Driver
Function

Event ID 851 — Point and Print not allowed by policy for queue %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Point and Print not allowed by policy for queue %1. Cannot make a Point and Print connection to this queue. Error %2.

Fields

NameDescription
PrintQueue
Error

Event ID 852 — Driver %1 could not be installed for printer connection %3.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Driver %1 could not be installed for printer connection %3. The print system selected the replacement driver %2 for the printer connection. No user action is required.

Fields

NameDescription
OriginalDriver
NewDriver
PrinterName

Event ID 853 — Print Client Side Rendering synchronization for print job cache completed with code %1 for printer %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Print Client Side Rendering synchronization for print job cache completed with code %1 for printer %2.

Fields

NameDescription
Error
PrinterName

Event ID 854 — Print Client Side Rendering synchronization for printer information cache completed with code %1 for printer %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

Print Client Side Rendering synchronization for printer information cache completed with code %1 for printer %2.

Fields

NameDescription
Error
PrinterName

Event ID 855 — OpenPrinter cache entry added for printer %1 with access code %2.

Provider
Microsoft-Windows-PrintService
Channel
Debug

Message

OpenPrinter cache entry added for printer %1 with access code %2.

Fields

NameDescription
PrinterName
AccessCode

Event ID 856 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Connection '%1' has been reconfigured for normal operation because branch office printing has been disabled.

Fields

NameDescription
ConnectionName

Event ID 857 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Connection '%1' has been reconfigured for normal operation because the queue is incompatible with branch office printing.

Fields

NameDescription
ConnectionName

Event ID 858 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Connection '%1' has been reconfigured for normal operation because the queue has been configured for Server Side Rendering. To re-enable Branch Office Printing, enable the 'Render Jobs On Client' setting on the server queue.

Fields

NameDescription
ConnectionName

Event ID 859 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Connection '%1' has been reconfigured for normal operation because the client is incompatible with branch office printing.

Fields

NameDescription
ConnectionName

Event ID 860 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Connection '%1' has been reconfigured for normal operation because the server is incompatible with branch office printing.

Fields

NameDescription
ConnectionName

Event ID 861 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Connection '%1' has been reconfigured for normal operation because the remote port is incompatible with branch office printing.

Fields

NameDescription
ConnectionName

Event ID 862 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

Connection '%1' has been reconfigured for normal operation because the 'Keep Printed Jobs' setting is enabled on the queue. To re-enable Branch Office Printing, disable the 'Keep Printed Jobs' setting on the server queue.

Fields

NameDescription
ConnectionName

Event ID 863 — Connection '.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

Connection '%1' has been reconfigured for normal operation due to an internal error, %2.

Fields

NameDescription
ConnectionName
Error

Event ID 864 — The Windows Fax and Scan servicing operation failed, HRESULT %1.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Message

The Windows Fax and Scan servicing operation failed, HRESULT %1.

Fields

NameDescription
HResult

Event ID 865 — There were %1 print job failures out of %2 jobs sent to printer '%3' using driver '%4'.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

There were %1 print job failures out of %2 jobs sent to printer '%3' using driver '%4'. The printer driver isolation setting was updated to load the printer driver inside the print spooler process. No user action is required.

Fields

NameDescription
Failures
Jobs
PrinterName
DriverName

Event ID 866 — The print spooler failed to create a Plug and Play printer device object for the printer '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to create a Plug and Play printer device object for the printer '%1'. Print object instance identifier '%2'. Error code %3. This printer will not be fully functional until the print spooler service is restarted and the Plug and Play printer device object is successfully created.

Fields

NameDescription
PrinterName
DeviceObjectInstanceIdentifier
HResultErrorCode

Event ID 867 — The WS-Print Port Monitor failed to initialize correctly.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The WS-Print Port Monitor failed to initialize correctly. Creating the Device Association listener failed with the following error code: %1.

Fields

NameDescription
HResultErrorCode

Event ID 868 — The Offline EventLog on machine '.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The Offline EventLog on machine '%1' exceeded the allow maximum size. Some job events may have been lost.

Fields

NameDescription
MachineName

Event ID 869 — In VALIDATINGDRVINFO, Adding printer driver %3 failed, error code %2.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

In VALIDATINGDRVINFO, Adding printer driver %3 failed, error code %2. See the event user data for context information. Driver has no valid catalog

Fields

NameDescription
Label
ErrorCode
ObjectName

Event ID 870 — The print spooler failed to download package for driver %1.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The print spooler failed to download package for driver %1. Error code= %2. Blocking driver as there could be a possibility of potential tampering.

Fields

NameDescription
Driver
Error

Event ID 871 — The current print job was rejected due to Device Control Print Restrictions.

Provider
Microsoft-Windows-PrintService
Channel
Admin

Message

The current print job was rejected due to Device Control Print Restrictions. Rejection Reason: %1, Printer: %2, Job or Document Name: %3, User Name: %4, Port Name: %5

Fields

NameDescription
RestrictionReason
PrinterName
JobOrDocumentName
UserName
PortName

Event ID 1111 — Driver <DriverName> required for printer <PrinterName> is unknown.

Provider
Microsoft-Windows-PrintService
Channel
Operational

Event ID 4098 — The computer <ComputerName or IP> preference item in the '{GUID}' Group Policy object did not apply because it failed with error code '0x80070bcb The specified printer driver was not found on the s...

Provider
Microsoft-Windows-PrintService
Channel
Operational

Event ID 8192 — The user <UserName> preference item in the '{GUID}' Group Policy object did not apply because it failed with error code '0x80070bcb The specified printer driver was not found on the system and need...

Provider
Microsoft-Windows-PrintService
Channel
Operational