Microsoft-Windows-PrintService
218 events across 3 channels
Event ID 1 — The print spooler failed to import the printer driver that was downloaded from <ServerName> into the driver store for driver <DriverName>.
Event ID 22 — Failed to upgrade printer settings for printer <PrinterName> driver <DriverName>.
Event ID 23 — Printer <PrinterName> failed to initialize because a suitable <DriverName> driver could not be found.
Event ID 99 — The print spooler encountered a fatal error while executing a critical operation (%1, error %2) and must immediately terminate.
Message
Fields
| Name | Description |
|---|---|
OperationCode | — |
Error | — |
Event ID 100 — Printer %3 successfully added.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
PrinterName | — |
Status | — |
Event ID 101 — Failed to add printer %3, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
PrinterName | — |
Status | — |
Event ID 104 — Deleting printer %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
PrinterName | — |
Status | — |
Event ID 105 — Deleting printer %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
PrinterName | — |
Status | — |
Event ID 106 — Starting document job %3 for printer %4 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 107 — Starting document job %3 for printer %4 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 110 — Ending document job %3 for printer %4 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 111 — Ending document job %3 for printer %4 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 114 — Adding printer driver %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 115 — Adding printer driver %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 118 — Opening printer %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 119 — Opening printer %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 122 — Starting page job %3 at printer %4 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 123 — Starting page failed at printer %3, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 124 — Ending page job %3 at printer %4 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 125 — Ending page job %3 at printer %4 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
JobID | — |
PrinterName | — |
Status | — |
Event ID 131 — Setting printer %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
PrinterName | — |
Status | — |
Event ID 200 — Adding CSR printer connection %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 201 — Adding CSR printer connection %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 204 — Deleting CSR printer connection %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 205 — Deleting CSR printer connection %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 207 — Opening CSR printer %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 210 — Closing CSR printer %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 211 — Closing CSR printer %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 212 — Parsing inf (%4) for printer driver %5 succeeded (processor architecture %7).
Message
Fields
| Name | Description |
|---|---|
Label | — |
Message | — |
AdditionalInfo | — |
InfPath | — |
DriverName | — |
InstallSection | — |
ProcessorArchitecture | — |
LastError | — |
HResult | — |
Event ID 213 — Parsing inf (%4) for printer driver %5 failed (processor architecture %7), error code %8, HRESULT %9.
Message
Fields
| Name | Description |
|---|---|
Label | — |
Message | — |
AdditionalInfo | — |
InfPath | — |
DriverName | — |
InstallSection | — |
ProcessorArchitecture | — |
LastError | — |
HResult | — |
Event ID 214 — Installing printer driver %5 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
Message | — |
AdditionalInfo | — |
InfPath | — |
DriverName | — |
InstallSection | — |
ProcessorArchitecture | — |
PackageAware | — |
CoreDriverDependencies | — |
LastError | — |
HResult | — |
Event ID 215 — Installing printer driver %5 failed, error code %10, HRESULT %11.
Message
Fields
| Name | Description |
|---|---|
Label | — |
Message | — |
AdditionalInfo | — |
InfPath | — |
DriverName | — |
InstallSection | — |
ProcessorArchitecture | — |
PackageAware | — |
CoreDriverDependencies | — |
LastError | — |
HResult | — |
Event ID 216 — A printer setup operation succeeded during the installation process.
Message
Fields
| Name | Description |
|---|---|
Context | — |
Message | — |
AdditionalInfo | — |
ProcessorArchitecture | — |
LastError | — |
HResult | — |
Event ID 217 — A printer setup operation failed during the installation process, error code %5, HRESULT %6.
Message
Fields
| Name | Description |
|---|---|
Context | — |
Message | — |
AdditionalInfo | — |
ProcessorArchitecture | — |
LastError | — |
HResult | — |
Event ID 218 — Copying printer driver package %5 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
Message | — |
AdditionalInfo | — |
Server | — |
InfPath | — |
DestInfPath | — |
ProcessorArchitecture | — |
LastError | — |
HResult | — |
Event ID 219 — Copying printer driver package %5 failed, error code %8, HRESULT %9.
Message
Fields
| Name | Description |
|---|---|
Label | — |
Message | — |
AdditionalInfo | — |
Server | — |
InfPath | — |
DestInfPath | — |
ProcessorArchitecture | — |
LastError | — |
HResult | — |
Event ID 220 — Retrieving CSR cache information for printer %3 succeeded.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 221 — Retrieving CSR cache information for printer %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 222 —
Message
Fields
| Name | Description |
|---|---|
Message | — |
LastError | — |
Event ID 223 —
Message
Fields
| Name | Description |
|---|---|
Message | — |
LastError | — |
Event ID 224 — A remote print driver package operation %1 failed with error code %2, server name %3.
Message
Fields
| Name | Description |
|---|---|
Function | — |
Error | — |
Server | — |
Event ID 225 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 226 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
DriverModelVersion | — |
Event ID 227 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 228 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 229 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 230 — A problem was encountered while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 231 — An attempt was made to upgrade installed class driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 232 — An attempt was made to upgrade installed printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 233 — An attempt was made to upgrade installed printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 234 — A problem was encountered while deleting printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 235 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
Directive | — |
Value | — |
Event ID 236 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
Directive | — |
ClassDriverOnly | — |
NonClassDriverOnly | — |
Event ID 237 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
Directive | — |
EmptyToken | — |
IncorrectNumberOfTokens | — |
Event ID 238 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
Directive | — |
Value | — |
Event ID 239 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
Directive | — |
Value | — |
Event ID 240 — An error occurred while installing printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
MissingManifest | — |
MultipleManifests | — |
Event ID 241 — An attempt was made to upgrade installed printer driver '.
Message
Fields
| Name | Description |
|---|---|
DriverName | — |
InfPath | — |
RequiredClassDriver | — |
HResult | — |
Event ID 242 — An error occurred while configuring print queue '.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
DriverName | — |
Event ID 300 — Printer %1 was created.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 300
version: 0
level: 4
task: 4
opcode: 11
keywords: 4611686018427389984
time_created: '2021-10-27T10:14:27.559950Z'
event_record_id: 155
correlation: {}
execution:
process_id: 2552
thread_id: 4028
channel: Microsoft-Windows-PrintService/Operational
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
PrinterCreated:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: Kiwi Legit Printer
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 301 — Printer %1 was deleted, and users will no longer be able to print to this printer.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 301
version: 0
level: 4
task: 5
opcode: 11
keywords: 4611686018427389984
time_created: '2021-10-27T10:14:21.369976Z'
event_record_id: 152
correlation:
'#attributes':
ActivityID: C43202E9-CB0F-0000-D030-32C40FCBD701
execution:
process_id: 2552
thread_id: 4028
channel: Microsoft-Windows-PrintService/Operational
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-18
user_data:
PrinterDeleted:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: Kiwi Legit Printer
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 302 — Printer %1 will be deleted.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 302
version: 0
level: 4
task: 5
opcode: 10
keywords: 4611686018427389984
time_created: '2021-10-27T10:14:21.369976Z'
event_record_id: 150
correlation:
'#attributes':
ActivityID: C43202E9-CB0F-0000-D030-32C40FCBD701
execution:
process_id: 2552
thread_id: 4028
channel: Microsoft-Windows-PrintService/Operational
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-18
user_data:
PrinterDeletionPending:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: Kiwi Legit Printer
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 303 — Printer %1 was paused.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 304 — Printer %1 was resumed.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 304
version: 0
level: 4
task: 24
opcode: 11
keywords: 4611686018427389984
time_created: '2021-10-27T10:28:26.229212Z'
event_record_id: 3
correlation: {}
execution:
process_id: 1048
thread_id: 3836
channel: Microsoft-Windows-PrintService/Operational
computer: FS03.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
PrinterUnPaused:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: '{BABBC1A0-F75A-44B0-92BC-57E20CEDA1D8}'
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 305 — The jobs in the print queue for printer %1 were deleted.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 306 — Settings for printer %1 were changed.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 306
version: 0
level: 4
task: 17
opcode: 11
keywords: 4611686018427389984
time_created: '2021-10-27T10:28:26.229212Z'
event_record_id: 4
correlation: {}
execution:
process_id: 1048
thread_id: 3836
channel: Microsoft-Windows-PrintService/Operational
computer: FS03.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
PrinterSet:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: '{BABBC1A0-F75A-44B0-92BC-57E20CEDA1D8}'
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 307 — Document %1, %2 owned by %3 on %4 was printed on %5 through port %6.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
param5 | — |
param6 | — |
param7 | — |
param8 | — |
References
Event ID 308 — Document %1, %2 owned by %3 was paused on %4.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
Event ID 309 — Document %1, %2 owned by %3 was resumed on %4.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
Event ID 310 — Document %1, %2 owned by %3 was deleted on %4.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
Event ID 311 — An administrator moved document %1, %2 owned by %3 to position %4 on %5.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
param5 | — |
Event ID 312 — Form %1 was added.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 313 — Form %1 was removed.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 314 — Document %1, %2 owned by %3 timed out while printing on %4.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
param5 | — |
Event ID 315 — The print spooler failed to share printer %2 with shared resource name %3.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 316 — Printer driver %1 for %2 %3 was added or updated.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 316
version: 0
level: 4
task: 8
opcode: 11
keywords: 4611686018427390208
time_created: '2021-10-27T10:14:27.309949Z'
event_record_id: 153
correlation: {}
execution:
process_id: 2552
thread_id: 4028
channel: Microsoft-Windows-PrintService/Operational
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-18
user_data:
DriverAdded:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: Generic / Text Only
Param2: Windows x64
Param3: Version-3
Param4: UNIDRV.DLL, UNIDRVUI.DLL, TTY.GPD, UNIDRV.HLP, TTYRES.DLL, TTY.INI, TTY.DLL,
TTYUI.DLL, TTYUI.HLP, UNIRES.DLL, STDNAMES.GPD, STDDTYPE.GDL, STDSCHEM.GDL,
STDSCHMX.GDL
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 317 — Printer driver %1 was deleted.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 317
version: 0
level: 4
task: 9
opcode: 11
keywords: 4611686018427390208
time_created: '2021-10-27T10:28:26.494838Z'
event_record_id: 10
correlation: {}
execution:
process_id: 1048
thread_id: 3768
channel: Microsoft-Windows-PrintService/Operational
computer: FS03.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
DriverDeleted:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: Generic / Text Only
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 318 — Failed to upgrade printer settings for printer %1 driver %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 319 — Printer %1 failed to initialize because a suitable %2 driver could not be found.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 320 — Printer %1 failed to initialize because none of its ports (%2) could be found.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 321 — File(s) %1 associated with printer %2 were added or updated.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 322 — While attempting to publish the printer to the Active Directory directory service, Windows failed to publish property %1 at %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 323 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not create or update the print queue bec...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 325 — While attempting to remove the printer from the Active Directory directory service, Windows failed to delete print queue %1 at %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 326 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not create or update the print queue und...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 327 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not create print queue %1 under containe...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 328 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue con...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 329 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue con...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 331 — While attempting to publish the printer to the Active Directory directory service, the print spooler could not find the appropriate print queue con...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 332 — The printer was successfully published to the Active Directory directory service.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 333 — While attempting to publish the printer to the Active Directory directory service, the print spooler failed to create or update print queue %1 in c...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 334 — The printer was successfully removed from the Active Directory directory service.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 335 — While attempting to remove the printer from the Active Directory directory service, the print spooler failed to delete print queue %1 from containe...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 336 — Print queue %1 was successfully updated in the Active Directory directory service container %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 337 — The print queue could not be found on domain %1.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 338 — Printer %1 was successfully removed from the Active Directory directory service.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 342 — The print spooler removed print queue %1 from the Active Directory directory service because it does not have a Universal Naming Convention (UNC) n...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 343 — The print spooler was unable to connect to print queue %1 based on the information published in the Active Directory.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 344 — The print spooler removed print queue %1 from the Active Directory directory service.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 345 — The print spooler removed print queue %1 from the Active Directory directory service because it is a duplicate of another print queue.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 346 — The print spooler removed print queue %1 from the Active Directory directory service.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 347 — Print queue %1 could not be deleted (pruned) from the Active Directory directory service.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 348 — This version of %1 is incompatible with this version of Windows.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 349 — The print spooler failed to create a symbolic link between HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Print\\Printers and HKEY_LOCAL_M...
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 350 — Document %1 failed to print and was deleted because of corruption in the spooled file.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 351 — The attempt for %1 to use a Windows NT 4.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 352 — The priority of document %1, %2 owned by %3 was changed to %4 on %5.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
param5 | — |
Event ID 353 — The document failed to print because the user did not have the necessary privileges.
Message
Event ID 354 — %1 initialization failed at %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Error | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 354
version: 0
level: 2
task: 36
opcode: 12
keywords: 9223372036854777856
time_created: '2021-10-27T10:28:26.260460Z'
event_record_id: 10
correlation: {}
execution:
process_id: 1048
thread_id: 3836
channel: Microsoft-Windows-PrintService/Admin
computer: FS03.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
InitFailed:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
Param1: \\fs03vuln\Kiwi Legit Printer
Param2: \\fs03vuln\print$\W32X86\3\mimispool.dll
Param3: "2. The system cannot find the file specified.\r\n"
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 356 — Failed to install or update driver %1 on cluster spooler resource %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 359 — The attempt to install printer %1 into an offline operating system image failed with Win32 error code %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 360 — Updating the color profile failed for printer %1 with Win32 error code %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 361 — Printer %1 failed to initialize its ports.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 362 — The print spooler could not initialize because resolving the local machine name to IP addresses failed with error code %1.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 363 — The print spooler %1 failed to start.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 364 — Windows could not load print processor %1 because EnumDatatypes did not return any data.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 365 — Windows could not load print processor %1 because EnumDatatypes failed.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 366 — The print server security descriptor for %1 is invalid.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
Event ID 367 — Windows could not initialize printer %1 because the print processor %2 could not be found.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 368 — The print spooler failed to verify printer driver package %1 for environment %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 369 — The print spooler failed to verify printer driver package for environment %1.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
Event ID 370 — The print spooler failed to regenerate the printer driver information for driver %1 for environment %2.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 371 — The print spooler failed to unshare printer %2 which is shared as %3.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
Event ID 372 — The document %1, owned by %2, failed to print on printer %3.
Message
Fields
| Name | Description |
|---|---|
param1 | — |
param2 | — |
param3 | — |
param4 | — |
param5 | — |
param6 | — |
param7 | — |
param8 | — |
param9 | — |
param10 | — |
param11 | — |
Event ID 373 — The spooler has detected that a component has an unusually large number of open Graphical Device Interface (GDI) objects.
Message
Event ID 502 — The print spooler failed to get the computer name.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 503 — The system failed to initialize the local print provider: Error %2.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 504 — Failed to initialize the router work crew: Error %2.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 505 — Failed to create Phase2Init event in WaitForSpoolerInitialization: Error %2.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 507 — The system failed to initialize the name cache: Error %2.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 508 — Failed to initialize the router cache: Error %2.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 509 — The print spooler cannot start because the PrinterBusEnumerator could not start.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 510 — InitializeProvider cannot allocate memory for %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 511 — The print spooler failed to load print provider %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 512 — InitializePrintProvider failed for provider %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 513 — Group Policy was unable to add per computer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 514 — Group Policy was unable to delete per computer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 515 — Group Policy was unable to delete per computer printer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 516 — Group Policy was unable to deploy per computer printer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 517 — Group Policy was unable to update per computer printer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 518 — Group Policy was unable to delete the per user printer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 519 — Group Policy was unable to deploy per user printer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 520 — Group Policy was unable to update per user printer connection %1.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Error | — |
Event ID 600 — The print spooler failed to import the printer driver that was downloaded from %1 into the driver store for driver %2.
Message
Fields
| Name | Description |
|---|---|
DriverSource | — |
Driver | — |
Error | — |
Event ID 601 — The print spooler failed to download and import the printer driver from %1 into the driver store for driver %2.
Message
Fields
| Name | Description |
|---|---|
DriverSource | — |
Driver | — |
Error | — |
Event ID 602 — The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key %1\%2.
Message
Fields
| Name | Description |
|---|---|
RegistryKey1 | — |
RegistryKey2 | — |
Event ID 603 — The print spooler failed to reopen an existing printer connection because it could not read the configuration information from the registry key %1.
Message
Fields
| Name | Description |
|---|---|
RegistryKey | — |
Event ID 604 — The print spooler encountered an unknown driver type while saving %1 cache information.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Event ID 701 — The print filter pipeline host cannot initialize with the Component Object Model (COM) system.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 702 — The print filter pipeline host is shutting down due to the following error: Error %1.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 703 — The print filter pipeline host is shutting down due to an error in signaling the Component Object Model (COM) proxy in the spooler.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 704 — The print filter pipeline host is shutting down because the query interface for ISignal in the Component Object Model (COM) proxy in the spooler fa...
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 800 — Spooling job %1.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
Event ID 801 — Printing job %1.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
Event ID 802 — Deleting job %1.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
JobSize | — |
DataType | — |
Pages | — |
PagesPerSide | — |
FilesOpened | — |
JobSizeHigh | — |
Event ID 805 — Rendering job %1.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
GdiJobSize | — |
ICMMethod | — |
Color | — |
XRes | — |
YRes | — |
Quality | — |
Copies | — |
TTOption | — |
References
Event ID 806 — Pausing job %1.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
Event ID 807 — Resuming job %1.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
Event ID 808 — The print spooler failed to load a plug-in module %1, error code %2.
Message
Fields
| Name | Description |
|---|---|
PluginDllName | — |
ErrorCode | — |
Context | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 808
version: 0
level: 2
task: 36
opcode: 12
keywords: 9223372036854906880
time_created: '2021-10-27T10:28:26.322960Z'
event_record_id: 12
correlation:
'#attributes':
ActivityID: 8811EC75-6F9C-4103-BB8A-EEED31FA139D
execution:
process_id: 1656
thread_id: 1572
channel: Microsoft-Windows-PrintService/Admin
computer: FS03.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
LoadPluginFailed:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
PluginDllName: C:\Windows\system32\spool\DRIVERS\x64\3mimispool.dll
ErrorCode: '0x7e'
Context: 110
References
- Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/event-ids-associated-point-print-restrictions
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 809 — The print spooler failed to recursively delete the directory %1, error code %2.
Message
Fields
| Name | Description |
|---|---|
DirectoryName | — |
WaitForReboot | — |
ErrorCode | — |
Context | — |
Event ID 810 — The print spooler failed to delete the directory %1 and the contained files, error code %2.
Message
Fields
| Name | Description |
|---|---|
DirectoryName | — |
WaitForReboot | — |
ErrorCode | — |
Context | — |
Event ID 811 — The print spooler failed to move the file %1 to %2, error code %4.
Message
Fields
| Name | Description |
|---|---|
Source | — |
Destination | — |
Flags | — |
ErrorCode | — |
Context | — |
Event ID 812 — The print spooler failed to delete the file %1, error code %4.
Message
Fields
| Name | Description |
|---|---|
Source | — |
Destination | — |
Flags | — |
ErrorCode | — |
Context | — |
References
Event ID 813 — The print spooler failed to copy the file %1 to %2, error code %4.
Message
Fields
| Name | Description |
|---|---|
Source | — |
Destination | — |
Flags | — |
ErrorCode | — |
Context | — |
Event ID 814 — The print spooler failed to install the print processor %1 %2 %3, error code %4.
Message
Fields
| Name | Description |
|---|---|
Processor | — |
Environment | — |
Path | — |
ErrorCode | — |
Event ID 815 — The print spooler service failed to register the RPC server protocol sequence %1, error code %3.
Message
Fields
| Name | Description |
|---|---|
ProtocolSequence | — |
EndPoint | — |
ErrorCode | — |
Context | — |
Event ID 816 — The print spooler service detected an invalid RPC protocol sequence %1, expecting %2, error code %3.
Message
Fields
| Name | Description |
|---|---|
ValidatedProtocolSequence | — |
ExpectedProtocolSequence | — |
ErrorCode | — |
Event ID 817 — The RPC end-point policy for the print spooler service is disabled.
Message
Fields
| Name | Description |
|---|---|
WindowsStarterEdition | — |
SuiteStorageServer | — |
SystemPrintingDisabled | — |
SuiteBlade | — |
SuiteEmbeddedRestricted | — |
SuiteComputerServer | — |
Event ID 818 — The print spooler RPC server failed to start, error code %1.
Message
Fields
| Name | Description |
|---|---|
ErrorCode | — |
Context | — |
Event ID 819 — Client Side Rendering is currently disabled by policy.
Message
Fields
| Name | Description |
|---|---|
Policy | — |
Event ID 820 — Client side rendering to %1 failed, error code %4.
Message
Fields
| Name | Description |
|---|---|
PrintProcessor | — |
Connection | — |
IsXpsPrinter | — |
ErrorCode | — |
Event ID 821 — The print spooler Client Side Rendering is attempting to render the job %1 on the server (Server Side Rendering), status %3.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
Level | — |
Status | — |
Event ID 822 — Unknown print processor (%1) or invalid data type (%4), error %7, Client Side Rendering is disabled.
Message
Fields
| Name | Description |
|---|---|
LocalPrintProcessor | — |
RemotePrintProcessor | — |
DefaultPrintProcessor | — |
LocalDataType | — |
RemoteDataType | — |
DefaultDataType | — |
ErrorCode | — |
Event ID 823 — The default printer was changed to %3.
Message
Fields
| Name | Description |
|---|---|
DefaultPrinterSelectedBySpooler | — |
OldDefaultPrinter | — |
NewDefaultPrinter | — |
Status | — |
Module | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 823
version: 0
level: 4
task: 49
opcode: 11
keywords: 9223372036854906880
time_created: '2021-10-27T10:09:16.280929Z'
event_record_id: 4
correlation: {}
execution:
process_id: 2552
thread_id: 4012
channel: Microsoft-Windows-PrintService/Admin
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-21-4230534742-2542757381-3142984815-1111
user_data:
ChangingDefaultPrinter:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
DefaultPrinterSelectedBySpooler: 1
OldDefaultPrinter: '-'
NewDefaultPrinter: Kiwi Legit Printer
Status: '0x0'
Module: spoolsv.exe
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 824 — A fatal error occurred while printing job %1, id %2 on the print queue %3.
Message
Fields
| Name | Description |
|---|---|
DocumentName | — |
JobId | — |
PrintQueue | — |
ErrorInfo | — |
Event ID 825 — Client side rendering to %1 failed, error code %4.
Message
Fields
| Name | Description |
|---|---|
PrintProcessor | — |
Connection | — |
IsXpsPrinter | — |
ErrorCode | — |
Event ID 826 — Force Client Side Rendering policy was successfully set on printer %1, path %2, port %3.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
PrinterPath | — |
PortName | — |
Event ID 827 — The specified print queue %1 is invalid.
Message
Fields
| Name | Description |
|---|---|
QueueName | — |
Event ID 828 — The print job %1 failed with error code %2.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
ErrorCode | — |
Event ID 829 — XPS API call %1 (%2) started.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Context | — |
StatusCode | — |
Event ID 830 — XPS API call %1 (%2) ended, status %3.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Context | — |
StatusCode | — |
Event ID 831 — XPS API dependency %1 (%2) started.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Context | — |
StatusCode | — |
Event ID 832 — XPS API dependency %1 (%2) ended, status %3.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Context | — |
StatusCode | — |
Event ID 833 — Print spooler operation %1 (%2) started.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Context | — |
StatusCode | — |
Event ID 834 — Print spooler operation %1 (%2) ended, status %3.
Message
Fields
| Name | Description |
|---|---|
Name | — |
Context | — |
StatusCode | — |
Event ID 842 — The print job %1 was sent through the print processor %2 on printer %3, driver %4, in the isolation mode %5.
Message
Fields
| Name | Description |
|---|---|
JobId | — |
Processor | — |
Printer | — |
Driver | — |
IsolationMode | — |
Error | — |
References
Event ID 843 — The print spooler service recorded %1 successful and %2 failed RPC requests for all active print driver sandbox hosts.
Message
Fields
| Name | Description |
|---|---|
SucceededRpcCalls | — |
FailedRpcCalls | — |
Event ID 844 — The print spooler selected the isolation mode %1 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox) for prin...
Message
Fields
| Name | Description |
|---|---|
IsolationMode | — |
Printer | — |
Driver | — |
Event ID 845 — Attempted to load module %1 for printer %2, printer driver %3.
Message
Fields
| Name | Description |
|---|---|
Module | — |
Printer | — |
Driver | — |
Error | — |
Event ID 846 — Cached printer %1 has been scavenged and deleted.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
PrinterAge | — |
ExpiryAge | — |
Event ID 847 — Cached printer %1 has been scheduled for deletion due to a logon scavenging operation.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
Event ID 848 — Printer %1 was shared by the print spooler as %2.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
ShareName | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 848
version: 0
level: 4
task: 30
opcode: 11
keywords: 4611686018427387936
time_created: '2021-10-27T10:14:27.466200Z'
event_record_id: 154
correlation: {}
execution:
process_id: 2552
thread_id: 4028
channel: Microsoft-Windows-PrintService/Operational
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-18
user_data:
PrinterSharing:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
PrinterName: Kiwi Legit Printer
ShareName: Kiwi Legit Printer
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 849 — Printer %1 shared as %2 was unshared by the print spooler.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
ShareName | — |
Example Event
system:
provider: Microsoft-Windows-PrintService
guid: 747EF6FD-E535-4D16-B510-42C90F6873A1
event_source_name: ''
event_id: 849
version: 0
level: 4
task: 31
opcode: 11
keywords: 4611686018427387936
time_created: '2021-10-27T10:14:21.369976Z'
event_record_id: 151
correlation:
'#attributes':
ActivityID: C43202E9-CB0F-0000-D030-32C40FCBD701
execution:
process_id: 2552
thread_id: 4028
channel: Microsoft-Windows-PrintService/Operational
computer: fs03vuln.offsec.lan
security:
user_id: S-1-5-18
user_data:
PrinterSharing:
'#attributes':
xmlns: http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events
PrinterName: Kiwi Legit Printer
ShareName: Kiwi Legit Printer
References
- Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx
Event ID 850 — The print spooler called the function %2 in print driver module %1.
Message
Fields
| Name | Description |
|---|---|
Driver | — |
Function | — |
Event ID 851 — Point and Print not allowed by policy for queue %1.
Message
Fields
| Name | Description |
|---|---|
PrintQueue | — |
Error | — |
Event ID 852 — Driver %1 could not be installed for printer connection %3.
Message
Fields
| Name | Description |
|---|---|
OriginalDriver | — |
NewDriver | — |
PrinterName | — |
Event ID 853 — Print Client Side Rendering synchronization for print job cache completed with code %1 for printer %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PrinterName | — |
Event ID 854 — Print Client Side Rendering synchronization for printer information cache completed with code %1 for printer %2.
Message
Fields
| Name | Description |
|---|---|
Error | — |
PrinterName | — |
Event ID 855 — OpenPrinter cache entry added for printer %1 with access code %2.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
AccessCode | — |
Event ID 856 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 857 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 858 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 859 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 860 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 861 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 862 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Event ID 863 — Connection '.
Message
Fields
| Name | Description |
|---|---|
ConnectionName | — |
Error | — |
Event ID 864 — The Windows Fax and Scan servicing operation failed, HRESULT %1.
Message
Fields
| Name | Description |
|---|---|
HResult | — |
Event ID 865 — There were %1 print job failures out of %2 jobs sent to printer '%3' using driver '%4'.
Message
Fields
| Name | Description |
|---|---|
Failures | — |
Jobs | — |
PrinterName | — |
DriverName | — |
Event ID 866 — The print spooler failed to create a Plug and Play printer device object for the printer '.
Message
Fields
| Name | Description |
|---|---|
PrinterName | — |
DeviceObjectInstanceIdentifier | — |
HResultErrorCode | — |
Event ID 867 — The WS-Print Port Monitor failed to initialize correctly.
Message
Fields
| Name | Description |
|---|---|
HResultErrorCode | — |
Event ID 868 — The Offline EventLog on machine '.
Message
Fields
| Name | Description |
|---|---|
MachineName | — |
Event ID 869 — In VALIDATINGDRVINFO, Adding printer driver %3 failed, error code %2.
Message
Fields
| Name | Description |
|---|---|
Label | — |
ErrorCode | — |
ObjectName | — |
Event ID 870 — The print spooler failed to download package for driver %1.
Message
Fields
| Name | Description |
|---|---|
Driver | — |
Error | — |
Event ID 871 — The current print job was rejected due to Device Control Print Restrictions.
Message
Fields
| Name | Description |
|---|---|
RestrictionReason | — |
PrinterName | — |
JobOrDocumentName | — |
UserName | — |
PortName | — |