detection.wiki

Microsoft-Windows-PrintService › Event 842

Event ID 842 — The print job PrintDriverSandboxJobPrintProc.JobId was sent through the print processor PrintDriverSandboxJobPrintProc.Processor on printer PrintDriverSandboxJobPrintProc.Printer, driver PrintDrive...

Provider
Microsoft-Windows-PrintService
Channel
Operational
Level
Informational
Task
Isolatingprinterdriversandotherplug_ins
Opcode
SpoolerOperationSucceeded

Message #

The print job %1 was sent through the print processor %2 on printer %3, driver %4, in the isolation mode %5 (0 - loaded in the spooler, 1 - loaded in shared sandbox, 2 - loaded in isolated sandbox). Win32 error code returned by the print processor: %6.

Fields #

NameDescription
PrintDriverSandboxJobPrintProc.JobId UInt32—
PrintDriverSandboxJobPrintProc.Processor UnicodeString—
PrintDriverSandboxJobPrintProc.Printer UnicodeString—
PrintDriverSandboxJobPrintProc.Driver UnicodeString—
PrintDriverSandboxJobPrintProc.IsolationMode UInt32—
PrintDriverSandboxJobPrintProc.ErrorCode—
JobId UInt32—
Processor UnicodeString—
Printer UnicodeString—
Driver UnicodeString—
IsolationMode UInt32—
Error HexInt32—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "747EF6FD-E535-4D16-B510-42C90F6873A1",
    "event_source_name": "",
    "event_id": 842,
    "version": 0,
    "level": 4,
    "task": 50,
    "opcode": 11,
    "keywords": 4611686018427650048,
    "time_created": "2026-03-13T20:25:33.321078+00:00",
    "event_record_id": 7,
    "correlation": {},
    "execution": {
      "process_id": 3692,
      "thread_id": 11700
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "PrintDriverSandboxJobPrintProc": {
      "JobId": 2,
      "Processor": "MS_XPS_PROC",
      "Printer": "TestPrinter_EventGen",
      "Driver": "Microsoft Print To PDF",
      "IsolationMode": 0,
      "ErrorCode": "0x0"
    }
  },
  "message": ""
}

References #