Microsoft-Windows-PrintService

Description

The print spooler encountered a fatal error while executing a critical operation (OperationCode, error Error) and must immediately terminate. Try to manually restart the print spooler service (from Control Panel | Administrative Tools | Services or from an elevated command prompt running: net start spooler).

Message #

The print spooler encountered a fatal error while executing a critical operation (%1, error %2) and must immediately terminate. Try to manually restart the print spooler service (from Control Panel | Administrative Tools | Services or from an elevated command prompt running: net start spooler).

Fields #

Description

Printer PrinterName successfully added. See the event user data for context information.

Message #

Printer %3 successfully added. See the event user data for context information.

Fields #

Description

Failed to add printer PrinterName, error code ErrorCode. See the event user data for context information.

Message #

Failed to add printer %3, error code %2. See the event user data for context information.

Fields #

Description

Deleting printer PrinterName succeeded. See the event user data for context information.

Message #

Deleting printer %3 succeeded. See the event user data for context information.

Fields #

Description

Deleting printer PrinterName failed, error code ErrorCode. See the event user data for context information.

Message #

Deleting printer %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Starting document job JobID for printer PrinterName succeeded. See the event user data for context information.

Message #

Starting document job %3 for printer %4 succeeded. See the event user data for context information.

Fields #

Description

Starting document job JobID for printer PrinterName failed, error code ErrorCode. See the event user data for context information.

Message #

Starting document job %3 for printer %4 failed, error code %2. See the event user data for context information.

Fields #

Description

Ending document job JobID for printer PrinterName succeeded. See the event user data for context information.

Message #

Ending document job %3 for printer %4 succeeded. See the event user data for context information.

Fields #

Description

Ending document job JobID for printer PrinterName failed, error code ErrorCode. See the event user data for context information.

Message #

Ending document job %3 for printer %4 failed, error code %2. See the event user data for context information.

Fields #

Description

Adding printer driver ObjectName succeeded. See the event user data for context information.

Message #

Adding printer driver %3 succeeded. See the event user data for context information.

Fields #

Description

Adding printer driver ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Adding printer driver %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Opening printer ObjectName succeeded. See the event user data for context information.

Message #

Opening printer %3 succeeded. See the event user data for context information.

Fields #

Description

Opening printer ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Opening printer %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Starting page job JobID at printer PrinterName succeeded. See the event user data for context information.

Message #

Starting page job %3 at printer %4 succeeded. See the event user data for context information.

Fields #

Description

Starting page failed at printer JobID, error code ErrorCode. See the event user data for context information.

Message #

Starting page failed at printer %3, error code %2. See the event user data for context information.

Fields #

Description

Ending page job JobID at printer PrinterName succeeded. See the event user data for context information.

Message #

Ending page job %3 at printer %4 succeeded. See the event user data for context information.

Fields #

Description

Ending page job JobID at printer PrinterName failed, error code ErrorCode. See the event user data for context information.

Message #

Ending page job %3 at printer %4 failed, error code %2. See the event user data for context information.

Fields #

Description

Setting printer PrinterName failed, error code ErrorCode. See the event user data for context information.

Message #

Setting printer %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Adding CSR printer connection ObjectName succeeded. See the event user data for context information.

Message #

Adding CSR printer connection %3 succeeded. See the event user data for context information.

Fields #

Description

Adding CSR printer connection ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Adding CSR printer connection %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Deleting CSR printer connection ObjectName succeeded. See the event user data for context information.

Message #

Deleting CSR printer connection %3 succeeded. See the event user data for context information.

Fields #

Description

Deleting CSR printer connection ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Deleting CSR printer connection %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Opening CSR printer ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Opening CSR printer %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Closing CSR printer ObjectName succeeded. See the event user data for context information.

Message #

Closing CSR printer %3 succeeded. See the event user data for context information.

Fields #

Description

Closing CSR printer ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Closing CSR printer %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Parsing inf (InfPath) for printer driver DriverName succeeded (processor architecture ProcessorArchitecture). See the event user data for context information.

Message #

Parsing inf (%4) for printer driver %5 succeeded (processor architecture %7). See the event user data for context information.

Fields #

Description

Parsing inf (InfPath) for printer driver DriverName failed (processor architecture ProcessorArchitecture), error code LastError, HRESULT HResult. See the event user data for context information.

Message #

Parsing inf (%4) for printer driver %5 failed (processor architecture %7), error code %8, HRESULT %9. See the event user data for context information.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 213,
    "version": 0,
    "level": 2,
    "task": 18,
    "opcode": 12,
    "keywords": 4611686018427388448,
    "time_created": "2026-05-30T01:50:56.6850617+00:00",
    "event_record_id": 73,
    "correlation": {
      "ActivityID": "{6C4AD011-B2EA-447E-ABE8-CBD1BBC806BE}"
    },
    "execution": {
      "process_id": 3872,
      "thread_id": 10128
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "SetupParseInf": {
      "Label": "ParseInfAndCommitFileQueue",
      "Message": "PreSelectDriverEx failed",
      "AdditionalInfo": "-",
      "InfPath": "-",
      "DriverName": "Microsoft XPS Document Writer",
      "InstallSection": "-",
      "ProcessorArchitecture": "Windows x64",
      "LastError": "0x705",
      "HResult": "0x80070705"
    }
  },
  "message": "Parsing inf (-) for printer driver Microsoft XPS Document Writer failed (processor architecture Windows x64), error code 0x705, HRESULT 0x80070705. See the event user data for context information."
}

Description

Installing printer driver DriverName succeeded. See the event user data for context information.

Message #

Installing printer driver %5 succeeded. See the event user data for context information.

Fields #

Description

Installing printer driver DriverName failed, error code LastError, HRESULT HResult. See the event user data for context information.

Message #

Installing printer driver %5 failed, error code %10, HRESULT %11. See the event user data for context information.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 215,
    "version": 0,
    "level": 2,
    "task": 19,
    "opcode": 12,
    "keywords": -9223372036854775264,
    "time_created": "2026-05-30T01:50:56.6852684+00:00",
    "event_record_id": 50,
    "correlation": {
      "ActivityID": "{6C4AD011-B2EA-447E-ABE8-CBD1BBC806BE}"
    },
    "execution": {
      "process_id": 3872,
      "thread_id": 10128
    },
    "channel": "Microsoft-Windows-PrintService/Admin",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "SetupInstallPrinterDriver": {
      "Label": "InternalInstallPrinterDriverFromPackage",
      "Message": "pfnPSetupParseInfAndCommitFileQueue failed",
      "AdditionalInfo": "-",
      "InfPath": "-",
      "DriverName": "Microsoft XPS Document Writer",
      "InstallSection": "-",
      "ProcessorArchitecture": "Windows x64",
      "PackageAware": "Not package aware",
      "CoreDriverDependencies": "-",
      "LastError": "0x0",
      "HResult": "0x80070705"
    }
  },
  "message": "Installing printer driver Microsoft XPS Document Writer failed, error code 0x0, HRESULT 0x80070705. See the event user data for context information."
}

Description

A printer setup operation succeeded during the installation process. See the event user data for context information.

Message #

A printer setup operation succeeded during the installation process. See the event user data for context information.

Fields #

Description

A printer setup operation failed during the installation process, error code LastError, HRESULT HResult. See the event user data for context information.

Message #

A printer setup operation failed during the installation process, error code %5, HRESULT %6. See the event user data for context information.

Fields #

Description

Copying printer driver package InfPath succeeded. See the event user data for context information.

Message #

Copying printer driver package %5 succeeded. See the event user data for context information.

Fields #

Description

Copying printer driver package InfPath failed, error code LastError, HRESULT HResult. See the event user data for context information.

Message #

Copying printer driver package %5 failed, error code %8, HRESULT %9. See the event user data for context information.

Fields #

Description

Retrieving CSR cache information for printer ObjectName succeeded. See the event user data for context information.

Message #

Retrieving CSR cache information for printer %3 succeeded. See the event user data for context information.

Fields #

Description

Retrieving CSR cache information for printer ObjectName failed, error code ErrorCode. See the event user data for context information.

Message #

Retrieving CSR cache information for printer %3 failed, error code %2. See the event user data for context information.

Fields #

Description

Message

Message #

%1

Fields #

Description

Message

Message #

%1

Fields #

Description

A remote print driver package operation failed with error code , server name . This was most likely caused by an unexpected error in the protocol communication between the client and the print server.

Message #

A remote print driver package operation %1 failed with error code %2, server name %3. This was most likely caused by an unexpected error in the protocol communication between the client and the print server.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. Error code: HResult. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Message #

An error occurred while installing printer driver '%1'. Error code: %4. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The driver being installed is incompatible with this version of Windows. Please obtain and install a compatible version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device. See the event user data for context information.

Message #

An error occurred while installing printer driver '%1'. The driver being installed is incompatible with this version of Windows. Please obtain and install a compatible version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device. See the event user data for context information.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. Error code: HResult. The driver being installed relies on class driver 'RequiredClassDriver', which is not present on this computer. The class driver may be available on Windows Update. Please ensure that Windows Update is enabled in Device Installation Settings and that a connection can be established, and try again, or choose an alternate driver that works with this print device.

Message #

An error occurred while installing printer driver '%1'. Error code: %4. The driver being installed relies on class driver '%3', which is not present on this computer. The class driver may be available on Windows Update. Please ensure that Windows Update is enabled in Device Installation Settings and that a connection can be established, and try again, or choose an alternate driver that works with this print device.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The driver being installed relies on class driver 'RequiredClassDriver', which failed to install. Error code: HResult. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Message #

An error occurred while installing printer driver '%1'. The driver being installed relies on class driver '%3', which failed to install. Error code: %4. Please obtain and install a new version of the driver from the manufacturer (if available), or choose an alternate driver that works with this print device.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The driver must contain a pipelineconfig.xml file.

Message #

An error occurred while installing printer driver '%1'. The driver must contain a pipelineconfig.xml file.

Fields #

Description

A problem was encountered while installing printer driver 'DriverName'. A printer extension bundled with the driver failed to register, and will be unavailable. Error code: HResult. The driver will still be functional. Please obtain and install a new version of the printer extension or printer driver from the manufacturer (if available).

Message #

A problem was encountered while installing printer driver '%1'. A printer extension bundled with the driver failed to register, and will be unavailable. Error code: %4. The driver will still be functional. Please obtain and install a new version of the printer extension or printer driver from the manufacturer (if available).

Fields #

Description

An attempt was made to upgrade installed class driver 'DriverName' to a non-class driver. Doing so will prevent any driver that relies on the class driver to stop functioning. The class driver will remain installed.

Message #

An attempt was made to upgrade installed class driver '%1' to a non-class driver. Doing so will prevent any driver that relies on the class driver to stop functioning. The class driver will remain installed.

Fields #

Description

An attempt was made to upgrade installed printer driver 'DriverName' to an older version of the driver, which is unsupported. If the older version of the driver is required, please delete the current version (via Print Management or Print Server Properties) and try again.

Message #

An attempt was made to upgrade installed printer driver '%1' to an older version of the driver, which is unsupported. If the older version of the driver is required, please delete the current version (via Print Management or Print Server Properties) and try again.

Fields #

Description

An attempt was made to upgrade installed printer driver 'DriverName' to a version that does not support printer sharing, or may cause compatibility problems when sharing to some computers. In order to use the new driver, please disable sharing for all print queues that are using this driver (via Print Management or the Sharing tab in Printer Properties) and try again.

Message #

An attempt was made to upgrade installed printer driver '%1' to a version that does not support printer sharing, or may cause compatibility problems when sharing to some computers. In order to use the new driver, please disable sharing for all print queues that are using this driver (via Print Management or the Sharing tab in Printer Properties) and try again.

Fields #

Description

A problem was encountered while deleting printer driver 'DriverName'. A printer extension bundled with the driver failed to unregister. Error code: HResult. The driver will still be deleted.

Message #

A problem was encountered while deleting printer driver '%1'. A printer extension bundled with the driver failed to unregister. Error code: %4. The driver will still be deleted.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The file 'Value' referenced by the Directive directive could not be found.

Message #

An error occurred while installing printer driver '%1'. The file '%5' referenced by the %4 directive could not be found.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The Directive directive is not allowed for this type of driver. See the event user data for context information.

Message #

An error occurred while installing printer driver '%1'. The %4 directive is not allowed for this type of driver. See the event user data for context information.

Fields #

Description

An error occurred while installing printer driver ''. The directive is malformed, by having either an empty token or an incorrect number of tokens. See the event user data for context information.

Message #

An error occurred while installing printer driver '%1'. The %4 directive is malformed, by having either an empty token or an incorrect number of tokens. See the event user data for context information.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The Directive must be a GUID, but 'Value' was provided.

Message #

An error occurred while installing printer driver '%1'. The %4 must be a GUID, but '%5' was provided.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. The Directive directive must be present in the manifest.

Message #

An error occurred while installing printer driver '%1'. The %4 directive must be present in the manifest.

Fields #

Description

An error occurred while installing printer driver 'DriverName'. There must be only one manifest per driver. Either no manifest was found, or too many manifests were found. See the event user data for context information.

Message #

An error occurred while installing printer driver '%1'. There must be only one manifest per driver. Either no manifest was found, or too many manifests were found. See the event user data for context information.

Fields #

Description

An attempt was made to upgrade installed printer driver 'DriverName' to a driver that does not support non-inbox port monitors. In order to use the new driver, please remove or reconfigure all print queues that are using this driver and try again.

Message #

An attempt was made to upgrade installed printer driver '%1' to a driver that does not support non-inbox port monitors. In order to use the new driver, please remove or reconfigure all print queues that are using this driver and try again.

Fields #

Description

An error occurred while configuring print queue 'PrinterName'. Printer driver 'DriverName' may not be used in conjunction with a non-inbox port monitor.

Message #

An error occurred while configuring print queue '%1'. Printer driver '%2' may not be used in conjunction with a non-inbox port monitor.

Fields #

Description

Printer param1 was created. No user action is required.

Message #

Printer %1 was created. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 11,
    "keywords": 4611686018427389984,
    "time_created": "2026-06-13T15:13:09.6513266+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 8552,
      "thread_id": 4996
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "PrinterCreated": {
      "Param1": "evtgen-printer"
    }
  },
  "message": "Printer evtgen-printer was created. No user action is required."
}

Description

Printer param1 was deleted, and users will no longer be able to print to this printer. No user action is required.

Message #

Printer %1 was deleted, and users will no longer be able to print to this printer. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 301,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 11,
    "keywords": 4611686018427389984,
    "time_created": "2026-06-13T15:13:18.2273480+00:00",
    "event_record_id": 4,
    "correlation": {},
    "execution": {
      "process_id": 9060,
      "thread_id": 7024
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "PrinterDeleted": {
      "Param1": "evtgen-printer"
    }
  },
  "message": "Printer evtgen-printer was deleted, and users will no longer be able to print to this printer. No user action is required."
}

Description

Printer param1 will be deleted. No user action is required.

Message #

Printer %1 will be deleted. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 302,
    "version": 0,
    "level": 4,
    "task": 5,
    "opcode": 10,
    "keywords": 4611686018427389984,
    "time_created": "2026-06-13T15:13:18.1778725+00:00",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 9060,
      "thread_id": 6148
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "PrinterDeletionPending": {
      "Param1": "evtgen-printer"
    }
  },
  "message": "Printer evtgen-printer will be deleted. No user action is required."
}

Description

Printer param1 was paused. No user action is required.

Message #

Printer %1 was paused. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 303,
    "version": 0,
    "level": 4,
    "task": 23,
    "opcode": 11,
    "keywords": 4611686018427389984,
    "time_created": "2026-05-30T01:51:11.2092102+00:00",
    "event_record_id": 98,
    "correlation": {
      "ActivityID": "{5EF3D886-AF92-402B-AAF8-5AC4C18D93B9}"
    },
    "execution": {
      "process_id": 3872,
      "thread_id": 10128
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "PrinterPaused": {
      "Param1": "PrintLab-PDF"
    }
  },
  "message": "Printer PrintLab-PDF was paused. No user action is required."
}

Description

Printer param1 was resumed. No user action is required.

Message #

Printer %1 was resumed. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "747EF6FD-E535-4D16-B510-42C90F6873A1",
    "event_source_name": "",
    "event_id": 304,
    "version": 0,
    "level": 4,
    "task": 24,
    "opcode": 11,
    "keywords": 4611686018427389984,
    "time_created": "2021-10-27T10:28:26.229212Z",
    "event_record_id": 3,
    "correlation": {},
    "execution": {
      "process_id": 1048,
      "thread_id": 3836
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "FS03.offsec.lan",
    "security": {
      "user_id": "S-1-5-21-4230534742-2542757381-3142984815-1111"
    }
  },
  "user_data": {
    "PrinterUnPaused": {
      "#attributes": {
        "xmlns": "http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events"
      },
      "Param1": "{BABBC1A0-F75A-44B0-92BC-57E20CEDA1D8}"
    }
  }
}

References #

• Example event sourced from https://github.com/Yamato-Security/hayabusa-sample-evtx

Description

The jobs in the print queue for printer param1 were deleted. No user action is required.

Message #

The jobs in the print queue for printer %1 were deleted. No user action is required.

Fields #

Description

Settings for printer param1 were changed. No user action is required.

Message #

Settings for printer %1 were changed. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 306,
    "version": 0,
    "level": 4,
    "task": 17,
    "opcode": 11,
    "keywords": 4611686018427389984,
    "time_created": "2026-06-13T15:13:10.0553491+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 8552,
      "thread_id": 1836
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "telemetry-DC-d.cell-d.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "PrinterSet": {
      "Param1": "evtgen-printer"
    }
  },
  "message": "Settings for printer evtgen-printer were changed. No user action is required."
}

Description

Document param1, param2 owned by param3 on param4 was printed on param5 through port param6. Size in bytes: SizeInBytes. Pages printed: PagesPrinted. No user action is required.

Message #

Document %1, %2 owned by %3 on %4 was printed on %5 through port %6.  Size in bytes: %7. Pages printed: %8. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 307,
    "version": 0,
    "level": 4,
    "task": 26,
    "opcode": 11,
    "keywords": 4611686018427390016,
    "time_created": "2026-05-30T01:51:30.3741444+00:00",
    "event_record_id": 114,
    "correlation": {},
    "execution": {
      "process_id": 12596,
      "thread_id": 4296
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "DocumentPrinted": {
      "Param1": "2",
      "Param2": "document",
      "Param3": "domainadmin",
      "Param4": "\\\\JD-DC01-2022",
      "Param5": "PrintLab-PDF",
      "Param6": "C:\\PrintLab\\pdflab_output.pdf",
      "Param7": "53851",
      "Param8": "1"
    }
  },
  "message": "Document 2, document owned by domainadmin on \\\\JD-DC01-2022 was printed on PrintLab-PDF through port C:\\PrintLab\\pdflab_output.pdf.  Size in bytes: 53851. Pages printed: 1. No user action is required."
}

Related Events #

References #

• Microsoft Learn https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/event-ids-associated-point-print-restrictions

Description

Document param1, param2 owned by param3 was paused on param4. This document will not print until the document owner resumes the print job. No user action is required.

Message #

Document %1, %2 owned by %3 was paused on %4. This document will not print until the document owner resumes the print job. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 308,
    "version": 0,
    "level": 4,
    "task": 26,
    "opcode": 11,
    "keywords": 4611686018427390016,
    "time_created": "2026-05-30T01:51:14.6869907+00:00",
    "event_record_id": 102,
    "correlation": {
      "ActivityID": "{A1E5D082-A57A-42F4-A80D-125F5E1EFB3F}"
    },
    "execution": {
      "process_id": 3872,
      "thread_id": 7704
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "DocumentPaused": {
      "Param1": "7",
      "Param2": "document",
      "Param3": "domainadmin",
      "Param4": "PrintLab-PDF"
    }
  },
  "message": "Document 7, document owned by domainadmin was paused on PrintLab-PDF. This document will not print until the document owner resumes the print job. No user action is required."
}

Description

Document param1, param2 owned by param3 was resumed on param4. No user action is required.

Message #

Document %1, %2 owned by %3 was resumed on %4. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "{747EF6FD-E535-4D16-B510-42C90F6873A1}",
    "event_source_name": "",
    "event_id": 309,
    "version": 0,
    "level": 4,
    "task": 26,
    "opcode": 11,
    "keywords": 4611686018427390016,
    "time_created": "2026-05-30T01:51:15.7044064+00:00",
    "event_record_id": 103,
    "correlation": {
      "ActivityID": "{F1F9D0C4-D7F6-44F1-9BA0-F0367025EA0C}"
    },
    "execution": {
      "process_id": 3872,
      "thread_id": 7704
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "JD-DC01-2022.ludus.domain",
    "security": {
      "user_id": "S-1-5-21-1006758700-2167138679-1475694448-1105"
    }
  },
  "user_data": {
    "DocumentResumed": {
      "Param1": "6",
      "Param2": "document",
      "Param3": "domainadmin",
      "Param4": "PrintLab-PDF"
    }
  },
  "message": "Document 6, document owned by domainadmin was resumed on PrintLab-PDF. No user action is required."
}

Description

Document DocumentDeleted.Param1, DocumentDeleted.Param2 owned by DocumentDeleted.Param3 was deleted on DocumentDeleted.Param4. No user action is required.

Message #

Document %1, %2 owned by %3 was deleted on %4. No user action is required.

Fields #

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-PrintService",
    "guid": "747EF6FD-E535-4D16-B510-42C90F6873A1",
    "event_source_name": "",
    "event_id": 310,
    "version": 0,
    "level": 4,
    "task": 27,
    "opcode": 11,
    "keywords": 4611686018427390016,
    "time_created": "2026-03-13T20:25:33.325281+00:00",
    "event_record_id": 10,
    "correlation": {},
    "execution": {
      "process_id": 3692,
      "thread_id": 11700
    },
    "channel": "Microsoft-Windows-PrintService/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "user_data": {
    "DocumentDeleted": {
      "Param1": "2",
      "Param2": "Print Document",
      "Param3": "domainadmin",
      "Param4": "TestPrinter_EventGen"
    }
  },
  "message": ""
}

Description

An administrator moved document param1, param2 owned by param3 to position param4 on param5. This changes when the document will print. No user action is required.

Message #

An administrator moved document %1, %2 owned by %3 to position %4 on %5. This changes when the document will print. No user action is required.

Fields #

Description

Form param1 was added. No user action is required.

Message #

Form %1 was added. No user action is required.

Fields #

Description

Form param1 was removed. No user action is required.

Message #

Form %1 was removed. No user action is required.

Fields #

Description

Document param1, param2 owned by param3 timed out while printing on param4. The spooler waited for param5 milliseconds and no data was received.

Message #

Document %1, %2 owned by %3 timed out while printing on %4. The spooler waited for %5 milliseconds and no data was received.

Fields #

Description

The print spooler failed to share printer param2 with shared resource name param3. Error param1. The printer cannot be used by others on the network.

Message #

The print spooler failed to share printer %2 with shared resource name %3. Error %1. The printer cannot be used by others on the network.

Fields #

Description

Printer driver param1 for param2 param3 was added or updated. Files:- param4. No user action is required.

Message #

Printer driver %1 for %2 %3 was added or updated. Files:- %4. No user action is required.

Fields #