Microsoft-Windows-Spooler-LPRMON

18 events across 1 channel

Event	Title	Channel	Sample
2000	Event ID 2000	Operational	N
2001	Event ID 2001	Operational	N
2002	Event ID 2002	Operational	N
2003	Event ID 2003	Operational	N
2004	Event ID 2004	Operational	N
2005	Event ID 2005	Operational	N
2006	Event ID 2006	Operational	N
2007	Event ID 2007	Operational	N
2008	Event ID 2008	Operational	N
1073743824	LPR Print Monitor started successfully.	Operational	N
2147485649	Printer {param1} on host {param2} is unreachable.	Operational	N
2147485651	An error occurred while de-spooling the file {param1}.	Operational	N
2147485652	The Line Printer Remote (LPR) service could not submit the print job to the Line …	Operational	N
3221227474	An error was reported while attempting to initialize the printer port monitor …	Operational	N
3221227477	The Line Printer Remote (LPR) print monitor failed to open a temporary file …	Operational	N
3221227478	The Line Printer Remote (LPR) service could not delete the LPR port information …	Operational	N
3221227479	The Line Printer Remote (LPR) print monitor failed to open the port named …	Operational	N
3221227480	The Line Printer Remote (LPR) print monitor failed to start because it reported …	Operational	N

Event ID 2000

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Event ID 2001

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2002

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Event ID 2003

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 2004

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString
`param2` UnicodeString

Event ID 2005

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 2006

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 2007

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Fields #

Name	Description
`param1` UnicodeString

Event ID 2008

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Event ID 1073743824: LPR Print Monitor started successfully.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Description

LPR Print Monitor started successfully.

Message #

LPR Print Monitor started successfully.

Event ID 2147485649: Printer {param1} on host {param2} is unreachable.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Description

Printer {param1} on host {param2} is unreachable. The print job has been cancelled.

Message #

Printer {param1} on host {param2} is unreachable.  The print job has been cancelled.

Fields #

Name	Description
`param1`
`param2`

Event ID 2147485651: An error occurred while de-spooling the file {param1}.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Description

An error occurred while de-spooling the file {param1}. The print job has been cancelled.

Message #

An error occurred while de-spooling the file {param1}.  The print job has been cancelled.

Fields #

Name	Description
`param1`

Event ID 2147485652: The Line Printer Remote (LPR) service could not submit the print job to the Line Printer Daemon (LPD) printer {param1} on host {param2} because the...

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Message #

The Line Printer Remote (LPR) service could not submit the print job to the Line Printer Daemon (LPD) printer {param1} on host {param2} because the LPD service on the remote host or printer is rejecting the print job. This can occur if the LPD service is processing other print jobs. The LPR service will retry printing until the job prints successfully or the user cancels the print job.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221227474: An error was reported while attempting to initialize the printer port monitor with the list of port information from the following registry key: SY...

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Message #

An error was reported while attempting to initialize the printer port monitor with the list of port information from the following registry key: SYSTEM\CurrentControlSet\Control\Print\Monitors\LPR Print Monitor. The Line Printer Remote (LPR) service could not read or write registry settings. This is usually a result of a more significant system problem such as running out of memory or not having the appropriate registry permissions. The LPR printer port monitor may not be correctly configured until the problem is resolved.

Event ID 3221227477: The Line Printer Remote (LPR) print monitor failed to open a temporary file while spooling output for port {param1}.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Message #

The Line Printer Remote (LPR) print monitor failed to open a temporary file while spooling output for port {param1}. This can occur if the system is low on disk space; if the spool folder is write-protected; or if the LPR service does not have write permissions to the spool folder.

Fields #

Name	Description
`param1`

Event ID 3221227478: The Line Printer Remote (LPR) service could not delete the LPR port information stored in registry key {param1}.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Message #

The Line Printer Remote (LPR) service could not delete the LPR port information stored in registry key {param1}. This is usually the result of a more significant system problem. LPR may not be correctly configured until the problem is resolved.

Fields #

Name	Description
`param1`

Event ID 3221227479: The Line Printer Remote (LPR) print monitor failed to open the port named {param1}.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Message #

The Line Printer Remote (LPR) print monitor failed to open the port named {param1}.  This can occur if the server name for this port is incorrect. Printing to this port will fail until the problem is resolved.

Fields #

Name	Description
`param1`

Event ID 3221227480: The Line Printer Remote (LPR) print monitor failed to start because it reported an error while attempting to initialize the LPR Helper DLL.

Provider: Microsoft-Windows-Spooler-LPRMON
Channel: Operational

Description

The Line Printer Remote (LPR) print monitor failed to start because it reported an error while attempting to initialize the LPR Helper DLL.

Message #

The Line Printer Remote (LPR) print monitor failed to start because it reported an error while attempting to initialize the LPR Helper DLL.

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)