Microsoft-Windows-SpoolerSpoolss

22 events across 1 channel

Event	Title	Channel	Sample
1073742848	Event ID 1073742848	Operational	N
1073742863	Group Policy was unable to delete per computer printer connection {param1}.	Operational	N
1073742864	Group Policy was unable to deploy per computer printer connection {param1}.	Operational	N
1073742865	Group Policy was unable to update per computer printer connection {param1}.	Operational	N
1073742866	Group Policy was unable to delete the per user printer connection {param1}.	Operational	N
1073742867	Group Policy was unable to deploy per user printer connection {param1}.	Operational	N
1073742868	Group Policy was unable to update per user printer connection {param1}.	Operational	N
1073742869	{ExceptionCode}: {Module}; {OffsetAddress}.	Operational	N
2147484682	InitializeProvider cannot allocate memory for {param1}.	Operational	N
2147484683	The print spooler failed to load print provider {param1}.	Operational	N
2147484684	InitializePrintProvider failed for provider {param1}.	Operational	N
2147484685	Group Policy was unable to add per computer connection {param1}.	Operational	N
2147484686	Group Policy was unable to delete per computer connection {param1}.	Operational	N
3221226497	The print router failed to initialize.	Operational	N
3221226498	The print spooler failed to get the computer name.	Operational	N
3221226499	The system failed to initialize the local print provider: Error {param1}.	Operational	N
3221226500	Failed to initialize the router work crew: Error {param1}.	Operational	N
3221226501	Failed to create Phase2Init event in WaitForSpoolerInitialization: Error …	Operational	N
3221226502	The system failed to impersonate the client: Error {param1}.	Operational	N
3221226503	The system failed to initialize the name cache: Error {param1}.	Operational	N
3221226504	Failed to initialize the router cache: Error {param1}.	Operational	N
3221226505	The print spooler cannot start because the PrinterBusEnumerator could not start.	Operational	N

Event ID 1073742848

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

{param1}

Fields #

Name	Description
`param1`

Event ID 1073742863: Group Policy was unable to delete per computer printer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to delete per computer printer connection {param1}. Error {param2}. The printer connection is still available to users on this computer. This can occur if the name of the printer connection is incorrect; if there is a Group Policy problem; or if the print spooler cannot contact the print server. Group Policy will periodically retry deleting the printer connection.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742864: Group Policy was unable to deploy per computer printer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to deploy per computer printer connection {param1}. Error {param2}. The printer connection is not available to users on this computer. This can occur if the name of the printer connection is incorrect; if there is a Group Policy problem; or if the print spooler cannot contact the print server. Group Policy will periodically retry adding the printer connection.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742865: Group Policy was unable to update per computer printer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to update per computer printer connection {param1}. Error code {param2}. This can occur if the name of the printer connection is incorrect; if there is a Group Policy problem; or if the print spooler cannot contact the print server. Group Policy will periodically retry updating the printer connection.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742866: Group Policy was unable to delete the per user printer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to delete the per user printer connection {param1}. Error code {param2}. The printer connection is still available to users on this computer. This can occur if the name of the printer connection is incorrect; if there is a Group Policy problem; or if the print spooler cannot contact the print server. Group Policy will periodically retry deleting the printer connection.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742867: Group Policy was unable to deploy per user printer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to deploy per user printer connection {param1}. Error code {param2}. The printer connection is not available to the users on this computer to which the Group Policy object applies. This can occur if the name of the printer connection is incorrect; if there is a Group Policy problem; or if the print spooler cannot contact the print server. Group Policy will periodically retry adding the printer connection.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742868: Group Policy was unable to update per user printer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to update per user printer connection {param1}. Error code {param2}. This can occur if the name of the printer connection is incorrect; if there is a Group Policy problem; or if the print spooler cannot contact the print server. Group Policy will periodically retry updating the printer connection.

Fields #

Name	Description
`param1`
`param2`

Event ID 1073742869: {ExceptionCode}: {Module}; {OffsetAddress}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

{ExceptionCode}: {Module}; {OffsetAddress}.

Message #

{ExceptionCode}: {Module}; {OffsetAddress}

Fields #

Name	Description
`ExceptionCode`
`Module`
`OffsetAddress`

Event ID 2147484682: InitializeProvider cannot allocate memory for {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

InitializeProvider cannot allocate memory for {param1}. This can occur because of system instability or a lack of system resources.

Message #

InitializeProvider cannot allocate memory for {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 2147484683: The print spooler failed to load print provider {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The print spooler failed to load print provider {param1}. This can occur because of system instability or a lack of system resources.

Message #

The print spooler failed to load print provider {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 2147484684: InitializePrintProvider failed for provider {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

InitializePrintProvider failed for provider {param1}. This can occur because of system instability or a lack of system resources.

Message #

InitializePrintProvider failed for provider {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 2147484685: Group Policy was unable to add per computer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to add per computer connection {param1}. Error code {param2}. This can occur if the name of the printer connection is incorrect; or if the print spooler cannot contact the print server.

Fields #

Name	Description
`param1`
`param2`

Event ID 2147484686: Group Policy was unable to delete per computer connection {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Message #

Group Policy was unable to delete per computer connection {param1}. Error {param2}. This can occur if the name of the printer connection is incorrect; or if the print spooler cannot contact the print server.

Fields #

Name	Description
`param1`
`param2`

Event ID 3221226497: The print router failed to initialize.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The print router failed to initialize. This can occur because of system instability or a lack of system resources.

Message #

The print router failed to initialize. This can occur because of system instability or a lack of system resources.

Event ID 3221226498: The print spooler failed to get the computer name.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The print spooler failed to get the computer name. Error {param1}. This can occur due to system instability or a lack of system resources.

Message #

The print spooler failed to get the computer name. Error {param1}. This can occur due to system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226499: The system failed to initialize the local print provider: Error {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The system failed to initialize the local print provider: Error {param1}. This can occur because of system instability or a lack of system resources.

Message #

The system failed to initialize the local print provider: Error {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226500: Failed to initialize the router work crew: Error {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

Failed to initialize the router work crew: Error {param1}. This can occur because of system instability or a lack of system resources.

Message #

Failed to initialize the router work crew: Error {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226501: Failed to create Phase2Init event in WaitForSpoolerInitialization: Error {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

Failed to create Phase2Init event in WaitForSpoolerInitialization: Error {param1}. This can occur because of system instability or a lack of system resources.

Message #

Failed to create Phase2Init event in WaitForSpoolerInitialization: Error {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226502: The system failed to impersonate the client: Error {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The system failed to impersonate the client: Error {param1}. This can occur because of system instability or a lack of system resources.

Message #

The system failed to impersonate the client: Error {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226503: The system failed to initialize the name cache: Error {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The system failed to initialize the name cache: Error {param1}. This can occur because of system instability or a lack of system resources.

Message #

The system failed to initialize the name cache: Error {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226504: Failed to initialize the router cache: Error {param1}.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

Failed to initialize the router cache: Error {param1}. This can occur because of system instability or a lack of system resources.

Message #

Failed to initialize the router cache: Error {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

Event ID 3221226505: The print spooler cannot start because the PrinterBusEnumerator could not start.

Provider: Microsoft-Windows-SpoolerSpoolss
Channel: Operational

Description

The print spooler cannot start because the PrinterBusEnumerator could not start. Error code {param1}. This can occur because of system instability or a lack of system resources.

Message #

The print spooler cannot start because the PrinterBusEnumerator could not start. Error code {param1}. This can occur because of system instability or a lack of system resources.

Fields #

Name	Description
`param1`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)