Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 20 Source: Print

Printer Driver <printer model> for Windows NT x86 Version-2 was added or updated. Files:- <list of driver files>.
This problem occurred when we uninstalled a PCL6 driver of an HP LaserJet 5100 printer and installed the PCL5e driver. Somehow, the print server mixed up some driver components.
We solved this problem by removing the drives completely (both PCL6 and 5E) from the C:\Windows\system32\spool\ directory and re-installing the PCL5e driver on the server. After removing and adding the printer on the workstation, everything worked like a charm.
The event appears whenever a printer driver is installed or updated. See MSW2KDB for more details.

If Citrix session printer policies are used, see "Citrix Support Document ID: CTX114061" to resolve this problem.
My users have reported that every time they try to print to the shared printer, the print dialog takes about 30 seconds to appear and event 20 is logged. I have investigated and found a possible solution. As per Microsoft: "GetPrintData may trigger a Windows call to GetPrinterDataFromPort. (See the Windows Development Kit, formerly Driver Development Kit, for more information about GetPrinterDataFromPort.) The latter function may write to the registry. If it does there may be side effects like triggering an update/upgrade printer event ID 20 in the client, if the printer is shared in a network" (see the link to "The GetPrinterData function"). The users who reported the problem had the "Manage Printers" right on the printers in question. I have removed this right and the problem was solved.
See ME911713 for a hotfix applicable to Microsoft Windows Server 2003.
The first time a user logs on to a Metaframe XP server that has been assigned to a printer on an imported network printserver or when an autocreated client printer initiates the driver installed on the Metaframe server, this event is logged. See the link to "Citrix Support Document ID: CTX775118" for details.

This event also occurs after the installation of a Service Pack. In this case the printer driver is updated to a new version.
There are two articles that also offer two explanations for this error message displaying in the Event Logs. I have seen several instances of this when using SNA print devices, information on SNA causes of this message are detailed in the second article (ME229046)

ME234330: These events are logged when a Terminal Services client with a local printer attached connects to a server. The server loads the drivers for the client''s local printer to enable the client to print to its local printer from within the client session. Note: Microsoft''s explanation sounds somewhat similar to Event ID 1105 for source: TermServDevice

ME229046: If the drivers for a remote printer are not installed on the SNA Server computer, the Windows NT spooler service will copy the drivers locally in order to print.

If the drivers for the remote printer ARE installed on the SNA Server computer, the spooler service still checks the remote printer server for updated drivers. If the drivers are newer than the ones installed on SNA Server, then the newer ones are temporarily copied locally to print the job.

Note: These events can occur for every print job that is sent through an SNA Server print session. The message does not cause any problems with printing, and can be considered an informational message.
Normally, this event is generated when a new printer is installed on a system. However, in many instances, it has been reported that this event keeps occuring without any change to the printing hardware or software. Here are some explanations:

From a newsgroup post: "This event is also generated when a computer without the required drivers connects to the print server and downloads the printer driver to their workstation. You could test this by removing the printer and its drivers from one of your workstations and then re-adding the printer. This should cause the driver files to be downloaded again, and should generate this event."

From another newsgroup post: "This may occur when you have printers from different NT print servers that have different versions of drivers for the same printer model. Either standardize driver versions on all servers or stop using conflicting printers on the same PC. E.g. \\SERVR1\HPLJ4-12 is HP driver version 3.0.7 and \\SERVR2\HPLJ4-33 is MS driver v X.X...or HP v. 2.00... Everytime you open a printer on your NT PC it checks and updates the driver versions from server, but it couldn't have different versions installed for the same model (HP LaserJet 4 in example)."

From another newsgroup post: "Here is my solution for the repeated event id 20:
1. Go to the actual print server, open the print dialog box, click Server properties, click the driver tab and remove all of the unused drivers (note: if you don't know which ones to delete just go through and delete them all, windows prompts you when the driver is in use and cannot be deleted).
2. After you cleaned up the server side of useless driver info go the the client. Delete the logical printers first on the client, then go into printer dialog box and go into the server properties driver tab and remove the unused drivers as indicated in the previous text,
3. Reboot the client, install the printers, that should be all you need.
4. After you install the printers you will see one entry in the event viewer at the time you installed the printer but you should see that only once."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.