Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 61 Source: Print

The document <document name> owned by <user name> failed to print. Win32 error code returned by the print processor: <error code> (<error code in hex>).
In my case, I had a similar problem. I attached a printer to the client machine on LPT and then added it on the server on local port. When I was printing directly from Windows everything was working fine, however, when I tried printing with a 3rd party Printing Service (Sentinel), I received the error. It turned out the user account from which the Printing Service was started did not have Administrator privileges. When I added it to the Administrators group, everything went fine.
In my case, the LPT1 port was disabled from BIOS.
In our case, the driver was corrupted. We have disconnected the client's printers that were using that driver, restarted the Spooler service and uninstalled the faulty driver. Finally, we have reinstalled it and everything worked well.
- Error code: 3003 (Error code 3003) - See ME896604 for a hotfix applicable to Microsoft Office 2003. Also see "JSI Tip 8222" for additional information about this event.

This problem may occur when new print jobs try to acquire a port when the port is still being used. See ME889074 for a hotfix applicable to Microsoft Windows 2000 and Microsoft Windows Server 2003.
- Error code: 3003 (Error code 3003) - If you are using a Minolta QMS Magicolour 2200 printer, make sure the protocol used is LPR and not RAW. This should solve your error.

See ME824339 and ME826026 for two hotfixes applicable to Microsoft Windows 2000.
See ME901370 for a hotfix applicable to Microsoft Office XP.

As per Microsoft: This problem occurs when you do not specify the full path of the file you are printing to. If a file is specified as filename.prn, the file will be created in the %Systemroot%\System32 folder. Various users will have different rights to this folder. If you print to a file that is located in this folder, you may receive an "ACCESS_DENIED" error message. In this case, if you continue to write jobs to this same file, the spooler continues to try to print the job. This scenario can exhaust page-pooled memory and cause your computer to stop responding". See ME838172 to fix this problem.

From a newsgroup post: "I was having the following problem. When I was logging in as admin, the print job appeared in queue and then disappeared, no print and no event log message. When I was logging in as another user the print job generated error 3003(0xbbb) in system event log. I think I've traced the error back to the Netware Client installed on this PC. If logged in with "Workstation only" the problem disappeared. I went back to version 4.83 of Netware Client and problem went away".

As per Microsoft: "The print server is low on resources such as memory or hard drive space, or a TCP/IP printer is not connected to the network. It is common for this message to appear several times; however, if this message appears more than 25 times in a 15-minute period, you might have to restart the print spooler". See MSW2KDB for more details on this problem.
I had this problem on a Windows 2000 server where the printer was set to use the hostname (on the ports tab). I changed it to the IP address and it worked fine after that.
Error code: 1008. From a newsgroup post: "I had the same problem after I applied the hotfix. So on a hunch, I deleted the printer and reinstalled it. Then on my networked computers, I removed the printer and re-attached to it and it worked just fine."

Error code: 0 (The operation completed successfully) - This would be recorded in the event log when a print job is cancelled by the owner. It is an "error" because the printing basically failed but the "error" is "successful" because that was the intention of the print job owner.
- Error code: 3003 (Error code 3003) - This error code indicates the printer cannot be reached over the network. The usual reason is an erroneous port configuration, incorrect IP address, FQDN, or printer name.
I had this same problem, it turned out to be, and IP address conflict. After I changed address on the printer, everything worked just fine.
In our case, the problem turned out to be caused by the lack of disk space on the print server. After deleting some files, this problem disappeared.
I received this error and had difficulties printing only from domain user accounts, while the administrator was able to print successfully. Win2k and WinXP both had the same issue. The error code was 3003, or 0xbbb. In my case, the issue was only on an HP DesignJet plotter that uses a JetDirect MIO card (the J2552A) for network connectivity. I had installed the printer using HP's "Install Network Printer Wizard" and I was oblivious to the problem until I logged off the Admin accounts and regular jobs could not print to it, not even a test page. All of the defaults were used until I saw a previous comment (below) which stated I should try to disable "advanced printing features". This did not work for us. I then just on a random hunch looked at the "Ports" tab on the Printer Properties page. I clicked "configure port" and changed the field for "Printer Name or IP address" to its actual IP address. Previously, its DNS name had appeared in place of an IP. (It had a static IP, and I had already given it the domain name
So, in other words, for some unknown reason, the IP address works and its DNS name fails unless the user is a local or domain administrator.
We have had this intermittently on a Win2003 box. The problem was actually caused by a faulty switch on a single network segment linking to this printer; the print command could not actually reach the printer, hence the message. Re-booting the switch allowed the command through, and all is well.
- Error code: 3003 (Error code 3003) - We were getting Event ID 61 with Error code 3003 on our print server. I fixed this problem by enabling port 9100 on our Xerox 1325 printers, seeing as how the print queues were setup by default to print raw across port 9100.

I was running XP and printing to an IP port. Other computers could print with the same configuration, but not XP. I created a new port with the same IP address but named it differently, in this Tektronix Printer. I assigned the printer to the new port and successfully printed.
This error occurred on a Windows XP Professional with an HP Officejet G95. Canceling the erroneous document from the print queue and turning the printer off and then back on solved the problem. Note: After canceling the erroneous document, other documents from the queue gave the same problem/events until the power of the printer was turned off and back on.
I was encountering this error: "Win32 error code returned by the print processor: 3003. A StartDocPrinter call was not issued”. This happened for me on an HP LJ8000 and an 8100 after moving them from my win2000 server to the win2003 server. Finally discovered that the printer itself was configured to accept only print requests from the original Win2k server. I used telnet to connect to the IP address of the problematic printer, then used the "allow:" command to add the IP address of the new Win2k3 server, essentially telling the printer that it's OK to accept print jobs from that server. This did it.
- Error: 126(0x7e) - I was receiving this error on all Domain User workstations that were connecting to an Active Directory 2000 Server. The error was caused by a selection in the Printer Properties, Advanced Tab, "Enable Advanced Printer Features". Once this selection was turned off a Domain User was able to print to any printer that was listed in Active Directory.
I had a user on terminal services raising this event with error 5 every time anyone tried to print to his printer. He was able to print to anyone else’s printer, and none of the other users on that machine had any printing issues of their own. Stopping the print spool service and re-starting it fixed the problem.
- Error code: 3003 (Error code 3003) - It was just the SNMP-Status in the TCP/IP-Printer-Port, that was not activated. After activating it, everything works fine.
This event has occurred on our 2 node cluster print server due to devices that are using AppleTalk. Since clustering is not compatible with AppleTalk devices, I needed to instruct users to print directly to node "a". Keep in mind that you can still see the AP device on the cluster name, it just won’t let you map to it. Things changed to where it was necessary to have customers use a server other than node "a" for AP devices. I built a separate server just for those people, but there are a few still trying to print to the old queue names on node "a" (my bad for not removing those queues). When a customer tries to print to node "a", to that AppleTalk device, the event ID 61 is created. What I have done is to call the users (since their userid is in the 61 event), find out what printer they are trying to connect to, and then I have them remap to the correct printer. This solves the problem for this particular situation.
In my case this problem appeared when the Wins Server was offline. Our Print server was unable to resolve the IP address of the printer.
- Error code: 3003 (Error code 3003) indicates the printer cannot be reached over the network. The usual reason is an erroneous port configuration (incorrect IP address, FQDN or printer name).

I have a Printer server installed on a two clustered server with Win2k. After I installed Service Pack 4, on the server event viewer I found errors with id 61 and 45, and the users were not able to print anything. After I uninstalled Service Pack 4 everything worked just fine.
Error 63. Restarting the print spooler service resolved the problem.
See ME810647 link below. After you install the hotfix that is described in this article, event 61 is not logged for Win32 status 63 (0x3f).
From a newsgroup post, when events 45 and 61 are logged on W2K print server:

What does this mean:
Document rendering was not successful. Rendering is that part of the spooler process where jobs are passed to language and port monitors for processing. All monitors are layered as defined within the "HKLM\System\CurrentControlSet\Control\Print\Monitor" registry key.

Once you see these events (45/61) pop-up, the job is deleted from the queue and no print-out received by the printer. Sometimes this happens for every 3-4 prints made by anyone.

The Event 61 reveals more than the Event 45, because Event 61 logs also the user, job and queue details of the job sent. Additionally a Win32 error code is logged and reveals the actual reason why the OS has stopped processing/rendering the job:

3003 (Error code 3003) A StartDocPrinter call was not issued (printer not reached on network)
63   Your file waiting to be printed was deleted (user deleted job)
129  The %1 application cannot be run in Win32 mode (???)
29   The system cannot write to the specified device (port error)

3003 and 63 should not trouble you, as these occur in quite normal situations.

29 is related to a Port name that has become inactive/corrupt, normally corrupted by the print driver => wrong driver code. Restarting the spool service will solve the problem, as well as creating a new port (with a new name!), but this is temporarily. Enabling LPR Byte Count after stop-start spooler proved to be a better solution.

129 were seen "storming" on multiple servers. In the end it appeared that these servers were typically stressed (100% CPU; spoolsv.exe consuming 800+ Mb; 500+ jobs left in spool folder) due to a running page heap debug process (to detect corrupt driver code). After stopping page heap, the problems disappeared and stayed away.

To return the description of any error message in W2K go to a Command prompt and type: NET HELPMSG message# (e.g. "net helpmsg 63" returns "Your file waiting to be printed was deleted.").

I typed in the errors that we received in our system and got following results:
0  (0x0) The operation completed successfully.
5  (0x5) Access is denied.
63  (0x3f) Your file waiting to be printed was deleted.
259  (0x103) No more data is available.
3003  (0xbbb) A StartDocPrinter call was not issued.
- Error code: 3003 (Error code 3003) - I tried to print from the network PC named A to the printer which is connected to the network PC named B after I exchanged B by a new PC. On this new PC I had to reinstall also the printer. After that I was no more able to print from B to the printer. I deleted the printer on B and reinstalled it again. After this, I was able again to print.
I received the error when trying to print - the network cable was simply unplugged from the printer.
Solved this problem by using an earlier version drivers ie drivers for HP Laserjet 5L for a HP1200 printer.
Error code 2(0x2).I got this message after I installed the printerdriver for a LaserJet 2200 DN and accidently deleted the HPB22007.PPD in "c:\winnt\system32\spool\drivers\w32x86\3"

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.