Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 6161 Source: Print

The document <document> owned by <username> failed to print on printer <printer>. Data type: NT EMF 1.008. Size of the spool file in bytes: 0. Number of bytes printed: 0. Total number of pages in the document: 0. Number of pages printed: 0. Client machine: <computername>. Win32 error code returned by the print processor: <error code>.
In the following scenario:
- The print server is a Windows Server 2008 that is also Domain Controller
- The print job shows on the server queue but disappears and does not get to the local computer
- An "Access is denied" Error shows up on the system log

In this case, you might need to "adjust" security permissions on C:\Windows\System32\spool.
We had this problem with a self developed software in Microsoft .NET in using the Crystal Reports 8.5 dll for a print-job. The problem was the dll. Something was running too fast in the .NET software, so the print job wasn't completed when the next printing-command was sent. We solved the problem with a thread.sleep with 3 seconds in the program. Then the errors in the log disappeared.
I cleared the print jobs in the spool directory after stopping the print spooler service. After restarting the spooler service, I got rid of this issue.
In my case, on WIN2K3 SP1, this problem occurred with Xerox 5665 printer. The cause of the access denied printing problem we had was that authenticated users beeing removed from c:\winnt\system32\spool\drivers and prtprocs. Granting access back to authenticated users cured the problem. Curious however, every other printer worked just fine with this setup.
In my case, I encountered lots of this event errors on a Windows 2003 Print Server. I simply restarted the Spooler service. Printing resumed straight away.

In our case, changing the print processor to "Winprint" solved the problem.
In my case, I had an USB printer and the port was set to LPT1.
Check that the RAW or LPT port is opened between firewalls. The default port for RAW is 9100.
- Error code 61 - The printer port was set up as a TCP/IP HP print server and the configuration utility used the printer's FQDN as address. Replacing the FQDN with the actual IP address of the printer resolved this problem.
I had this exact same problem with a Xerox Phaser 8550DP. Sometimes, the job would print after trying to restart the print job, sometimes it would not. Then sometimes, after throwing this error, the job would print. After contacting Xerox tech support, I went into the properties of the printer, selected the "Ports" tab and clicked on "Configure Port". I changed the protocol from Raw to LPR and also set the queue name to auto (all lowercase). I did not change anything else. This appears to have fixed the problem.
We received this error when we were trying to print to a networked HP Photosmart 8400. Users were not able to print but the local admin printed without errors. After installing the printer driver on the server, the software detected the network printer and added a HP port. I changed the port to a standard tcp/ip port and users were then able to print.
From a newsgroup post: "Please grant Full Control permissions to the C:\WINDOWS\System32\spool\ directory".

From a newsgroup post: "As article ME208820 suggested, I turned off bidirectional printing for my networked HP printer, and the problem was solved".
I fixed the problem with the Brother printer by installing the generic Brother PCL driver. After installing this as a new printer in the Add New Printer section, the old printer (which had 19 "deleting" documents stuck in it) was clear and now works great.
From a newsgroup post: "I encountered this problem on a Windows 2003 Server. In order to fix this problem I used the cleanspl.exe tool from the Windows 2003 resource tools and removed everything from the spooler except standard TCP/IP and USB. I then setup a test printer using a standard TCP/IP connection and printing started working again. I think that the problem was caused by one of our staff members, who had installed a non-compliant Windows 2003 driver".

From a newsgroup post: "I have performed a lot of research on printing issue after installing ME896423. Many cases indicated that ME896423 might cause some printers to stop working. There are two methods to resolve this issue (which have been confirmed to work on similar issues):
1. Follow the suggestions in ME832219.
2. Install a new version printer driver.
The security update ME896423 makes the printer spooler more secure. However, some old drivers cannot work with the updated spooler".

This event might occur after installing the hotfix provided in article ME824339.

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.