Windows Event ID 20 – Print Spooler: Print Job Completion and Status Events

Start by examining the specific Event ID 20 entries to understand the context and frequency.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. In the Actions pane, click Filter Current Log
4. Enter 20 in the Event IDs field and click OK
5. Review recent entries, noting the frequency and any patterns in timing
6. Double-click individual events to examine detailed information including job names and user accounts

Look for correlations between Event ID 20 occurrences and user complaints about printing issues. High frequency might indicate spooler instability or driver problems requiring further investigation.

Use PowerShell to extract and analyze Event ID 20 data programmatically for pattern identification.

1. Open PowerShell as Administrator
2. Run this command to retrieve recent Event ID 20 entries:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=20; StartTime=(Get-Date).AddDays(-7)} | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -AutoSize

3. For more detailed analysis, export the data:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=20; StartTime=(Get-Date).AddDays(-30)} | Export-Csv -Path "C:\Temp\Event20_Analysis.csv" -NoTypeInformation

4. Count occurrences by hour to identify peak printing times:

   Get-WinEvent -FilterHashtable @{LogName='System'; Id=20; StartTime=(Get-Date).AddDays(-1)} | Group-Object {$_.TimeCreated.Hour} | Sort-Object Name

This analysis helps identify printing patterns and potential performance bottlenecks during high-usage periods.

Verify the Print Spooler service is operating correctly and review its configuration settings.

1. Open Services by pressing Win + R, typing services.msc, and pressing Enter
2. Locate Print Spooler service and verify it shows Running status
3. Right-click the service and select Properties
4. Ensure Startup type is set to Automatic
5. Check the spooler folder permissions and contents:

   Get-ChildItem -Path "C:\Windows\System32\spool\PRINTERS" -Force | Measure-Object

6. Review spooler registry settings:

   Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers"

7. If issues persist, restart the spooler service:

   Restart-Service -Name "Spooler" -Force

Examine printer drivers that might be causing excessive Event ID 20 generation or related printing problems.

1. Open Device Manager by pressing Win + X and selecting it from the menu
2. Expand Print queues to view installed printers
3. Right-click problematic printers and select Properties
4. Check the Driver tab for version information and update dates
5. Use PowerShell to list all printer drivers and their versions:

   Get-PrinterDriver | Select-Object Name, Version, DriverVersion | Format-Table -AutoSize

6. Check for driver updates in Windows Update or manufacturer websites
7. If driver issues are suspected, remove and reinstall the problematic printer:

   Remove-Printer -Name "PrinterName"

8. Monitor Event ID 20 frequency after driver updates to confirm resolution

Driver incompatibilities often manifest as increased Event ID 20 activity combined with user printing complaints.

Enable detailed print spooler logging for comprehensive troubleshooting and ongoing monitoring.

1. Open Registry Editor as Administrator
2. Navigate to HKLM\SYSTEM\CurrentControlSet\Control\Print
3. Create or modify the LogLevel DWORD value:

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Print" -Name "LogLevel" -Value 1 -Type DWord

4. Enable operational logging in Event Viewer by navigating to Applications and Services Logs → Microsoft → Windows → PrintService
5. Right-click Operational and select Enable Log
6. Set up automated monitoring with PowerShell:

   Register-WmiEvent -Query "SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2" -Action { Get-WinEvent -FilterHashtable @{LogName='System'; Id=20; StartTime=(Get-Date).AddMinutes(-5)} | Out-File -Append "C:\Logs\PrintEvents.log" }

7. Create a scheduled task to regularly analyze Event ID 20 patterns and generate reports