There isn't anything native. This tool should work though.
https://documentation.solarwinds.com/en/success_center/sam/content/sam_documentation.htm
--please don't forget to upvote
and Accept as answer
if the reply is helpful--
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
What event id triggers when print spooler service get started
There isn't anything native. This tool should work though.
https://documentation.solarwinds.com/en/success_center/sam/content/sam_documentation.htm
--please don't forget to upvote
and Accept as answer
if the reply is helpful--
Hi there,
It is Event ID 353 — Print Job Status.
The following table lists events that you should monitor in your environment.
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
You can get an additional list from the above link.
-------------------------------------------------------------------------------------------------------------------------------------------------------------------
--If the reply is helpful, please Upvote and Accept it as an answer--
From what I have found, on a Windows server OS, you should see event ID 7036 from the Service Control Manager.
On a desktop OS, like Win10, Windows no longer generates those events. I have no idea why Microsoft chose to do that.
You can see when the Spooler service was started by using this Powershell script to look at the start time of the process.
$Spooler = Get-CimInstance -Class Win32_Service -Filter 'Name="spooler"'
if ($Spooler.Started -eq 'True') {
$process = Get-Process -id $Spooler.ProcessId
"The Spooler service was started at {0}" -f $process.StartTime
} else {
"The Spooler service is not running."
}