Testing Ability to Print

Group Policy can be used to disable printing for specific user accounts.

The Windows Registry stores information about installed printers and their configurations. The following registry keys can be useful to investigators:

• Printer settings -  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers
• User-specific settings -  HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Devices

This detection monitors when a subject prints a file from a device protected by Microsoft Defender for Endpoint. By generating an alert on file print events, investigators gain early visibility into potential data loss vectors and can correlate the activity with the originating device, the initiating account, and the context of the printed content.

This detection is dependent on the respective device running Microsoft Defender for Endpoint.

In the Microsoft Defender portal at https://security.microsoft.com, navigate to Email & collaboration > Policies & rules > Alert policy. To go directly to the Alert policy page, use https://security.microsoft.com/alertpoliciesv2.

Click + New Alert Policy in the top-left corner. Assign a clear name to the alert policy and select an appropriate Severity and Category. On the next page, under Activity is, search for and select “Printed file”. Configure the remaining settings as required.

When a device that has Microsoft Defender for Endpoint deployed prints a file, an alert will be generated.

The Spool files can typically be found in the following directory: C:\\Windows\\System32\\spool.

A spool file with a .SPL extension contains the actual print data. This data can be in various formats, including RAW, EMF (Enhanced Metafile), or other printer-specific formats.

The spool file is stored in the spool directory associated with the printer until the print job is completed. Once the print job is finished and successfully printed, the .SPL file is typically deleted.

A job control language file with a .SHD extension contains metadata about the print job, such as document properties, print settings, and information about the account that submitted the print job.

The .SHD file is also stored in the spool directory during the print job's processing. Unlike the .SPL file, the .SHD file can sometimes persist longer, but it is generally deleted after the print job is completed or upon system cleanup.

If the files are not present, it may be possible to use file carving techniques on a disk image to retrieve .SPL and .SHD files. Content and metadata analysis can be conducted to identify timestamps, document names, and user names.

Windows logs print job activities to Event logs, containing information such as job creation, completion, errors, and adding or deleting printer devices.

Windows Logs -> System

Event ID 307 - A document was printed.

Event ID 310 - A document failed to print.

Event ID 701 - Printer status changed.

Event ID 703 - Printer object added.

Event ID 804 - Document resumed for printing.

Event ID 805 - Printer driver was installed.

Applications and Services Logs -> Microsoft -> Windows -> PrintService -> Operational

Event ID 808 - Printer driver was installed.

Event ID 843 - The print spooler failed to import the printer driver.

Event ID 1000 - Document print started.

Event ID 1001 - Document was printed.

Event ID 1100 - Printer was added.

Event ID 1101 - Printer was deleted.

Event ID 1200 - Print spooler service started.

Event ID 1201 - Print spooler service stopped.