Update Microsoft-Windows-PrintService-Operational_Microsoft-Windows-PrintService_307.map to correct the parameter used (Param2) for Document Name. This parameter contains the default value "Print Document" until the ShowJobTitleInEvent setting is enabled in Group Policy.
Description
Please include a summary of the change and (if applicable) which issue is fixed.
Checklist:
Please replace every instance of [ ] with [X]
[x] I have ensured a Provider is listed for the new Map(s) being submitted
[x] I have ensured the filename(s) of any new Map(s) being submitted follows the approved format, i.e. Channel-Name_Provider-Name_EventID.map. In summary, all spaces and special characters are replaced with a hyphen with an underscore separates Channel Name, Provider Name, and Event ID
[x] I have tested and validated the new Map(s) work with my test data and achieve the desired output
[x] I have provided example event data (# Example Event Data:) at the bottom of my Map(s), if possible
[x] I have consulted the Guide/Template to ensure my Map(s) follow the same format
Thank you for your submission and for contributing to the DFIR community!
Update Microsoft-Windows-PrintService-Operational_Microsoft-Windows-PrintService_307.map to correct the parameter used (Param2) for Document Name. This parameter contains the default value "Print Document" until the ShowJobTitleInEvent setting is enabled in Group Policy.
Description
Please include a summary of the change and (if applicable) which issue is fixed.
Checklist:
Please replace every instance of
[ ]with[X]Provideris listed for the new Map(s) being submittedChannel-Name_Provider-Name_EventID.map. In summary, all spaces and special characters are replaced with a hyphen with an underscore separates Channel Name, Provider Name, and Event ID# Example Event Data:) at the bottom of my Map(s), if possibleThank you for your submission and for contributing to the DFIR community!