none
PrintService EventID 812

    General discussion

  • I found this post http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2general/thread/45bf397a-73c0-4636-bd92-97028b56357d I can't respond or reply to it, as it's marked read-only.

    I am also seeing this same problem, this is a brand new installtion of Windows Server 2008 R2 Enterprise x64. I don't know what the other peoples issues were, but I'm seeing the error in deleteing the spool file on users who are logging in from a trusted domain. Not really sure what the best way at the moment to deal with that is as it appears to be a cross-forest issue.

    I could most likely assign a group from the trusted domain permissions to delete files in that folder, but it seems if they are able to create files in that folder, they should also be able to delete. Wouldn't they wind up in the Creator Owner group?


    Jeffrey S. Patton Assistant Director of IT School of Engineering Computing Services University of Kansas 1520 West 15th Street Lawrence, KS. 66045-7621
    Tuesday, September 21, 2010 8:29 PM

All replies

  • Ok, after looking at it, it appears that the file it says it can't delete is a file the doesn't actually exsit.
    Jeffrey S. Patton Assistant Director of IT School of Engineering Computing Services University of Kansas 1520 West 15th Street Lawrence, KS. 66045-7621
    Tuesday, September 21, 2010 8:40 PM
  • Ok, after looking at it, it appears that the file it says it can't delete is a file the doesn't actually exsit.
    Jeffrey S. Patton Assistant Director of IT School of Engineering Computing Services University of Kansas 1520 West 15th Street Lawrence, KS. 66045-7621

    I decided to watch what was going on, I logged in to a computer in the trusting domain, with a trusted domain user account. I sent a print job, and watched the spool folder on the print server. I saw the spool files show up and then go away, I then noted that Event ID 812 was logged. Next I logged into a computer in the trusting domain, with a trusting domain user account. I sent a print job, and again watched the spool folder, same outcome this time Event ID 812 was NOT logged.

    So, I guess I can just ignore these errors as they are apparently incorrect. Deep down this feels like some sort of bug, so maybe if someone at MS could check it out that would be awesome.


    Jeffrey S. Patton Assistant Director of IT School of Engineering Computing Services University of Kansas 1520 West 15th Street Lawrence, KS. 66045-7621
    Wednesday, September 22, 2010 3:12 PM
  • Hi Jeffrey,

     

    Thanks for your report.

     

    Do you have any other printers with the same problems? If only this one has problem, it may be a printer driver compatibility issue.

     

    Meanwhile, you can configure Audit Policy to monitor the C:\Windows\system32\spool\PRINTERS folder. Then, reproduce the problem and you can find the event occurs in security log at the same time that Event ID 812 appears.

     

    Hope it helps.

     

    Regards,

    Bruce

    Friday, September 24, 2010 9:14 AM
  • For what it's worth, i'm having the same problem..   one AD domain,   anyone who uses the printers on the 2008 R2 server seem to generate this error, except the domain admin account.   most  users have "print" permissions, and "creator owner" has "manage documents" permissions.

    ---  just updated to SP1,   still have the problem.    As noted above, print jobs are going through, and  there seem to be no actual detrimental effectes related to the error, it's just an annoyance as far as I can tell.... so far..

     

     

    Monday, March 21, 2011 9:47 PM
  • The printer' permissions only have connectivity impact.

    In the spool directory, Users should have Read attributes, Read extended attributes, Create files, Create folders

    Creator Owner has the same + List folder, Write attributes, Write extended attributes, Delete subfolders, Delete, Read permissions, Change permissions, and Take ownership.

    I would expect some failure if the default acl in the folder has been changed.


    Alan Morris Windows Printing Team
    Monday, March 21, 2011 10:01 PM
    Answerer
  • I still have this issue. In my case my users exist in a domain to which i have a one-way external trust. In the old school terminology, i'm the resource domain, so the arrow flows from me to the user domain.

    The default permissions have not been modified, i observed this behaviour immediately upon setting up this new server.


    Jeffrey S. Patton Assistant Director of IT School of Engineering Computing Services University of Kansas 1520 West 15th Street Lawrence, KS. 66045-7621 | http://patton-tech.com
    Wednesday, March 23, 2011 6:15 PM
  • I'm having the same problem with error code 0x2.  It appears that the user affected is the "SYSTEM" account.  I wonder if the problem is just that "SYSTEM" cannot see that the file got deleted correctly. Looking through permissions I see that "SYSTEM" does not have "traverse folder / execute file" permissions set.  

     

    If I am right about my assumption and I grant "SYSTEM" the Bypass Traverse Checking right, would that eliminate the error message? 

     

    By the way, I am running 2008 R2 standard, fairly updated with patches, no sp-1.  Drivers are HP Universal Print Driver PS & PCL (Latest Version).  

     

    One more thing, Setting up this print server has been extremely painful!  I cannot understand why installation, configuration, and deployment takes so long in the new environment.  For example, simply changing drivers on a shared printer takes about 4 minutes to complete.  What would you do if you wanted to update the driver for 50 computers?  

    Wednesday, March 23, 2011 7:42 PM
  • I had the same Problem.

    Win2k8R2 Virtual, HP Universal PCL6

    We have also an Document Cost Programm (TE.COMP Printfex).

    Document Sitt in Spool

    i changed the Permission on the Spool\Printers Folder to Read,Write,Delete and Read Persmissions with Domain Users.

    I also changed "NO Driverisolation" for the HP Universal Printing Driver, prbly this could also fix it.

    Since 2 Days no Error Message and Document Printing errors.


    Its the ghost in the machine how dont let me go in vadication :-)
    Wednesday, June 15, 2011 5:56 AM
  • i figure it is still within the same year, so I can reply.  I have the same issue with win2008r2 print server and the HP Universal Driver.  However I'm using a product called Papercut for billing print jobs.  My issue is that with the papercut product there are jobs that get processed and do not end up printing and get refunded by papercut.  (Papercut pauses jobs, figures out who printed, bills, etc. then releases)  The interesting thing about this is that the ones that do NOT work are jobs that do NOT have this 812 Event ID as part of the print cycle.  One person's printing will not work, then it will work, not pattern that I can find.  My "normal" print job that DOES WORK generates the following event IDs:

    800, 801, 842, 812 (error), 805, 307

    The print jobs that do NOT print generate this sequence in order:

    800, 308, 309,801,307,310

    The 307 showing that the file is 0 bytes, and of course the 310 showing the delete of the file.   Once again, there seems to be no pattern and I can't reliably reproduce the issue.  I'm working with papercut to find a solution, but it seems that the OS is deleting the file at an odd point, and that 812 error is actually allowing it to print by keeping it from being deleted.


    I know I'm not offering any insight to this issue, but I wanted to get it "out there" in case anyone else was poking around.  I will update with any new info.

    Friday, October 28, 2011 5:23 PM
  • hi did you get anywhere with this, I am also using papercut and we have print jobs that are being deleted from the print queue without any obvious reason.
    Friday, March 30, 2012 2:33 PM
  • For PaperCut software, you will need to your print drivers so they render in the spooler process rather than the isolation process.  From printmanagement.msc on the print server or remotely from another machine, select the print drivers that are used by the devices you have PaperCut set for and change Driver Isolation to None.

    Alan Morris Windows Printing Team

    Friday, March 30, 2012 3:08 PM
    Answerer
  • Hello

    we have also this 812 error on our Windows 7 SP1 machines with HP Universal Printing PCL 6 (german error message):
    (Fehler beim Löschen der Datei C:\Windows\system32\spool\SERVERS\WKKPSA\00007.SHD durch den Druckspooler, Fehlercode 0x5. Kontextinformationen finden Sie in den Benutzerereignisdaten.)


    is this a bug and can we ignore that error?

    or sould we set the Driver Isolation to None on the printserver (the client gets the printer through GPO)

    robert

    • Edited by Mad Rian Thursday, May 03, 2012 7:41 AM
    Thursday, May 03, 2012 7:41 AM
  • Also getting this symptom (Error in PrintService Operational log) but apparently no consequences. We are using HP Universal Print Driver 5.5 PCL6 and Ricoh's PCL6 Driver for Universal Print (for HP or Ricoh printers, respectively). It is intermittent, can't determine cause or reproduce at will. The message is being logged against well known GUID S-1-5-18 (Local System). SYSTEM has Full Control NTFS permissions to the D:\Spool folder. So this error makes no sense. The .SHD and .SPL files do get deleted, but while one was there briefly I checked NTFS permissions and they are all inherited (as expected) from the parent D:\Spool folder.

    Security Properties of D:\Spool are -

    CREATOR OWNER (Full Control)

    SYSTEM (Full Control)

    Administrators (Full Control)

    Users (Read & execute, List folder contents, Read)

    Example message from log:

    Log Name:      Microsoft-Windows-PrintService/Operational
    Source:        Microsoft-Windows-PrintService
    Date:          1/31/2013 8:26:05 AM
    Event ID:      812
    Task Category: Executing a file operation
    Level:         Error
    Keywords:      Print Spooler
    User:          SYSTEM
    Computer:      PRT.my.com
    Description:
    The print spooler failed to delete the file D:\Spool\00103.SHD, error code 0x2. See the event user data for context information.
    
    + System 
      - Provider 
       [ Name]  Microsoft-Windows-PrintService 
       [ Guid]  {747EF6FD-E535-4D16-B510-42C90F6873A1} 
       EventID 812 
       Version 0 
       Level 2 
       Task 46 
       Opcode 12 
       Keywords 0x4000000000020000 
      - TimeCreated 
       [ SystemTime]  2013-01-31T14:26:05.831332200Z 
       EventRecordID 71644 
       Correlation 
      - Execution 
       [ ProcessID]  3604 
       [ ThreadID]  3668 
       Channel Microsoft-Windows-PrintService/Operational 
       Computer PRT.my.com 
      - Security 
       [ UserID]  S-1-5-18 
    - UserData 
      - FileOpFailed 
       Source D:\Spool\00103.SHD 
       Destination - 
       Flags 0x0 
       ErrorCode 0x2 
       Context 104 

    Thursday, January 31, 2013 10:18 PM
  • So i wonder if it's some issue with the HP universal driver? I've changed jobs within the University and managing printers no longer falls under my control..thank god..lol...but it looks like a handful of folks were seeing this. There was a reply early on that I failed to respond to regarding dialing up auditing. I'd be happy to try this out in a lab to see if i can get any more details, but if anyone else has already tried this I would be interested in seeing those logs.

    Thanks,


    Jeffrey S. Patton Jeffrey S. Patton Systems Specialist, Enterprise Systems University of Kansas 1001 Sunnyside Ave. Lawrence, KS. 66045 (785) 864-0242 | http://patton-tech.com

    Thursday, January 31, 2013 10:24 PM
  • Recently changed the default NTFS permissions on the Spooler folder on the print server (see http://social.technet.microsoft.com/Forums/en-US/winserverprint/thread/3c833648-c60f-4e6e-8bfc-ec81aa7685ae). This change was made for unrelated reasons to the Event ID 812 in this thread. However, it did seem likely it might resolve this issue; unfortunately, No. I do plan to upgrade the HP UPD print driver soon and will continue to monitor....
    Friday, May 24, 2013 5:23 PM
  • I have updated to HP UPD 5.6.1 and it did not resolve this issue. Still getting event 812.

    Log Name:      Microsoft-Windows-PrintService/Operational
    Source:        Microsoft-Windows-PrintService
    Date:          6/9/2013 10:27:17 PM
    Event ID:      812
    Task Category: Executing a file operation
    Level:         Error
    Keywords:      Print Spooler
    User:          SYSTEM
    Computer:      PRT.my.com
    Description:
    The print spooler failed to delete the file D:\Spool\00119.SHD, error code 0x2. See the event user data for context information.
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-PrintService" Guid="{747EF6FD-E535-4D16-B510-42C90F6873A1}" />
        <EventID>812</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>46</Task>
        <Opcode>12</Opcode>
        <Keywords>0x4000000000020000</Keywords>
        <TimeCreated SystemTime="2013-06-10T03:27:17.774300700Z" />
        <EventRecordID>12060</EventRecordID>
        <Correlation />
        <Execution ProcessID="1248" ThreadID="3644" />
        <Channel>Microsoft-Windows-PrintService/Operational</Channel>
        <Computer>PRT.my.com</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <FileOpFailed xmlns:auto-ns3="http://schemas.microsoft.com/win/2004/08/events" xmlns="http://manifests.microsoft.com/win/2005/08/windows/printing/spooler/core/events">
          <Source>D:\Spool\00119.SHD</Source>
          <Destination>-</Destination>
          <Flags>0x0</Flags>
          <ErrorCode>0x2</ErrorCode>
          <Context>104</Context>
        </FileOpFailed>
      </UserData>
    </Event>


    • Edited by George Perkins Monday, June 10, 2013 6:49 PM sanitize domain name
    Monday, June 10, 2013 6:47 PM