locked
PrintIsolationHost.exe Faulting RRS feed

  • Question

  • I am trying to isolate the cause of this error message on a terminal server running Server 2012. When it crashes there is about a 20% chance that it will freeze up the whole print queue and the printer spooler service has to be restarted to allow it to continue.

    If I am reading this error message correctly it says that a printer drive is faulting, and KMUU6MR1.DLL is a Kyocera printer driver. I have since updated all Kyocera printers to the latest version but it is still faulting.

    Any ideas?

    Faulting application name: PrintIsolationHost.exe, version: 6.2.9200.16384, time stamp: 0x50109d59
    Faulting module name: KMUU6MR1.DLL, version: 6.1.8.26, time stamp: 0x521ba6ee
    Exception code: 0xc0000005
    Fault offset: 0x0000000000168d2f
    Faulting process id: 0x7a90
    Faulting application start time: 0x01d1b2374f38a7f7
    Faulting application path: C:\Windows\system32\PrintIsolationHost.exe
    Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\KMUU6MR1.DLL
    Report Id: 8d416fed-1e2a-11e6-98d4-000c29e3df68
    Faulting package full name: 
    Faulting package-relative application ID: 

    Friday, May 20, 2016 2:41 AM

All replies

  • Hi,

    Looking at the last four digits of the "exception code", 0005, indicate there is an access denied issue going on. This will be a memory "access denied", not a file system "access denied", so don't go investigating that school of thought.

    There's very little you can do about this. You just need to keep trying different driver versions to hopefully find a stable revision.

    Cheers,
    Lain

    Friday, May 20, 2016 2:50 AM
  • This binary is causing the failure. It could be during rendering or when opening the UI or if there id some upgrade driver task occurring on the machine.  Is this for a redirected printer, a connection to a print server, or a local printer on the machine?

    You can locate the precise driver causing the issue using PowerShell.  Open a PowerShell window on the server and execute this command.

    get-printerdriver | where {$_.ConfigFile -like "*KMUU6MR1*" -or $_.DependentFiles -like "*KMUU6MR1*" -or $_.Monitor -like "*KMUU6MR1*"}

    I go into addition depth here: http://www.papercut.com/kb/Main/TrackDownFailingPrintDrivers

    I usually associate KMblahblah.dll to Konica Minolta drivers.

    See if there is some other driver that works with the device.  Just because the driver is the latest does not mean it was designed for a remote desktop environment. 


    Alan Morris formerly with Windows Printing Team


    Friday, May 20, 2016 3:18 AM
    Answerer
  • Hi Alan,

    Thank you for your help! We have 59 "printers" (43 directly connected printers and those same printers on a print server, plus another 16 redirected using TS Print for a total of 59 "printers") so tracking down this error has been a nightmare! I ran your script and this is the result:

    Name                                PrinterEnvironment MajorVersion    Manufacturer
    ----                                ------------------ ------------    ------------
    Kyocera FS-C5350DN KX               Windows x64        3               Kyocera
    Kyocera FS-C5030N KX                Windows x64        3               Kyocera
    Kyocera FS-1118MFP KX               Windows x64        3               Kyocera

    We do have a Konica Minolta printer as well and I will update this driver ASAP.

    I set up a script on Friday in Task Scheduler to reboot the Printer Spooler every time the error message occurred. On Friday it was faulting less than once an hour but by Monday morning it was doing it three times a minute! (oops!) I have since stopped the scheduler because the print job would stop 2/3rds of the way through printing and start again and the queue would just keep getting longer and wasting paper with incomplete jobs.

    I'm now getting these errors as well, every second or third event, not sure if it is related, seems to be new over the weekend, maybe because of the script:

    **************************************************************************

    Faulting application name: PrintIsolationHost.exe, version: 6.2.9200.16384, time stamp: 0x50109d59
    Faulting module name: KMDISCOVER2.DLL, version: 3.1.52.24, time stamp: 0x53e15371
    Exception code: 0xc00000fd
    Fault offset: 0x000000000001fd97
    Faulting process id: 0x543c
    Faulting application start time: 0x01d1b480a587c534
    Faulting application path: C:\Windows\system32\PrintIsolationHost.exe
    Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\KMDISCOVER2.DLL
    Report Id: f4c6c534-2073-11e6-98d7-000c29e3df68
    Faulting package full name: 
    Faulting package-relative application ID:

    get-printerdriver | where {$_.ConfigFile -like "*KMDISCOVER2*" -or $_.DependentFiles -like "*KMDISCOVER2*" -or $_.Monitor -like "*KMDISCOVER2*"}

    Name                                PrinterEnvironment MajorVersion    Manufacturer
    ----                                ------------------ ------------    ------------
    Kyocera FS-C5300DN KX               Windows x64        3               Kyocera
    Kyocera FS-3920DN KX                Windows x64        3               Kyocera
    Kyocera FS-3040MFP KX               Windows x64        3               Kyocera
    Kyocera FS-1320D KX                 Windows x64        3               Kyocera
    Kyocera FS-1300D KX                 Windows x64        3               Kyocera
    Kyocera FS-1100 KX                  Windows x64        3               Kyocera

    **************************************************************************

    Faulting application name: splwow64.exe, version: 6.2.9200.16384, time stamp: 0x50109d1a
    Faulting module name: ntdll.dll, version: 6.2.9200.21815, time stamp: 0x56eafa87
    Exception code: 0xc00000fd
    Fault offset: 0x000000000001a79d
    Faulting process id: 0x6c18
    Faulting application start time: 0x01d1b4696eacfcc1
    Faulting application path: C:\Windows\splwow64.exe
    Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
    Report Id: c34104d1-205d-11e6-98d7-000c29e3df68
    Faulting package full name: 
    Faulting package-relative application ID: 

    **************************************************************************

    Faulting application name: splwow64.exe, version: 6.2.9200.16384, time stamp: 0x50109d1a
    Faulting module name: KMUU6399.DLL, version: 6.3.9.9, time stamp: 0x55f07472
    Exception code: 0xc00000fd
    Fault offset: 0x000000000000e6cf
    Faulting process id: 0x3a5c
    Faulting application start time: 0x01d1b464d85e1164
    Faulting application path: C:\Windows\splwow64.exe
    Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\KMUU6399.DLL
    Report Id: 04297d25-2060-11e6-98d7-000c29e3df68
    Faulting package full name: 
    Faulting package-relative application ID:

    get-printerdriver | where {$_.ConfigFile -like "*KMUU6399*" -or $_.DependentFiles -like "*KMUU6399*" -or $_.Monitor -like "*KMUU6399*"}

    Name                                PrinterEnvironment MajorVersion    Manufacturer
    ----                                ------------------ ------------    ------------
    Kyocera FS-C5300DN KX               Windows x64        3               Kyocera
    Kyocera FS-3920DN KX                Windows x64        3               Kyocera
    Kyocera FS-3040MFP KX               Windows x64        3               Kyocera
    Kyocera FS-1320D KX                 Windows x64        3               Kyocera
    Kyocera FS-1300D KX                 Windows x64        3               Kyocera
    Kyocera FS-1100 KX                  Windows x64        3               Kyocera


    Monday, May 23, 2016 1:04 AM
  • I have just updated the Konica Minolta C284e to the latest driver version. KMUU6MR1.DLL is still faulting.
    Monday, May 23, 2016 1:23 AM
  • Hi Alex,

    I had to do a search on "00fd" as that's not an error code I've seen or resolvable via "net helpmsg". Unsurprisingly though, it still brings you back to the drivers being the issue. Have a read of this other thread where someone's actually gone to the trouble of debugging the application crash dump.

    The short version is you're going to want to remove those drivers (obviously the printers using them have to be removed first) entirely along with any port monitors (if there are any for that driver series). Removing the print monitor can be tricky and involve both stopping the spooler and using regedit.exe to remove the monitor entry (based on the HP monitor experience) so hopefully Kyocera handles this better.

    Make sure you get rid of the source .inf file(s) as well. You can get those from the Get-PrinterDriver commandlet as well. Here's an example:

    Get-PrinterDriver -Name "Kyocera fs*" | fl Name,InfPath

    Anyhow, the basic order of events is:

    1. Run the above commandlet to get the .inf references.
    2. Either remove the printers using these drivers or if there's a nearby alternative printer: pause the jobs, change the TCP port to the port of the nearby printer, change the driver to match the new device and cancel any jobs with a status of "printing" and resume the queue to have those queued jobs come out on the new printer. You'll likely want to have made a note of any driver custom settings from the Kyceroa drivers before doing either. The clients should detect the new driver and pull it down if it doesn't have it already.

      You can read more about print queue redirection here.
    3. Remove the print drivers. This should remove the actual driver files. Make sure it does or you can end up going in circles.
    4. If relevant, remove the print monitor(s).
    5. Ensure the .inf file(s) have been removed.
    6. Re-install the latest driver.
    7. Test it with a single test print queue and if that works fine for a few print jobs or a period of time you're happy with, re-create the original print queues (or reverse the process in point 2 if you elected to print to another queue in the interim).

    Cheers,
    Lain

    Monday, May 23, 2016 1:49 AM
  • well clearly a Kyocera driver at this point.

    Is there a hdmp file generated with the failure?  If you can send me that I will attempt to deduce what the driver is attempting when it terminates the application.

    I would absolutely remove anything in the printer settings or Ports that has to do with communication with the printer.  The discover32.dll in the name indicates something is calling out to the device.  If you can stop this, it's possible the failures will cease.

    If you can completely remove and reinstall the driver, then this might clear up the issue. 

    thanks


    Alan Morris formerly with Windows Printing Team

    • Proposed as answer by Amy Wang_ Monday, July 18, 2016 8:06 AM
    Monday, May 23, 2016 5:46 AM
    Answerer
  • Hi guys, thank you both for your help!

    Alan, is this what you mean?

    https://drive.google.com/open?id=0B8tnlqTdReZBa2R1d0NzR3ZOTWs
    Monday, May 23, 2016 9:01 PM
  • Hi Alex,

    what's the current version of this Kyocera driver?

    Seems same issue was fixed in KX Version 6.1.1118: ftp://ftp.physicon.ru/Kyocera%20FS-3040MFP/Win7/KX_611118_UPD_signed/KX%20DRIVER%206.1.1118%20Release%20Note.pdf

    KR,

    Sergey.

    Tuesday, May 24, 2016 8:58 AM
  • Hi Sergey, all of our Kyocera printers are now on 6.3.0909
    Tuesday, May 24, 2016 9:04 PM
  • I have just talked to Kyocera and they have suggested that doing the upgrade to 6.3.0909 may have left the Server 2012 Terminal Server Kyocera printers with a dual state of having different printer drivers running at the same time. Apparently updating the printer using Printer Properties | Advanced | New Driver is a great way to end up with a mix of old and new drivers.

    They have also suggested that the remote machines may be trying to call to the older drivers on the server and the terminal server is getting confused, or the RDP and/or TSPrint means that the remote machines may be using their older Kyocera printer drivers stored on the remote machines (redirected printers).

    Kyocera's suggested solution was to remove all Kyocera printer drivers on the server completely and reinstall each one. They also suggested going to each user and turning of printer sharing with the Terminal Server via RDP, which would involve writing a GPO to remove all the RDPs and rebuild them without the share printer option.

    Tuesday, May 24, 2016 10:48 PM
  • The minidump indicates that the driver suffers/suffered from an age-old problem of using an uninitialised pointer:

    BUGCHECK_STR:  APPLICATION_FAULT_NULL_CLASS_PTR_READ

    In any case, knowing this doesn't help beyond pointing out what we already knew from the outset, which is it's a driver issue.

    Have you removed all traces of the driver, including the elements I raised above?

    • Driver files.
    • Driver .inf files.
    • Driver monitors.

    Simply upgrading the driver version all-to-often has no impact on resolving these kinds of issues.

    Cheers,
    Lain


    Tuesday, May 24, 2016 10:57 PM
  • This will be done tomorrow after we migrate the Terminal Server from VMWare to Hyper-V. I'll let you know how it goes.
    Wednesday, May 25, 2016 4:52 AM
  • We have deleted every printer, removed the printer INF files using Server Properties, and all the faulting DLLs have been renamed to .old. No more errors.

    The next step will be to re-add all those printers with a direct printer connection and via the print server, which will take a day to set up correctly.
    Wednesday, May 25, 2016 11:53 PM
  • I'm trying to add the printers via the print server but I'm now getting two error messages when I try to do this:

    Error 0X000003eb
    Error 0X000005b3

    This is occurring for ALL printers.

    Thursday, May 26, 2016 3:59 AM
  • Hi Alex,

    Is there additional information in the event log relating to these errors? The error codes themselves don't provide much guidance.

    Cheers,
    Lain

    Thursday, May 26, 2016 4:09 AM
  • Oh dear, the Event Viewer is full of error messages since the Terminal Server reboot. There is an error message ~8 times a minute.

    **************************************************************************

    The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\KMUU6399.DLL, error code 0x7E. See the event user data for context information.

    Log Name: Microsoft-Windows-PrintService/Admin

    Source: PrintService

    Event ID: 808

    Keywords: Print Spooler

    OpCode: Spooler Operations Failed

    **************************************************************************

    The print spooler failed to load a plug-in module C:\Windows\system32\spool\DRIVERS\x64\3\KMUU6MR1.DLL, error code 0x7E. See the event user data for context information.

    Log Name: Microsoft-Windows-PrintService/Admin

    Source: PrintService

    Event ID: 808

    Keywords: Print Spooler

    OpCode: Spooler Operation Failed

    **************************************************************************

    Metadata staging failed, result={ABC677CE-47BA-5EFB-BD86-EC45522E569A} for container '0x80072F78'

    Log Name: Microsoft-Windows-DeviceSetupManager/Admin

    Source: DeviceSetupManager

    Event ID: 131

    Keywords:

    OpCode: Info

    **************************************************************************

    Installing printer driver Kyocera FS-C5350DN KX failed, error code 0x0, HRESULT 0x800705B3. See the event user data for context information.

    Log Name: Microsoft-Windows-PrintService/Admin

    Source: PrintService

    Event ID: 215

    Keywords: Printer Setup,Printer

    OpCode: Spooler Operation Failed

    **************************************************************************

    Group Policy was unable to add per computer connection \\DOMAIN\PRINTERNAME. Error code 0x3EB. This can occur if the name of the printer connection is incorrect, or if the print spooler cannot contact the print server.

    Log Name: Microsoft-Windows-PrintService/Admin

    Source: PrintService

    Event ID: 513

    Task Category: Routing print spooler command(s)

    Keywords: Router,Classic Spooler Event

    OpCode: Spooler Operation Failed

    Thursday, May 26, 2016 4:23 AM
  • Is the Terminal Services host also acting as a print server? If so, I'm assuming you're then adding local print queues on that server?

    Cheers,
    Lain

    Thursday, May 26, 2016 4:28 AM
  • No, the Terminal Server directly connects to the printers but doesn't share them. The SBS 2011 server is acting as a print server as it directly connects to the printers and shares them via AD.
    Thursday, May 26, 2016 4:32 AM
  • Yeah, fair enough. Once you edited your previous post it became apparent this was just a typical UNC connection. I wasn't sure based on your previous post where you mentioned re-adding the printers via a direct (which I interpreted to be a TCP/IP port) connection.

    Anyhow, I think it's going to be the same sort of issue.

    One of the things I mentioned before is that you also need to get rid of the monitors, though doing so it not always pleasant.

    On the terminal server:

    1. Make sure you've removed all the Kyocera drivers and the driver files.
    2. Next, open up regedit and navigate to: HKLM\System\CurrentControlSet\Control\Print.
    3. Export the HKLM\System\CurrentControlSet\Control\Print key so you have something to restore to if required.
    4. Check the Monitor subkey and ensure all the Kyocera print monitors have been removed. Just delete any subkey values that relate to Kyocera, though you might want to make a note of any .dll names before you do so you can ensure you've also removed the matching file.
    5. You can also check the Environments and Printers subkeys for anything Kyocera-related, but if you've already successfully removed the drivers, nothing should be in either branch.
    6. Stop the print spooler.
    7. Start the print spooler.
    8. See if you can add the driver back on. It doesn't matter whether you attempt to do so via connecting to a remote printer via UNC or as a local driver installation.

    I've mentioned it a few times now because it's important, but make sure you remove any driver or monitor files from the file system. Notably, now that we're talking about monitors, if you find the monitor driver is still in use after the spooler restarting, you'll need to reboot the terminal server to resolve the situation (I wouldn't recommend simply killing the host process in this instance).

    Cheers,
    Lain

    Thursday, May 26, 2016 4:45 AM
  • Returning the DLLs to their original name and location has allowed for me to re-add all the printers except one, but for some reason they're coming up as duplicate printers ("PRINTERNAME on DOMAIN" and "PRINTERNAME on DOMAIN.COM")
    Thursday, May 26, 2016 5:06 AM
  • Hi,

    I want to confirm with you that if this crash problem happened when the printers have been deployment in this environment? Or, any change before this problem happened? 

    I would recommend you to check the hardware compatibility(including driver) between RDS 2012 and Printer with the printer provider/supporter. Or, if any previous driver version may helpful.

    For the Pinter installation problem, also, contact the printer provider/supporter to confirm the details.

    Best Regards,
    Eve Wang

    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.


    Friday, May 27, 2016 3:30 AM
  • Thanks Alex.

    I'm not getting notifications when this thread gets updated so I missed this.  In this dump KMUU6MR1.DLL is still the culprit.  It's reading memory without first checking if the memory is valid and thus terminates the process.  It looks like the older version of the driver uses KM??6MR1 naming convention and the newer version uses the KM??6399 convention.  If you have removed the older software, then the *6MR1 files should be gone from the system.  These are all from the older driver.  

        Image path: C:\Windows\System32\spool\drivers\x64\3\KMUU6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMPE6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMFS6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMWM6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMPF6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMXL6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KM5E6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMPO6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMPS6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMRF6MR1.DLL
        Image path: C:\Windows\System32\spool\drivers\x64\3\KMRC6MR1.DLL
        Timestamp:        Mon Aug 26 12:05:18 2013 (521BA6EE)
        CheckSum:         0034CED9
        ImageSize:        00350000
        File version:     6.1.8.26
        Product version:  6.1.8.26


    Alan Morris formerly with Windows Printing Team


    Monday, May 30, 2016 6:55 PM
    Answerer
  • For future reference  x5b3 gives me the main concern.  The driver file is requesting access to session zero UI which is never a good practice.

    C:\>winerror 0x3eb
      1003 ERROR_CAN_NOT_COMPLETE

    C:\>winerror 0x5b3
      1459 ERROR_REQUIRES_INTERACTIVE_WINDOWSTATION


    Alan Morris formerly with Windows Printing Team

    Monday, May 30, 2016 6:58 PM
    Answerer
  • Hi,

    Are there any updates at the moment?

    Best Regards,

    Amy


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, June 8, 2016 8:34 AM
  • Hi Amy,

    The issue has become a mess because some of the files haven't uninstalled properly. As Alan pointed out, some of the drivers are using old files even though they should have been upgraded to the latest version.

    We have an accounting / ERP system called Greentree and it is now no longer printing correctly to the correct printers (printing out to a label printer in Greentree will go to the default TS printer instead). The official advice from Greentree is that the server that Greentree runs on (Jade) also needs to have the drivers updated to the same version as the TS. What should have been a relatively simple job ("update the printer drivers") now involves deleting and reinstalling the printer drivers on all three servers (TS, SBS and Greentree (Jade)) and even then I don't know if that will fix the issue if the drivers aren't uninstalling correctly.

    We should have this all fixed this weekend (in theory) but I won't hold my breath!

    Thursday, June 9, 2016 11:18 PM
  • Hi Alex,

    Thank you for the update and good luck!

    Best Regards,

    Amy


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, June 10, 2016 5:20 AM