locked
2008 R2 Print Spooler Cleanup RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi

    We have a problem with one of our Terminal Servers. When users log on the CPU usage shoots up to 100% for 5-10 seconds which causes serious latency for the other users on the server. We have pinned this on the process of mapping client printers from the users remote machines. If we disable this feature in the RDP client software the user logs on instantly and there is only a small peak of CPU usage. The main process that uses the CPU during this time is SVCHOST and when I check I find it is related to the Plug & Play procedure.

    The system is a mix of both Easyprint and a couple of 3rd party print drivers. I have tried to uninstall the 3rd party drivers but still have the issue when they have been removed.

    On a 2003 server there used to be a small application that cleaned the print spooler and returned it to default but there doesn't appear to be one available for 2008 R2 servers.

    Does anyone know a way to clean the spooler and return the system to a default setup so that I can rule drivers out of the issue.

     

    Many thanks in advance.

     

    Simon

     

    Thursday, September 8, 2011 3:54 PM

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I have uncovered some new information.

    Can you check how many entries are listed under hkcu\Software\Microsoft\Windows NT\CurrentVersion\Devices key for any given user?

     

    Then run the following command as the user to delete all entries, REG DELETE "hkcu\Software\Microsoft\Windows NT\CurrentVersion\Devices" /va /f

    Log off and login back as that user, do you still see the high CPU when that particular user logs in?

    This command needs to be run by all other users later on, you can put it in a user GPO to achieve this.

     

    Let me know how helpful this is.

     

     

    Sumesh P - Microsoft Online Community Support
    Tuesday, September 20, 2011 11:17 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Ok, then to continue forward we will need to get dumps and debug traces of the svchost. For that you will need to open a support incident to have a Support Professional guide you through the process and analyze the logs.

    Please visit the below link to see the various paid support options that are available to better meet your needs. http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone

     

    Just to be sure that the issue is not the one I suspected earlier, you can run a Process Monitor trace in console session when a user logs in and then analyze it to make sure that there are no excessive IO to Files or registry. Make sure the c:\windows\system32\Spool folder doesnt have orphaned .Spl or .tmp files and also exclude it in the AV.

     

    Sumesh P - Microsoft Online Community Support
    Thursday, September 22, 2011 5:56 AM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

                     

    Thank you for your question.

                     

    I am trying to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

                     

    Thank you for your understanding and support.

    Technology changes life……
    Tuesday, September 13, 2011 10:13 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Many thanks.

     

    Simon

     

    Tuesday, September 13, 2011 7:23 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Simon

    Not much use to you this, but we had exactly the same problem with a customer's 2008 R2 session host farm, and after weeks of troubleshooting our solution was to install thinprint. Works like a charm, and is far far superior to the MS easy print. I suggest you give it a bash.

     

    Dave

    dave
    Tuesday, September 13, 2011 10:41 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Thanks Dave. We've got Tricerat's Screwdrivers lined up as a possible as we use it on our larger servers but it's an expensive fix to a problem.

     

    I might take a look at ThinPrint as an alternative and compare costs if I get nowhere with this issue. Thanks for the comment though.

     

    Simon

     

    Tuesday, September 13, 2011 10:58 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    We tried screwdrivers first, but we chose thinprint, as thinprint was superior in print speed over crappy WAN RDP connections.

    Dave

    dave
    Tuesday, September 13, 2011 11:01 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The print hive cleaning app is not available for 2008 R2. What it basically does is to remove all the installed driver/queues/DLLs from the registry and file system.

    How many printers do you have on this server?

    How many users are logged into this server at any point in time?

    Was this migrated from 2003 print server or were the printers/drivers freshly installed?

    How long has this server been in production?

    these inputs might help me narrow down to the actual problem and provide further suggestions.

     

    Sumesh P - Microsoft Online Community Support
    Wednesday, September 14, 2011 8:02 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Dave - Thanks for the advice. I'll look into ThinPrint but my recollection is that it is even more expensive than Tricerat which would rule it out.

     

    Sumesh - Thanks for responding, I have put my answers to your questions below.

    How many printers do you have on this server? - There are no actual physical printers installed or connected to the server as all users are remote. We have installed some drivers into Server Properties as EasyPrint doesn't seem to work properly with some of the printers. There are a number of drivers that have also effectively installed themselves when users have logged in with alternative printers too.

    How many users are logged into this server at any point in time? - Approx 10 - 15. The issue happens under all logons though, even if it is just the Administrator with nobody else logged in.

    Was this migrated from 2003 print server or were the printers/drivers freshly installed? - No it started life as a clean build 2008 R2 server.

    How long has this server been in production? - Approx 9 months

     

    I have tried removing as much as I can from the system and registry but the problem still persists. I am getting to the point where I will have to either rebuild or go to a 3rd party print solution but feeel that is only masking the issue rather than fixing it.

     

    Many thanks

     

    Simon Whittington

     

    Wednesday, September 14, 2011 9:34 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I missed to ask if you are at 2008 RTM or SP1.

    What is the current setting of the policy: Use Terminal Services Easy Print printer driver first
    This policy setting is located in the following node of the Local Group Policy Editor:
    Computer Configuration\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Printer Redirection

    Does it continue to occur if you toggle it from the existing setting?

     

    Can you find out what services are running inside the spiking svchost using tasklist /svc? is it the one running termserv?

    How many drivers are currently listed under the print server properties on the TS?

    I will check for known hotfixes once you confirm the SP level.

     

    Sumesh P - Microsoft Online Community Support
    Thursday, September 15, 2011 8:41 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Sumesh

     

    The server is a Windows 2008 R2 Standard SP1.

     

    What is the current setting of the policy: Use Terminal Services Easy Print printer driver first. This is set to Disabled. We had issues with Easyprint when printing to some printers so we set it to disabled so that it would use some of the drivers we have installed such as the Sharp MX-2300N.

    Does it continue to occur if you toggle it from the existing setting? - I haven't tried it recently but will attempt to have a go this evening when the server is quiet.

     

    Can you find out what services are running inside the spiking svchost using tasklist /svc? is it the one running termserv? - The svchost process that consumes the CPU is associated with DCOMLaunch, PlugPlay and Power.

     

    How many drivers are currently listed under the print server properties on the TS? - There are about 24 drivers that now seem to be installed on the server. We have in fact only added a few but some seem to have appeared as users with other printers have logged in from different locations. I have attached screen grabs of them below for reference.

     

    Many thanks for the help so far.

     

    Simon

     

     

     

     

    Thursday, September 15, 2011 10:49 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Did changing Easy Print policy help?

    Please install these hotfixes for the purpose of updating the print binaries.

     

    http://support.microsoft.com/kb/2466040

    http://support.microsoft.com/kb/2493115

    http://support.microsoft.com/kb/2546651

    http://support.microsoft.com/kb/2542200

     

    Overall this sounds like an issue where we will need to do in-depth analysis possibly by capturing dumps of services taking high cpu.

    Do let me know if updating the spooler binaries does some help.

    Also check if the behavior is different when we do a clean boot using msconfig or in safe mode with networking.

     

     

    Sumesh P - Microsoft Online Community Support
    Tuesday, September 20, 2011 5:42 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I have uncovered some new information.

    Can you check how many entries are listed under hkcu\Software\Microsoft\Windows NT\CurrentVersion\Devices key for any given user?

     

    Then run the following command as the user to delete all entries, REG DELETE "hkcu\Software\Microsoft\Windows NT\CurrentVersion\Devices" /va /f

    Log off and login back as that user, do you still see the high CPU when that particular user logs in?

    This command needs to be run by all other users later on, you can put it in a user GPO to achieve this.

     

    Let me know how helpful this is.

     

     

    Sumesh P - Microsoft Online Community Support
    Tuesday, September 20, 2011 11:17 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Sumesh

     

    Many thanks for the reply. I have tried the registry edit but it doesn't appear to resolve the issue although I can only do limited testing during the working day due to the disruption it causes.

     

    I don't believe that the change to the EasyPrint policiy setting helps either but I will apply the patches out of hours and will try again.

    I will take another look this evening and report back to you.

     

    Kind regards,

     

    Simon

     

    Tuesday, September 20, 2011 1:05 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    The best way to implement the above changes is to put the command in a logoff/logon script as the key re-populates every time.

    Test the response after making the changes for all users.

    I think this should fix it.

     

     

    Sumesh P - Microsoft Online Community Support
    Wednesday, September 21, 2011 7:12 AM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Sumesh

     

    I have tried all of your suggestions and unfortunately we still have the issues. The patches were installed and I have removed the registry key but the svchost process still goes crazy when a user logs in.

     

    Regards,

     

    Simon

     

    Wednesday, September 21, 2011 11:26 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    Ok, then to continue forward we will need to get dumps and debug traces of the svchost. For that you will need to open a support incident to have a Support Professional guide you through the process and analyze the logs.

    Please visit the below link to see the various paid support options that are available to better meet your needs. http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone

     

    Just to be sure that the issue is not the one I suspected earlier, you can run a Process Monitor trace in console session when a user logs in and then analyze it to make sure that there are no excessive IO to Files or registry. Make sure the c:\windows\system32\Spool folder doesnt have orphaned .Spl or .tmp files and also exclude it in the AV.

     

    Sumesh P - Microsoft Online Community Support
    Thursday, September 22, 2011 5:56 AM