none
Windows Server 2008 R2 Print spooler crashes continually

    Question

  • My print spooler started crashing a few days ago. This is a windows Remote Destop server. The print spooler crashes whether any users are logged in or not. I start it & as soon as I open devices & printers, it crashes or if I try to add a printer right after starting the spooler. I have tried to manually remove all references to the printers from the registry & have cleaned out the c:\windows\system32\spool\printers & drivers folders. (I have made a backup of the drivers folder just in case). I get the following logged in my error logs:

     System Log:

    Log Name:      System
    Source:        Service Control Manager
    Date:          2/25/2011 8:06:37 AM
    Event ID:      7034
    Task Category: None
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     
    Description:
    The Print Spooler service terminated unexpectedly.  It has done this 16 time(s).
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
        <EventID Qualifiers="49152">7034</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>0</Task>
        <Opcode>0</Opcode>
        <Keywords>0x8080000000000000</Keywords>
        <TimeCreated SystemTime="2011-02-25T15:06:37.327281000Z" />
        <EventRecordID>198034</EventRecordID>
        <Correlation />
        <Execution ProcessID="576" ThreadID="35068" />
        <Channel>System</Channel>
        <Computer></Computer>
        <Security />
      </System>
      <EventData>
        <Data Name="param1">Print Spooler</Data>
        <Data Name="param2">16</Data>
      </EventData>
    </Event>

    Application Log:

    Log Name:      Application
    Source:        Application Error
    Date:          2/25/2011 8:06:37 AM
    Event ID:      1000
    Task Category: (100)
    Level:         Error
    Keywords:      Classic
    User:          N/A
    Computer:     

    Description:
    Faulting application name: spoolsv.exe, version: 6.1.7600.16661, time stamp: 0x4c6f61fe
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0xc0000005
    Fault offset: 0x000000000004002e
    Faulting process id: 0x8d70
    Faulting application start time: 0x01cbd4fd96ffa8da
    Faulting application path: C:\Windows\System32\spoolsv.exe
    Faulting module path: unknown
    Report Id: d6d2ccda-40f0-11e0-860d-0026b94fd4f5
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Application Error" />
        <EventID Qualifiers="0">1000</EventID>
        <Level>2</Level>
        <Task>100</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-02-25T15:06:37.000000000Z" />
        <EventRecordID>134402</EventRecordID>
        <Channel>Application</Channel>
        <Computer></Computer>
        <Security />
      </System>
      <EventData>
        <Data>spoolsv.exe</Data>
        <Data>6.1.7600.16661</Data>
        <Data>4c6f61fe</Data>
        <Data>unknown</Data>
        <Data>0.0.0.0</Data>
        <Data>00000000</Data>
        <Data>c0000005</Data>
        <Data>000000000004002e</Data>
        <Data>8d70</Data>
        <Data>01cbd4fd96ffa8da</Data>
        <Data>C:\Windows\System32\spoolsv.exe</Data>
        <Data>unknown</Data>
        <Data>d6d2ccda-40f0-11e0-860d-0026b94fd4f5</Data>
      </EventData>
    </Event>

    Log Name:      Application
    Source:        Windows Error Reporting
    Date:          2/25/2011 8:06:37 AM
    Event ID:      1001
    Task Category: None
    Level:         Information
    Keywords:      Classic
    User:          N/A
    Computer:      h9rds1.hiway9.com
    Description:
    Fault bucket , type 0
    Event Name: BEX64
    Response: Not available
    Cab Id: 0

    Problem signature:
    P1: spoolsv.exe
    P2: 6.1.7600.16661
    P3: 4c6f61fe
    P4: StackHash_d742
    P5: 0.0.0.0
    P6: 00000000
    P7: 000000000004002e
    P8: c0000005
    P9: 0000000000000008
    P10:

    Attached files:

    These files may be available here:
    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spoolsv.exe_25ff8a8bc662b6168d0ea662ffd4f73f0a6be_1fd68c7b

    Analysis symbol:
    Rechecking for solution: 0
    Report Id: d6d2ccda-40f0-11e0-860d-0026b94fd4f5
    Report Status: 4
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Windows Error Reporting" />
        <EventID Qualifiers="0">1001</EventID>
        <Level>4</Level>
        <Task>0</Task>
        <Keywords>0x80000000000000</Keywords>
        <TimeCreated SystemTime="2011-02-25T15:06:37.000000000Z" />
        <EventRecordID>134403</EventRecordID>
        <Channel>Application</Channel>
        <Computer></Computer>
        <Security />
      </System>
      <EventData>
        <Data>
        </Data>
        <Data>0</Data>
        <Data>BEX64</Data>
        <Data>Not available</Data>
        <Data>0</Data>
        <Data>spoolsv.exe</Data>
        <Data>6.1.7600.16661</Data>
        <Data>4c6f61fe</Data>
        <Data>StackHash_d742</Data>
        <Data>0.0.0.0</Data>
        <Data>00000000</Data>
        <Data>000000000004002e</Data>
        <Data>c0000005</Data>
        <Data>0000000000000008</Data>
        <Data>
        </Data>
        <Data>
        </Data>
        <Data>C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_spoolsv.exe_25ff8a8bc662b6168d0ea662ffd4f73f0a6be_1fd68c7b</Data>
        <Data>
        </Data>
        <Data>0</Data>
        <Data>d6d2ccda-40f0-11e0-860d-0026b94fd4f5</Data>
        <Data>4</Data>
      </EventData>
    </Event>

    Report referenced in app log:

    Version=1
    EventType=BEX64
    EventTime=129431199804742810
    ReportType=2
    Consent=1
    UploadTime=129431199957442810
    ReportIdentifier=cccd570b-40f0-11e0-860d-0026b94fd4f5
    IntegratorReportIdentifier=cccd570a-40f0-11e0-860d-0026b94fd4f5
    Response.BucketId=1742207582
    Response.BucketTable=5
    Response.type=4
    Sig[0].Name=Application Name
    Sig[0].Value=spoolsv.exe
    Sig[1].Name=Application Version
    Sig[1].Value=6.1.7600.16661
    Sig[2].Name=Application Timestamp
    Sig[2].Value=4c6f61fe
    Sig[3].Name=Fault Module Name
    Sig[3].Value=StackHash_d742
    Sig[4].Name=Fault Module Version
    Sig[4].Value=0.0.0.0
    Sig[5].Name=Fault Module Timestamp
    Sig[5].Value=00000000
    Sig[6].Name=Exception Offset
    Sig[6].Value=000000000004002e
    Sig[7].Name=Exception Code
    Sig[7].Value=c0000005
    Sig[8].Name=Exception Data
    Sig[8].Value=0000000000000008
    DynamicSig[1].Name=OS Version
    DynamicSig[1].Value=6.1.7600.2.0.0.16.7
    DynamicSig[2].Name=Locale ID
    DynamicSig[2].Value=1033
    DynamicSig[22].Name=Additional Information 1
    DynamicSig[22].Value=d742
    DynamicSig[23].Name=Additional Information 2
    DynamicSig[23].Value=d7425510c1673ee6d06709e17f4207fc
    DynamicSig[24].Name=Additional Information 3
    DynamicSig[24].Value=6224
    DynamicSig[25].Name=Additional Information 4
    DynamicSig[25].Value=6224f6989f9bddc3261c3448122d3ffd
    UI[2]=C:\Windows\System32\spoolsv.exe
    UI[5]=Check online for a solution (recommended)
    UI[6]=Check for a solution later (recommended)
    UI[7]=Close
    UI[8]=Spooler SubSystem App stopped working and was closed
    UI[9]=A problem caused the application to stop working correctly. Windows will notify you if a solution is available.
    UI[10]=&Close
    LoadedModule[0]=C:\Windows\System32\spoolsv.exe
    LoadedModule[1]=C:\Windows\SYSTEM32\ntdll.dll
    LoadedModule[2]=C:\Windows\system32\kernel32.dll
    LoadedModule[3]=C:\Windows\system32\KERNELBASE.dll
    LoadedModule[4]=C:\Windows\system32\msvcrt.dll
    LoadedModule[5]=C:\Windows\SYSTEM32\sechost.dll
    LoadedModule[6]=C:\Windows\system32\RPCRT4.dll
    LoadedModule[7]=C:\Windows\system32\USER32.dll
    LoadedModule[8]=C:\Windows\system32\GDI32.dll
    LoadedModule[9]=C:\Windows\system32\LPK.dll
    LoadedModule[10]=C:\Windows\system32\USP10.dll
    LoadedModule[11]=C:\Windows\System32\POWRPROF.dll
    LoadedModule[12]=C:\Windows\system32\SETUPAPI.dll
    LoadedModule[13]=C:\Windows\system32\CFGMGR32.dll
    LoadedModule[14]=C:\Windows\system32\ADVAPI32.dll
    LoadedModule[15]=C:\Windows\system32\OLEAUT32.dll
    LoadedModule[16]=C:\Windows\system32\ole32.dll
    LoadedModule[17]=C:\Windows\system32\DEVOBJ.dll
    LoadedModule[18]=C:\Windows\System32\DNSAPI.dll
    LoadedModule[19]=C:\Windows\system32\WS2_32.dll
    LoadedModule[20]=C:\Windows\system32\NSI.dll
    LoadedModule[21]=C:\Windows\system32\IMM32.DLL
    LoadedModule[22]=C:\Windows\system32\MSCTF.dll
    LoadedModule[23]=C:\Windows\System32\avgrssta.dll
    LoadedModule[24]=C:\Windows\System32\CRYPTBASE.dll
    LoadedModule[25]=C:\Windows\System32\slc.dll
    LoadedModule[26]=C:\Windows\System32\RpcRtRemote.dll
    LoadedModule[27]=C:\Windows\System32\secur32.dll
    LoadedModule[28]=C:\Windows\System32\SSPICLI.DLL
    LoadedModule[29]=C:\Windows\System32\credssp.dll
    LoadedModule[30]=C:\Windows\System32\clusapi.dll
    LoadedModule[31]=C:\Windows\System32\cryptdll.dll
    LoadedModule[32]=C:\Windows\System32\IPHLPAPI.DLL
    LoadedModule[33]=C:\Windows\System32\WINNSI.DLL
    LoadedModule[34]=C:\Windows\system32\mswsock.dll
    LoadedModule[35]=C:\Windows\System32\wshtcpip.dll
    LoadedModule[36]=C:\Windows\System32\wship6.dll
    LoadedModule[37]=C:\Windows\System32\rasadhlp.dll
    LoadedModule[38]=C:\Windows\System32\fwpuclnt.dll
    LoadedModule[39]=C:\Windows\System32\localspl.dll
    LoadedModule[40]=C:\Windows\System32\SPOOLSS.DLL
    LoadedModule[41]=C:\Windows\System32\srvcli.dll
    LoadedModule[42]=C:\Windows\system32\winspool.drv
    LoadedModule[43]=C:\Windows\System32\PrintIsolationProxy.dll
    LoadedModule[44]=C:\Windows\System32\cpwmon64.dll
    LoadedModule[45]=C:\Windows\system32\SHLWAPI.dll
    LoadedModule[46]=C:\Windows\System32\ZLM1319.DLL
    LoadedModule[47]=C:\Windows\System32\HPMPW081.DLL
    LoadedModule[48]=C:\Windows\System32\VERSION.dll
    LoadedModule[49]=C:\Windows\System32\HPMPM081.DLL
    LoadedModule[50]=C:\Windows\System32\USERENV.dll
    LoadedModule[51]=C:\Windows\System32\profapi.dll
    LoadedModule[52]=C:\Windows\System32\hppmopjl.dll
    LoadedModule[53]=C:\Windows\System32\hpz3lw71.dll
    LoadedModule[54]=C:\Windows\System32\hpz3lw72.dll
    LoadedModule[55]=C:\Windows\System32\rc4mon64.dll
    LoadedModule[56]=C:\Windows\System32\tcpmon.dll
    LoadedModule[57]=C:\Windows\System32\snmpapi.dll
    LoadedModule[58]=C:\Windows\System32\wsnmp32.dll
    LoadedModule[59]=C:\Windows\system32\CLBCatQ.DLL
    LoadedModule[60]=C:\Windows\System32\msxml6.dll
    LoadedModule[61]=C:\Windows\System32\usbmon.dll
    LoadedModule[62]=C:\Windows\system32\wls0wndh.dll
    LoadedModule[63]=C:\Windows\system32\WINTRUST.dll
    LoadedModule[64]=C:\Windows\system32\CRYPT32.dll
    LoadedModule[65]=C:\Windows\system32\MSASN1.dll
    LoadedModule[66]=C:\Windows\System32\WSDMon.dll
    LoadedModule[67]=C:\Windows\System32\wsdapi.dll
    LoadedModule[68]=C:\Windows\System32\webservices.dll
    LoadedModule[69]=C:\Windows\System32\FirewallAPI.dll
    LoadedModule[70]=C:\Windows\system32\FunDisc.dll
    LoadedModule[71]=C:\Windows\system32\ATL.DLL
    LoadedModule[72]=C:\Windows\system32\fdPnp.dll
    LoadedModule[73]=C:\Windows\system32\spool\PRTPROCS\x64\winprint.dll
    LoadedModule[74]=C:\Windows\System32\GPAPI.dll
    LoadedModule[75]=C:\Windows\system32\spool\PRTPROCS\x64\hpcpp094.dll
    State[0].Key=Transport.DoneStage1
    State[0].Value=1
    State[1].Key=DataRequest
    State[1].Value=iData=1/nDumpFile=//Upload//iCab//783FFB3921C242F3BD9226727CD919CF.cab/nDumpServer=watson110.watson.microsoft.com/nResponseServer=watson110.watson.microsoft.com/nResponseURL=//dw//GenericFour.asp?iBucket=1742207582&szCab=783FFB3921C242F3BD9226727CD919CF.cab&EventType=BEX64&MID=5685F2F4-D91B-4EEE-BD3F-D7F46F79B12D/nMemoryDump=1/nBucket=1742207582/nBucketTable=5/nResponse=1/n
    FriendlyEventName=Stopped working
    ConsentKey=BEX64
    AppName=Spooler SubSystem App
    AppPath=C:\Windows\System32\spoolsv.exe

    Any help would be appreciated.

    My network print server is also a windows server 2008 R2 Machine & is functioning normally, the issue is only with the Remote Desktop Server. I have not added any new drivers in the last 6 months. All drivers are installed as network drivers & are pulled from the print server (Not installed independantly) to insure I have the same drivers on both machines. Any Clients that have mapped printers are forced to use the Windows Easy print driver via Group Policy.

    Friday, February 25, 2011 3:47 PM

Answers

  • Enable Print driver isolation.  It sounds like the print drivers are causing memory corruption in the spoolsv.exe process.  You want to set the policy so all print drivers run outside the spoolsv.exe process.

    http://blogs.technet.com/b/askperf/archive/2009/10/08/windows-7-windows-server-2008-r2-print-driver-isolation.aspx

  • Override Print Driver Execution Compatibility Setting Reported by Print Driver – again, there are two settings
    • Enabled  - Forces drivers flagged as incompatible with PDI to run in “shared” mode
    • Disabled or Not Configured – whatever isolation compatibility advertised in the .inf file for the driver is honored

    It looks like you have several HP drivers installing on the TS server including an older version of HP Universal driver.  I would first attempt to remove the Zenographics print driver for one of the HP printers.

    LoadedModule[44]=C:\Windows\System32\cpwmon64.dll
    LoadedModule[46]=C:\Windows\System32\ZLM1319.DLL
    LoadedModule[47]=C:\Windows\System32\HPMPW081.DLL
    LoadedModule[49]=C:\Windows\System32\HPMPM081.DLL
    LoadedModule[51]=C:\Windows\System32\profapi.dll
    LoadedModule[52]=C:\Windows\System32\hppmopjl.dll
    LoadedModule[53]=C:\Windows\System32\hpz3lw71.dll
    LoadedModule[54]=C:\Windows\System32\hpz3lw72.dll
    LoadedModule[55]=C:\Windows\System32\rc4mon64.dll
    LoadedModule[75]=C:\Windows\system32\spool\PRTPROCS\x64\hpcpp094.dll


  • Alan Morris Windows Printing Team
Sunday, February 27, 2011 2:20 AM
Answerer

All replies

  • I am re-installing windows on the affected server - seems like my only other option at this point
    Saturday, February 26, 2011 7:16 PM
  • Enable Print driver isolation.  It sounds like the print drivers are causing memory corruption in the spoolsv.exe process.  You want to set the policy so all print drivers run outside the spoolsv.exe process.

    http://blogs.technet.com/b/askperf/archive/2009/10/08/windows-7-windows-server-2008-r2-print-driver-isolation.aspx

  • Override Print Driver Execution Compatibility Setting Reported by Print Driver – again, there are two settings
    • Enabled  - Forces drivers flagged as incompatible with PDI to run in “shared” mode
    • Disabled or Not Configured – whatever isolation compatibility advertised in the .inf file for the driver is honored

    It looks like you have several HP drivers installing on the TS server including an older version of HP Universal driver.  I would first attempt to remove the Zenographics print driver for one of the HP printers.

    LoadedModule[44]=C:\Windows\System32\cpwmon64.dll
    LoadedModule[46]=C:\Windows\System32\ZLM1319.DLL
    LoadedModule[47]=C:\Windows\System32\HPMPW081.DLL
    LoadedModule[49]=C:\Windows\System32\HPMPM081.DLL
    LoadedModule[51]=C:\Windows\System32\profapi.dll
    LoadedModule[52]=C:\Windows\System32\hppmopjl.dll
    LoadedModule[53]=C:\Windows\System32\hpz3lw71.dll
    LoadedModule[54]=C:\Windows\System32\hpz3lw72.dll
    LoadedModule[55]=C:\Windows\System32\rc4mon64.dll
    LoadedModule[75]=C:\Windows\system32\spool\PRTPROCS\x64\hpcpp094.dll


  • Alan Morris Windows Printing Team
Sunday, February 27, 2011 2:20 AM
Answerer
  • Hi,

    Thanks for the post.

    Please note, we may have to analyze memory dump file to narrow down the cause of this issue, forum is not the best place for analyzing dump. It’s suggested to contact Microsoft Customer Support Services (CSS) so that a dedicated Support Professional can help you on this issue.

    To obtain the phone numbers for specific technology request please take a look at the web site listed below.
    http://support.microsoft.com/default.aspx?scid=fh;EN-US;PHONENUMBERS

    If you are outside the US please see http://support.microsoft.com for regional support phone numbers.

    Thanks,

    Miles 


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    Monday, February 28, 2011 9:00 AM
    Moderator
  • I'm am starting to see a very similar issue.   Clients using Easy Print.  RDS server 2008 R2.   If I remove the winprint.dll print processor the spooler will run and I can use any local printer not needing winprint.   Remote desktops however needs winprint.

    This had been working fine until recently.  We have started adding some Windows 7 SP1 clients into the fold so i'm wondering if this has brought on the issue. NDFOESIER, Are you having the similar issue with winprint?  Just delete the winprint.dll file from windows\system32\spool\prtprocs\x64, and see if the Print Spooler will run.  Do you have any Win7 SP1 clients?

     

    Thanks,

    ~Tyler

    Monday, February 28, 2011 8:06 PM
  • I see Event ID 1124 right about the time this problem happened. It shows that the limit of printer sessions was reached causing the print queue to fail. Everything was working fine the day before until we introduced about 4 more clients with Remote Apps. I'm wondering if the TS server couldn't handle all the print queue's request at once. I do see that there is a registry fix for this which allows you to increase the number of printer sessions on the TS server.

    See the following article.

    http://technet.microsoft.com/en-us/library/cc727415(WS.10).aspx

    Tuesday, March 1, 2011 1:11 PM