Spooler Subsystem App Stopped Working

[Miscbrah]

Hi folks, read a few similar topics through Google, and also one HERE which all refer to the same issue on desktop machines, where it seems bad enough, but this is happening on my one-and-only server here and it's going to be absolutely mad to bin all the drivers and then reinstall.

 

Has anyone seen this before or am I just doomed to a late night binning and reinstalling all the print drivers?? :/

 

Thanks for any help.

[bossman]

@Miscbrah:

 

What printers do you have?

 

Just need to verify something first before I go ahead with advice,

[Miscbrah]

Hi, I've got some HP OfficeJet 6000n, Brother HL-4570cdw and Brother HL-5250dn printers.

[sparkeh]

Been having that a bit recently myself.

For us its one of two things

 

1) Print driver had become corrupt so can be solved by a reinstall. The server event logs can tell you what file is misbehaving and sometimes you can just replace the bad file.

2) Something weird is in the print queue, clear it manually and restart the spooler service on the server.

 

You can prevent one printer taking down the whole server by setting the print drivers to isolation mode, worked great for us until we got PaperCut which requires you to turn off isolation

[Miscbrah]

Sparkeh thanks for that, I'll give that isolation a try. We have PaperCut here (I say 'we' this is an emergency callout and not my regular network) but it's poorly implemented and to be honest people would rather just get printing now I think than relish in its feature-rich confusion. Is there an easy way to just stop PaperCut network-wide from doing or interfering with anything, and then set the printers into isolation mode?

 

Thanks again.

[sparkeh]

Hmm not sure if there is a quick way to take PC out of the loop. I'll have a look in the morning.

[SYNACK]

Sparkeh thanks for that, I'll give that isolation a try. We have PaperCut here (I say 'we' this is an emergency callout and not my regular network) but it's poorly implemented and to be honest people would rather just get printing now I think than relish in its feature-rich confusion. Is there an easy way to just stop PaperCut network-wide from doing or interfering with anything, and then set the printers into isolation mode?

 

Thanks again.

 

Maybe this Chapter7.Advanced Printer Management

[Miscbrah]

Hmmm, it may be more complex yet simpler than I thought.

 

Right, the logs say the photocopier (shared as network printer) is doing the dirty with regards to crashing the spooler BUT now a shared printer (shared twice as different printers, one for b/w and one for colour jobs. Appears as two devices under Devices and Printers on server and on clients. Got that one? No? Good! lol) is doing the same thing to the poor server's spooler (well, both shares are.)

 

What FURTHER complicates the issue is that at some point in the past some of the clients on the network have had these printers added as local printers on an IP address rather than shared on the server which has been maddening. Like I mentioned I'm on an emergency bailout visit and this isn't my network.

 

What FURTHER FURTHER complicated things was people reporting on some newly-imaged Win7 machines "my printer isn't working" when what they ACTUALLY meant was "my printer prompts me for a username and password" so Point and Print restrictions still on default. ARGH!

 

With all that in mind, some people who have these printers mapped on server shares are still able to print. I'm going to do the follwing (for the sake of anyone helping me out or anyone googling this in the future:)

 

- Remove Advanced Printing Features from each of the troublesome printers, manually restarting the print spooler each time it falls over. This I believe spools jobs on the clients.

- If no joy, bin the two (three) troublesome ones and the drivers, then reinstall and re-share. Can rename shares if I need as they're mapped through a script.

 

Anyone feeling me on those two?

[SYNACK]

Printer drivers are the devil, make sure you have the latest as bad drivers will kill the spooler all the time, use generics if you have to and can get away with it, this is where I actually liked the HP universal ones as they were stable - Minolta are the opposite btw. Old drivers also can try installing as type one non-isolatable ones too where as the newer ones are usually at least type three.

 

Schedule a task if you have to cycle the spooler every hour or so - you'll need to kill then restart papercut services first in the task otherwise it won't work. We had to do this for six months thanks to leaking memory from Brother drivers.

 

Also look at removing old or uneeded drivers from the server because despite the fact they are supposed to be separate they can interfere with each other - Ricoh drivers had this habit.

[Miscbrah]

Cheers, okay NEXT thing going nuts is the UAC in Server 2008 (non-R2). Think I'll open a separate thread for that...

[Miscbrah]

Hmmm this is still crashing the spooler. All the troublesome drivers deleted from the drivers section of the print management. Had to keep BATTERING the spooler with restarts each time so it held up long enough to delete the drivers. I couldn't remove the driver packages through the options though as the spooler simply wouldn't stay up long enough to do so.

 

Can anyone help me out even now? Still have a few printers left in there but the spooler's falling over every few seconds.

[sparkeh]

Ok, you can go nuclear by deleting the printers from the registry: HKEY_LOCAL MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers

[Miscbrah]

Ta Sparkeh. They're not there under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers anymore. Just the ones I've got left that previously were no trouble and a couple that aren't named/appearing under Print Management with "CSR|" infront of them.

 

Spooler still craps out every few seconds.

 

Bounce in order? Anything else good to do? I'd be so stuck - thanks folks for all the help.

[SYNACK]

Check for custom print providers and ports in that same area of the reg, had a mimaki cutter that used to shred the spooler on start thanks to dodgyness in one of those, back up the key first of course. Edited November 5, 2013 by SYNACK

[Miscbrah]

Ta Synack. You might have to spell that out for me a bit, not too sure what I'd be looking for in there.

[SYNACK]

Found, this should help

Print Spooler Crash Troubleshooting Steps - PERFGURU - Site Home - TechNet Blogs

Registry entries for printing

[Miscbrah]

Thanks, that first article's super. I can't keep the spooler up long enough to change ports over though, and no ports are listed on any of the network printers shared out form this server. Also not 100% sure I'm doing everything I should be as even that article's a bit over my head.

 

If I bin ALL the printers and re-share them correctly, reinstall drivers, and use standard TCP/IP ports am I likely to encounter the same problem over again?

[SYNACK]

Thanks, that first article's super. I can't keep the spooler up long enough to change ports over though, and no ports are listed on any of the network printers shared out form this server. Also not 100% sure I'm doing everything I should be as even that article's a bit over my head.

 

If I bin ALL the printers and re-share them correctly, reinstall drivers, and use standard TCP/IP ports am I likely to encounter the same problem over again?

Hopefully not but if you remake them you have the chance to do it one by one and narrow the fault down. Still a fresh spooler with fresh printers and drivers is much more likely to stay running.

 

I'd flush everything non standard and try getting the spooler running then recreate, as long as you back up the reg keys as you kill them you can always put them back.

Edited November 5, 2013 by SYNACK

[Miscbrah]

Okay, just so I've got this right I'm going to maybe need a bit more spoon-feeding.

 

Been into Print Management and binned everything in there including the software printers you get with Office.

 

Now in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors the default ones are listed in the article as:

 

AppleTalk Printing Devices

BJ Language Monitor

Local Port

LPR Port

PJL Language Monitor

Standard TCP/IP Port

USB Monitor

Windows NT Fax Monitor

 

So delete anything from there that isn't on that list, though likely wise to back up that whole monitors section to a .reg entirely beforehand. That sounding right?

[SYNACK]

Yes, sounds right, those moniters try to talk to the primers constantly, if one is out of wack it can easily kill the spooler.

[Miscbrah]

The sodding spooler's still crashing and all I've got in there now are:

 

Local Port

PJL Language Monitor

Standard TCP/IP Port

USB Monitor

 

Which were the only ones I had off the list. Only option I can think of now is just let it fail, quit printing off this server and VM a new print server.

 

Think I've got any other options? :/

[sparkeh]

Is the event viewer not telling you why its falling over?

[mac_shinobi]

Just wondering if it is HP Printer Drivers that are causing the spooler to crash as I remember a number of other threads on EG where HP Print Drivers were causing issues and they have had to use a different HP Driver to get the HP Printers to work without crashing the spooler on the server

 

Only reason I say this is I can see in your list of monitors it states PJL Language Monitor which I think is related to HP ??

[Miscbrah]

Is the event viewer not telling you why its falling over?

 

No great help there. I get from Syslog:

 

The Print Spooler service terminated unexpectedly. It has done this 224 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

 

And from Applog:

 

Faulting application spoolsv.exe, version 6.0.6002.18294, time stamp 0x4c6a9898, faulting module msvcrt.dll, version 7.0.6002.18551, time stamp 0x4ee8cc5a, exception code 0xc00000fd, fault offset 0x0000b824, process id 0x17a0, application start time 0x01ceda350ce6cacd.

[sparkeh]

Yay for event log :/

 

Oh one thing to check, is there anything currently in the spool folder (C:\windows\system32\spool\printers)?

Couple of week ago I had a printer that was spewing nonsense into that spooler and crashed it everytime I tried to start it. Turning bad printer off, clearing spooler folder, restarting spooler fixed it.