TechSpot

Spooler service stopping automatically

By sumeshmd
Aug 13, 2009
Topic Status:
Not open for further replies.
  1. hello all,

    i have a strage problem with my windows 2003 server spooler service.it keeps on crashing randomly.this is my print server also. so i have to start this service manually in all the time.at first it was logging this error in event viewer
    "Faulting application spoolsv.exe, version 5.2.3790.3959, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp."

    then,this info by Dr.Watson.

    "The application, C:\WINDOWS\system32\spoolsv.exe, generated an application error The error occurred on 08/13/2009 @ 14:59:48.599 The exception generated was c0000005 at address 00000000 (<nosymbols>)

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp."

    then i restarted the server and now it is not logging any error, but keeps on crashing.
    if anybody can help me in this greatly appreciated.
    thanks in advance
    sumesh
  2. raybay

    raybay TechSpot Evangelist Posts: 10,716   +6

    How old is the hard drive? How much use has it had? You might want to run the S.M.A.R.T. test from the website of the drive manufacturer (unless it is a Tri-Gem or Toshiba which do not have one.
    Remember that S.M.A.R.T. evaluations of hard drives have a 11% error rate... for bad ones reported good.
  3. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    thanks for the quick reply.

    but, my server is hp proliant which is less than 1 year old and having SCSI hard disk. i dont think there is problem with hard drive.
  4. jobeard

    jobeard TS Ambassador Posts: 13,356   +302

    I don't think so either. the The exception generated was c0000005 at address 00000000 is a programming error, not a disk error.

    Recommend you ensure all win2003 fixes and Service Packs be applied.

    There is a small possibility of a known attack on the Spooler ...
  5. Placebos

    Placebos Newcomer, in training Posts: 42

    Can a printer driver cause this error? I know that some HP drivers can cause XP spooler services to crash when you try to add the printer.

    Best of luck,
  6. LookinAround

    LookinAround TechSpot Chancellor Posts: 8,366   +167

    I agree with jobeard...

    1) Far less likely of it being related to errors with the hard drive itself
    2) Make certain all Windows Updates (including all hardware optional updates) have been applied (keep running Windows updates Custom until it comes back saying "No more updates)
    3) Run a thorough virus scan

    And if problem persists, here's a trick i've found sometimes helped verify spoolsv.exe corruption or virus issues in the past...
    Download HashTab.

    Go to file C:\WINDOWS\system32\spoolsv.exe, rt click Properties, then File Hashes tab. Then copy/paste the MD5 hash value that appears.
  7. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    thank you all for the help. i have scanned with mcafee and mbam. but no virus found. also have updated all the patches. let me try with hash tab.i will give the details after that

    thanks
  8. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    This might help you:
    That would be a Yes. See below.

    1)This error can be caused by a problem with the print driver.The file is located here: The file is located in C:\Window\System32 folder.
    Location should be verified as malware can 'assume' just about any process name.

    2)A common cause of this error can be when the printer spooler folder (buffer) is filled up with unwanted files. You can fix this problem by following the steps listed below:

    • [1] Go to Start> Run> type in services.msc.
      [2] Right-click on Print Spooler and then select Stop.
      [3] After you have stopped this process, leave the Service window open.
      [4}Now open My Computer and navigate to the following folder using Windows Explorer:
      Right click on Start> Explore> Windows> System 32>
    • c:\windows\system32\spool\PRINTERS - in Windows Vista, XP, 98/95/ME
      or
    • c:\winnt\system32\spool\PRINTERS - in Windows NT\2000
      [5] Delete all the files in the Printers folder.
      [6] Go back to Services window> right-click on Print Spooler> set Startup Type to Automatic> Start the Service.

    spoolsv.exe starts the Print Spooler Service. This Service should be set to Automatic. It has one Dependency, which should also be set to Automatic: RPC- Remote Procedure Call (not the RPC Locator, just the RPC)

    If the Print buffer is full, you may notice the spoolsv.exe running hot (hi CPU) in the Task Manager.
  9. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    thanks again

    this is the MD5 hash value "042F246C668FB17F884E90A1EFBDA443".

    and bobbye, there is nothing in my printers folder to delete..
  10. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    The thing about troubleshooting is that you have to start somewhere. We have eliminated one possible cause for this error.

    Give this one a try:
    A detailed description of the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2, Windows XP Tablet PC Edition 2005, and Windows Server 2003
    http://support.microsoft.com/default.aspx?scid=kb;en-us;875352

    DEP configuration for the system is controlled through switches in the Boot.ini file. During installation of Windows XP SP2 and Windows Server 2003 SP1 or later versions, the OptIn policy level is enabled by default.

    Since you are getting the Access Violation c0000005, it is most likely that the Policy needs to be changed.

    Please see the sections for resetting this policy on the Microsoft site that has been referenced.
    unless a different policy level is specified in an unattended installation.
  11. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    thanks bobbye..

    i have disabled spool subsystem in DEP. let me see whether it is crashing again..
    one more thing i have noticed is that if i didnt go to the printers folder it is not crashing. whenever i open the printers folder and refresh it, that time only this crashing is happening.so may be any of the printer driver is causing the problem. is there anyway to find out which is that driver?
     
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Can you please explain what you mean here?
    How or why are you trying to 'refresh' the printer folder?
  13. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    hi,

    i am doing it by going to the printers and fax folder and then right click and refresh.
    doing it because some printers appears as "unable to connect".when i "refresh" it will turn to "ready".
  14. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    You need to stop using refresh and find out what the problem is! Next time the printer doesn't connect, don't do refresh- look at the computer cloce, then go to event Viewer:

    Start> Run> type in eventvwr

    Do this on each the System and the Applications logs:

    • [1]. Click to open the log>
      [2]. Look for the Error>
      [3] .Right click on the Error> Properties>
      [4]. Click on Copy button, top right, below the down arrow >
      [5]. Paste here (Ctrl V)
      [6].NOTES
    • You can ignore Warnings and Information Events.
    • If you have a recurring Error with same ID#, same Source and same Description, only one copy is needed.
    • You don't need to include the lines of code in the box below the Description, if any.
    • Please do not copy the entire Event log.

    Errors are time coded. Check the computer clock at time of failed connect.
  15. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    ok.this is error
    1
    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1030
    Date: 18/08/2009
    Time: 03:11:41
    User: NT AUTHORITY\SYSTEM
    Computer: SERVER
    Description:
    Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    2
    Event Type: Error
    Event Source: Userenv
    Event Category: None
    Event ID: 1058
    Date: 18/08/2009
    Time: 03:11:41
    User: NT AUTHORITY\SYSTEM
    Computer: SERVER
    Description:
    Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=domain,DC=local. The file must be present at the location <\\domain.local\sysvol\domain.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied. ). Group Policy processing aborted.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
  16. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    this is in system log

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7031
    Date: 18/08/2009
    Time: 09:01:20
    User: N/A
    Computer: SERVER
    Description:
    The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    2

    Event Type: Error
    Event Source: Print
    Event Category: None
    Event ID: 51
    Date: 18/08/2009
    Time: 03:15:01
    User: NT AUTHORITY\SYSTEM
    Computer: SERVER
    Description:
    PrintQueue LDAP://CN=BILALPC-BILAL_HP,CN=BILALPC,OU=workstations,DC=domain,DC=local could not be pruned. Error: 80070005.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
  17. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    i have run the "sc query spooler" and this is the result

    SERVICE_NAME: spooler
    TYPE : 110 WIN32_OWN_PROCESS (interactive)
    STATE : 4 RUNNING
    (STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
    WIN32_EXIT_CODE : 0 (0x0)
    SERVICE_EXIT_CODE : 0 (0x0)
    CHECKPOINT : 0x0
    WAIT_HINT : 0x0
  18. raybay

    raybay TechSpot Evangelist Posts: 10,716   +6

    You have not reported the brand and model of printer, and how it is connected to the server. We need to know more, including brands, models, age.
    This is usually a hard error somewhere...
    Most commonly found in many Epson, Brother, Konica Minolta, and some HP Laser printers.
    If you have uninstalled and reinstalled the printer software, your printer is likely toast.
    If less than a year old, the printer company warranty will provide you with a refurbished replacement.
    Otherwise you have to replace the printer system board (easy to do but hard to get... and expensive) or replace the printer.
  19. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Good job! Now we're cooking!

    Events 1030 and 1058 can be handled together:

    Conservative (easiest) approach- try this first:
    Start> Run> cmd> run the following command:

    netsh winsock reset

    You must reboot the server to complete the reset of the TCP/IP stack.

    If that doesn't resolve the problem, do this:
    1) Change the binding order of the network adapters (ncpa.cpl-advanced-advanced settings), so that the adapter that is listed at the top of the Connections list has File and Printer Sharing bound to it.
    2) Make sure File and Printer Sharing for Microsoft Networks checkbox is enabled on the interface.
    3) Disable unplugged network adapters if you have more than one adapters in the computers.
    4) Run the gpupdate /force command and check the eventlog to see if the errors are gone. You should find an 1704 info about security policy in the GPO applied successfully.
    Refresh Group Policy settings with GPUpdate.exe: http://technet.microsoft.com/en-us/library/cc739112(WS.10).aspx
    Soource: EventID.net

    Event 58

    By default, when a printer is created, the Everyone group is granted Print access. If this permission is removed and the printer is published, Print access must be granted for the Domain Controllers group on the printer. Otherwise, Printer Pruner cannot do its job and Active Directory will contain stale PrintQueue objects.

    To resolve:
    Make sure that the Everyone group or the Domain Controllers group has access to all printers that are published in Active Directory.

    Details here: http://support.microsoft.com/default.aspx?scid=kb;en-us;246174

    Let me know if this/these resolve the problem.
  20. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    Thanks bobbye.

    I have just reset winsock and restarted, let me see if that problem happens again.if happens I will follow the other steps.

    thanks.
    Amidou Dicko likes this.
  21. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    hi

    first option is failed. so i have followed other options; changed the binding order. now it seems to be working. i have refreshed many times the printers and spooler is still not crashed. let me see. and i got one more error in eventviewer after changing the binding order.here it is,

    Event Type: Warning
    Event Source: NETLOGON
    Event Category: None
    Event ID: 5781
    Date: 19/08/2009
    Time: 09:03:19
    User: N/A
    Computer: SERVER
    Description:
    Dynamic registration or deletion of one or more DNS records associated with DNS domain domain.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

    Possible causes of failure include:
    - TCP/IP properties of the network connections of this computer contain wrong IP address(es) of the preferred and alternate DNS servers
    - Specified preferred and alternate DNS servers are not running
    - DNS server(s) primary for the records to be registered is not running
    - Preferred or alternate DNS servers are configured with wrong root hints
    - Parent DNS zone contains incorrect delegation to the child zone authoritative for the DNS records that failed registration

    USER ACTION
    Fix possible misconfiguration(s) specified above and initiate registration or deletion of the DNS records by running 'nltest.exe /dsregdns' from the command prompt or by restarting Net Logon service. Nltest.exe is available in the Microsoft Windows Server Resource Kit CD.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
    Data:
    0000: 2a 23 00 00 *#..
  22. sumeshmd

    sumeshmd Newcomer, in training Topic Starter Posts: 83

    bad luck!!! again it is crashed..so better to not to go into the printers and fax folder is seems to be ok for me.

    Event Type: Error
    Event Source: Service Control Manager
    Event Category: None
    Event ID: 7031
    Date: 19/08/2009
    Time: 09:22:41
    User: N/A
    Computer: SERVER
    Description:
    The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
  23. karankashyap

    karankashyap Newcomer, in training

    Same problem

    Bobbye is gr8 person.............
    He is osum......
    .
    .
    .
    i dnt hv wrds for his work u r absolutly gr8.....
    gr8 gr8

    i hv just do it's first step n my that F@ckin prob is disaper.....

    keep It Up man
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.