Spooler service stopping automatically

Status
Not open for further replies.
S

sumeshmd

Posts: 71   +1
hello all,

i have a strage problem with my windows 2003 server spooler service.it keeps on crashing randomly.this is my print server also. so i have to start this service manually in all the time.at first it was logging this error in event viewer
"Faulting application spoolsv.exe, version 5.2.3790.3959, faulting module unknown, version 0.0.0.0, fault address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp."

then,this info by Dr.Watson.

"The application, C:\WINDOWS\system32\spoolsv.exe, generated an application error The error occurred on 08/13/2009 @ 14:59:48.599 The exception generated was c0000005 at address 00000000 (<nosymbols>)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp."

then i restarted the server and now it is not logging any error, but keeps on crashing.
if anybody can help me in this greatly appreciated.
thanks in advance
sumesh
 
How old is the hard drive? How much use has it had? You might want to run the S.M.A.R.T. test from the website of the drive manufacturer (unless it is a Tri-Gem or Toshiba which do not have one.
Remember that S.M.A.R.T. evaluations of hard drives have a 11% error rate... for bad ones reported good.
 
thanks for the quick reply.

but, my server is hp proliant which is less than 1 year old and having SCSI hard disk. i dont think there is problem with hard drive.
 
I don't think so either. the The exception generated was c0000005 at address 00000000 is a programming error, not a disk error.

Recommend you ensure all win2003 fixes and Service Packs be applied.

There is a small possibility of a known attack on the Spooler ...
 
Can a printer driver cause this error? I know that some HP drivers can cause XP spooler services to crash when you try to add the printer.

Best of luck,
 
I agree with jobeard...

1) Far less likely of it being related to errors with the hard drive itself
2) Make certain all Windows Updates (including all hardware optional updates) have been applied (keep running Windows updates Custom until it comes back saying "No more updates)
3) Run a thorough virus scan

And if problem persists, here's a trick i've found sometimes helped verify spoolsv.exe corruption or virus issues in the past...
Download HashTab.

Go to file C:\WINDOWS\system32\spoolsv.exe, rt click Properties, then File Hashes tab. Then copy/paste the MD5 hash value that appears.
 
thank you all for the help. i have scanned with mcafee and mbam. but no virus found. also have updated all the patches. let me try with hash tab.i will give the details after that

thanks
 
This might help you:
Can a printer driver cause this error?
Click to expand...
That would be a Yes. See below.

1)This error can be caused by a problem with the print driver.The file is located here: The file is located in C:\Window\System32 folder.
Location should be verified as malware can 'assume' just about any process name.

2)A common cause of this error can be when the printer spooler folder (buffer) is filled up with unwanted files. You can fix this problem by following the steps listed below:

  • [1] Go to Start> Run> type in services.msc.
    [2] Right-click on Print Spooler and then select Stop.
    [3] After you have stopped this process, leave the Service window open.
    [4}Now open My Computer and navigate to the following folder using Windows Explorer:
    Right click on Start> Explore> Windows> System 32>
  • c:\windows\system32\spool\PRINTERS - in Windows Vista, XP, 98/95/ME
    or
  • c:\winnt\system32\spool\PRINTERS - in Windows NT\2000
    [5] Delete all the files in the Printers folder.
    [6] Go back to Services window> right-click on Print Spooler> set Startup Type to Automatic> Start the Service.

spoolsv.exe starts the Print Spooler Service. This Service should be set to Automatic. It has one Dependency, which should also be set to Automatic: RPC- Remote Procedure Call (not the RPC Locator, just the RPC)

If the Print buffer is full, you may notice the spoolsv.exe running hot (hi CPU) in the Task Manager.
 
thanks again

this is the MD5 hash value "042F246C668FB17F884E90A1EFBDA443".

and bobbye, there is nothing in my printers folder to delete..
 
The thing about troubleshooting is that you have to start somewhere. We have eliminated one possible cause for this error.

Give this one a try:
A detailed description of the Data Execution Prevention (DEP) feature in Windows XP Service Pack 2, Windows XP Tablet PC Edition 2005, and Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;875352

DEP configuration for the system is controlled through switches in the Boot.ini file. During installation of Windows XP SP2 and Windows Server 2003 SP1 or later versions, the OptIn policy level is enabled by default.

Since you are getting the Access Violation c0000005, it is most likely that the Policy needs to be changed.

Please see the sections for resetting this policy on the Microsoft site that has been referenced.
unless a different policy level is specified in an unattended installation.
 
thanks bobbye..

i have disabled spool subsystem in DEP. let me see whether it is crashing again..
one more thing i have noticed is that if i didnt go to the printers folder it is not crashing. whenever i open the printers folder and refresh it, that time only this crashing is happening.so may be any of the printer driver is causing the problem. is there anyway to find out which is that driver?
 
hi,

i am doing it by going to the printers and fax folder and then right click and refresh.
doing it because some printers appears as "unable to connect".when i "refresh" it will turn to "ready".
 
You need to stop using refresh and find out what the problem is! Next time the printer doesn't connect, don't do refresh- look at the computer cloce, then go to event Viewer:

Start> Run> type in eventvwr

Do this on each the System and the Applications logs:

  • [1]. Click to open the log>
    [2]. Look for the Error>
    [3] .Right click on the Error> Properties>
    [4]. Click on Copy button, top right, below the down arrow >
    [5]. Paste here (Ctrl V)
    [6].NOTES
  • You can ignore Warnings and Information Events.
  • If you have a recurring Error with same ID#, same Source and same Description, only one copy is needed.
  • You don't need to include the lines of code in the box below the Description, if any.
  • Please do not copy the entire Event log.

Errors are time coded. Check the computer clock at time of failed connect.
 
ok.this is error
1
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 18/08/2009
Time: 03:11:41
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

2
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 18/08/2009
Time: 03:11:41
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=domain,DC=local. The file must be present at the location <\\domain.local\sysvol\domain.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Configuration information could not be read from the domain controller, either because the machine is unavailable, or access has been denied. ). Group Policy processing aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
this is in system log

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 18/08/2009
Time: 09:01:20
User: N/A
Computer: SERVER
Description:
The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

2

Event Type: Error
Event Source: Print
Event Category: None
Event ID: 51
Date: 18/08/2009
Time: 03:15:01
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
PrintQueue LDAP://CN=BILALPC-BILAL_HP,CN=BILALPC,OU=workstations,DC=domain,DC=local could not be pruned. Error: 80070005.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
i have run the "sc query spooler" and this is the result

SERVICE_NAME: spooler
TYPE : 110 WIN32_OWN_PROCESS (interactive)
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, ACCEPTS_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
 
You have not reported the brand and model of printer, and how it is connected to the server. We need to know more, including brands, models, age.
This is usually a hard error somewhere...
Most commonly found in many Epson, Brother, Konica Minolta, and some HP Laser printers.
If you have uninstalled and reinstalled the printer software, your printer is likely toast.
If less than a year old, the printer company warranty will provide you with a refurbished replacement.
Otherwise you have to replace the printer system board (easy to do but hard to get... and expensive) or replace the printer.
 
Good job! Now we're cooking!

Events 1030 and 1058 can be handled together:

Conservative (easiest) approach- try this first:
Start> Run> cmd> run the following command:

netsh winsock reset

You must reboot the server to complete the reset of the TCP/IP stack.

If that doesn't resolve the problem, do this:
1) Change the binding order of the network adapters (ncpa.cpl-advanced-advanced settings), so that the adapter that is listed at the top of the Connections list has File and Printer Sharing bound to it.
2) Make sure File and Printer Sharing for Microsoft Networks checkbox is enabled on the interface.
3) Disable unplugged network adapters if you have more than one adapters in the computers.
4) Run the gpupdate /force command and check the eventlog to see if the errors are gone. You should find an 1704 info about security policy in the GPO applied successfully.
Refresh Group Policy settings with GPUpdate.exe: http://technet.microsoft.com/en-us/library/cc739112(WS.10).aspx
Soource: EventID.net

Event 58

By default, when a printer is created, the Everyone group is granted Print access. If this permission is removed and the printer is published, Print access must be granted for the Domain Controllers group on the printer. Otherwise, Printer Pruner cannot do its job and Active Directory will contain stale PrintQueue objects.

To resolve:
Make sure that the Everyone group or the Domain Controllers group has access to all printers that are published in Active Directory.

Details here: http://support.microsoft.com/default.aspx?scid=kb;en-us;246174

Let me know if this/these resolve the problem.
 
Thanks bobbye.

I have just reset winsock and restarted, let me see if that problem happens again.if happens I will follow the other steps.

thanks.
 
  • Like
Reactions: Amidou Dicko
hi

first option is failed. so i have followed other options; changed the binding order. now it seems to be working. i have refreshed many times the printers and spooler is still not crashed. let me see. and i got one more error in eventviewer after changing the binding order.here it is,

Event Type: Warning
Event Source: NETLOGON
Event Category: None
Event ID: 5781
Date: 19/08/2009
Time: 09:03:19
User: N/A
Computer: SERVER
Description:
Dynamic registration or deletion of one or more DNS records associated with DNS domain domain.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

Possible causes of failure include:
- TCP/IP properties of the network connections of this computer contain wrong IP address(es) of the preferred and alternate DNS servers
- Specified preferred and alternate DNS servers are not running
- DNS server(s) primary for the records to be registered is not running
- Preferred or alternate DNS servers are configured with wrong root hints
- Parent DNS zone contains incorrect delegation to the child zone authoritative for the DNS records that failed registration

USER ACTION
Fix possible misconfiguration(s) specified above and initiate registration or deletion of the DNS records by running 'nltest.exe /dsregdns' from the command prompt or by restarting Net Logon service. Nltest.exe is available in the Microsoft Windows Server Resource Kit CD.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 2a 23 00 00 *#..
 
bad luck!!! again it is crashed..so better to not to go into the printers and fax folder is seems to be ok for me.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7031
Date: 19/08/2009
Time: 09:22:41
User: N/A
Computer: SERVER
Description:
The Print Spooler service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
 
Same problem

Bobbye is gr8 person.............
He is osum......
.
.
.
i dnt hv wrds for his work u r absolutly gr8.....
gr8 gr8

i hv just do it's first step n my that F@ckin prob is disaper.....

keep It Up man
 
Status
Not open for further replies.

Similar threads

W
Solved HackTool:Wind32/Mailpassview found
Replies
10
Views
5K
Broni
Broni
F
Solved I think my system is infected, windows 10 guest user build automatically
2 3
Replies
56
Views
29K
Broni
Broni
E
  • Locked
Inactive Constant Temp folder creation
Replies
8
Views
5K
Broni
Broni

Latest posts

Back