Print Spooler Event id: 7031, 7032

Posted on 2005-04-11
Last Modified: 2008-01-09
Event Type:      Error
Event Source:      Service Control Manager
Event Category:      None
Event ID:      7031
Date:            11/04/2005
Time:            14:49:27
User:            N/A
Computer:      JFSMAINSERVER
The Print Spooler service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.

I have shared printers on my server, they where working ok till 13:00 then sundley this error arreared, i have tried restarting the printer spool service on the server, but it stops its self and comes up with subsytem error on spool service

Pls Help
Question by:simonsav
    LVL 35

    Expert Comment

    by:Nick Sui
    SP4 should resolve this problem. You can try uninstalling and installing the Printer Driver. If not resolved run sfc /scannow.

    Let me know.
    LVL 7

    Expert Comment

    This is lengthy, but helpful

     This error is not specific to the <service name> service but it is generated by the Service Control Manager when it detects that a specific service terminated ungracefully. In order to troubleshoot this error look for other events, logs, etc., that are specific to the service in question.

    - Service: "McShield" - This is caused by a bug in the McAfee software, install the latest version.
    - Service: "Print Spooler" - As per Microsoft, this problem may occur if a print job that contains an older version 3 DEVMODE structure that does not contain ICM information is submitted. When the spooler tries to reference this data, it causes the access violation. A post SP3 hotfix is available - see Q324183.
    - Service: "IIS Admin Service" - See Q311517.
    - Service: "Distributed Transaction Coordinator" - See Q290637.
    - Service: "Microsoft ISA Server" - See Q288247.
    - Service: "Remote Procedure Call (RPC)" - This may occur if the system is infected by the MSBlaster or LoveSAN Internet worm. See Q823980 for details. See also the Symantec Security Response on how to detect it and remove it.

    Not a fix, but a way to work around occasional failures is to configure the "Recovery" option of the service to restart it if the service fails. I would not recommend setting all the 3 options to restart the service but only the first two "First failure" and "Second failure" - this way, you avoid an continuous failure/restart cycle. We used this for example with Adiscon MoniLog that failed occasionally. The Service Control Manager would simply restart it and the service worked fine.

    Anonymous (Last update 4/7/2005):
    - Service: "COM+ System Application" - See Q895200 for a hotfix applicable to Microsoft Windows XP.

    Ionut Marin (Last update 2/6/2005):
    - Service: Print Spooler - This problem occurs if an access violation occurs in the Print Spooler service. This occurs if the size of the print buffer is not sufficient, therefore it must be reallocated, however, in the call to reallocate the buffer, the GetPrinterInfo function allocates a 0 byte buffer and an access violation occurs. Check Q820550, Q888191, Q888196, and Q888206 to fix the problem.
    - Service: Remote Procedure Call (RPC) - See Q327148.
    - Service: Microsoft Exchange Information Store - See Q317482, Q814924, Q822949, Q824467, Q831276, Q835437, Q842000, and Q891005.
    - Service: Microsoft Exchange System Attendant - See Q301364.
    - Service: World Wide Web Publishing Service - See Q308600.
    - Service: Cluster - See Q258469, Q272129, Q295091, Q321531, and the link to "Trend Micro Support Solution ID: 21441".
    - Service: Windows Installer - See Q329819.
    - Service: Message Queuing - See Q826820 and Q830639.
    - Service: File Replication Service - See Q255759.
    - Service: Information Store - See Q329817.
    - Service: DNS Server - See Q258073.
    - Service: Remote Registry Service - See Q833777.
    - Service: IIS Admin Service - See Q819865, Q821749, Q827214, Q836177, Q885264, and the link to "Symantec Support Document ID:2004040209303954".
    - Service: Telnet - See Q832459 for a hotfix applicable to Microsoft Windows 2000.
    - Service: OfficeScan Master - See the link to "Trend Micro Support Solution ID: 19462".
    - Service: NAI ePolicy Orchestrator Agent - See "Network Associates Support Solution ID: NAI29545".
    - Service: Diagnostic Facility COM Server - See "Citrix Support Document ID: CTX104533".
    - Service: Quota Advisor - See "Veritas Support Document ID: 270419".
    - Service: Symantec AntiVirus - See the link to "Symantec Support Document ID:2004093011032448".

    See the link to "Microsoft event 7031 from source Service Control Manager" for more details on this event.

    If you are using McAfee GroupShield 5.2 for Exchange, then see the link to "McAfee Support Solution ID: NAI31469" for information regarding this event.

    See Q286350 to find out how to use the ADPlus tool to troubleshoot "Hangs" and "Crashes".

    Author Comment

    Hi tried

    SP4 and run sfc /scannow

    didn't work
    LVL 35

    Expert Comment

    by:Nick Sui

    Did you restart the computer after trying these two methods?
    Are you running Terminal Application or Server on this machine?

    Let me know.

    Author Comment

    I have found out that are pcounter program was locking out the RPC server, so we have gone in c:\winnt1\system32\spool\printer and have delete the *.spl file.

    Thanks for your help

    Expert Comment

    I am having the same problem but running windows 2003 - any ideas? I havnt deleted the .spl or .shd files yet as am waiting for users to log off... thanks - help is welcome!
    LVL 30

    Expert Comment

    by:Wayne Barron
    No comment has been added to this question in more than 21 days, so it is now classified as abandoned..
    I will leave the following recommendation for this question in the Cleanup topic area:
    [PAQ - Refund]

    Any objections should be posted here in the next 4 days. After that time, the question will be closed.

    EE Cleanup Volunteer

    Accepted Solution

    PAQed with points refunded (500)

    Community Support Moderator

    Featured Post

    Find Ransomware Secrets With All-Source Analysis

    Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

    Join & Write a Comment

    Suggested Solutions

    NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
    This is an issue that we can get adding / removing permissions in the vCSA 6.0. We can also have issues searching for users / groups in the AD (using your identify sources). This is how one of the ways to handle this issues and fix it.
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    Sending a Secure fax is easy with eFax Corporate ( First, Just open a new email message.  In the To field, type your recipient's fax number You can even send a secure international fax — just include t…

    754 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now