Cannot start print spooler service

I manage about 25 windows machines, monday 1 stopped printing (i was on vacation) the next day 3 more machines would not print.  It was the print spooler service that had stopped and I could not start it even by going into services and trying to start it manually.  I tried to wipe out the spoosv.exe file and that didnt work.

I found the spooler would start sometims for just a second and no errors, mostly the errors were:

Could not start the Print Spooler service on Local Computer.
Error 1067: The Process terminated unexpectedly.

Using Add Printer wizard    or      trying to add network printer:
Operation could not be completed.  The print spooler service is not running.

Who is Participating?
EikromanConnect With a Mentor Commented:
When you go in "Services" in Control Panel>Administrative tools
In front of Print Spool service you'll see at the far right a column "Log On As". There should be LocalSystem. If for some reason it has changed, open properties of the service and in Logon tab select Local System.

For the event log. go to Control Panel> Administrative tools>Event Viewer.

There I'm interested in the output for Applications and System at the time you are trying to start the spool service.

Cheers! (leaving now, be back later)
To quote from the link given below:

If the Print Spooler service fails when printing, when Windows starts or it can not be restarted, the usual reason is that one or more printer drivers is defective.

This page has some very good advice on how to clean up installed printer drivers so that you can reinstall the printer and hopefully correct your problem:

marcomnordicAuthor Commented:
I have also tried the system restore to no avail, it seems that the restore views the print sub system as something not worth keeping track of it doesnt change it at all.

The printers have all dissapeared, I cannot add anything.

I have re scanned manualy using:
symantec corp AV 9 current virus defs,
AVG free (downloaded just to try something extra)
Super Antispyware PRofessional (downloaded for xtra scan)
Spybot s&d (also just downloaded for this)

still no success,  hopeing someone has directions to rebuild the entire print subsystem???  otherwise I will be install from scratch:(
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

As LeeTutor pointed out, that might be a problem with a driver.

I don't quite understand what you mean by "I tried to wipe out the spoosv.exe file and that didnt work."

Just in case, go to this folder and delete everything there. Then try to restart the spool service.
marcomnordicAuthor Commented:
first, I just tried the cleanspl.exe that Lee refered to, I had also previously tried the Reg fix that the link refered to.

The spoolsv.exe thing....   I found a referance yesterday recomending to pull the Spoolsv.exe file from a working machine and replace it on the problem one.  That didnt work.

I had done that already, sorry for lack of info.  The folder C:\WINDOWS\system32\spool\PRINTERS
is empty(just verified and checked for system and hidden as well)
marcomnordicAuthor Commented:
Still not able to start the print spooler.  It errors out with error 1067.  I did notice that about every 3 times it strats for about 1 second.  dont know if that is any help about anything.

Try this.
Download filemon
and regmon
Start both, start capture
Then start spool service.
When it will crash, stop both captures, filter out to spoolsv.exe to see what it does. It may give some clues on what it access. Maybe there is something missing.. you'll see it. Then also attach a log here.
marcomnordicAuthor Commented:
This is too much for me to absorb... I did it and the logs dont make much sense to me.  I did the filter and here there are.
Those two are strange:
839      7:59:52 AM      spoolsv.exe:1712      OPEN      C:\WINDOWS\system32\SPOOLSS.DLL      ACCESS DENIED      NT AUTHORITY\ANONYMOUS LOGON      

544      3.80065703      spoolsv.exe:1712      OpenKey      HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize      ACCESS DENIED      Access: 0x20019 NT AUTHORITY\ANONYMOUS LOGON      
After that line svchost proceeded to On failure actions...
That's strange because first the service was able to access GRE_Init... Then this. On a OK system it happens only once.
Seems like spool tries to start as anonymous %-(
Please verify, does the service starts under LocalSystem account?
And check if there is any logs in the EventLog relating to the problem. Especially interested in DCOM errors.

Unfortunately I may leave any minute so I won't be able to answer soon. But for now I'm around.

marcomnordicAuthor Commented:
I dont understand how to do that?
marcomnordicAuthor Commented:
It was Eikroman's direction that kept me going on this, but the problem was not even close what everyone was directing me to do.

Even I am shocked at the real issue.

I have a Canon IR400 that is a Copier, Printer and a fax machine. that was the problem.   It seems there is either a virus in the internal print srerver on this machine or  there is something else wrong witht he print board or programing on it.

As I pursued the issue, on a whim, and direction from a friend I was talking to ( the only common link between these 4 of the 25 pcs I manage is their main printer is the same one) and I had just commented to our copier repair guy about hearing about a virus in a printer he said he has seen it 2 times.  

after unpluging the printer I tried to get more info for Eikroman and when I did a start on the spooler it worked fine!

that is that!
marcomnordicAuthor Commented:
Thanks, dont know if this is ok but your help is not really the solution but it kept me pounding away at this and in the end it helped me to find the real solution, thanks again
Glad you sorted it out.

Thank you for points but I think it would have been more appropriate to request points refund.

Have a great day!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.