iris01
asked on
Print Spooler Service Stopping
Hi Experts;
I currently have a 2003 SP2 server with a failing print spooler, the service will "unexpectedly" stop, restart a minute later, then fail a few seconds after that.
I've uninstalled all print drivers and run sfc /scannow, to no avail.
https://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/
I've taken an ntsd trace as below. Can anyone spot a problem from this, or recommend how to proceed?
Thanks in advance
edit: somehow this has ended up in Server 2008, d'oh
I currently have a 2003 SP2 server with a failing print spooler, the service will "unexpectedly" stop, restart a minute later, then fail a few seconds after that.
I've uninstalled all print drivers and run sfc /scannow, to no avail.
https://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/
I've taken an ntsd trace as below. Can anyone spot a problem from this, or recommend how to proceed?
Thanks in advance
edit: somehow this has ended up in Server 2008, d'oh
Microsoft (R) Windows Debugger Version 5.2.3790.3959
Copyright (c) Microsoft Corporation. All rights reserved.
*** wait with pending attach
The call to LoadLibrary(ext) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(exts) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(uext) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.
The call to LoadLibrary(ntsdexts) failed, Win32 error 2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.
Symbol search path is: *** Invalid *** : Verify _NT_SYMBOL_PATH setting
Executable search path is:
ModLoad: 01000000 01010000 C:\WINDOWS\system32\spoolsv.exe
ModLoad: 7c800000 7c8c0000 C:\WINDOWS\system32\ntdll.dll
ModLoad: 77e40000 77f42000 C:\WINDOWS\system32\kernel32.dll
ModLoad: 77ba0000 77bfa000 C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f50000 77feb000 C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77c50000 77cef000 C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 76f50000 76f63000 C:\WINDOWS\system32\Secur32.dll
ModLoad: 77c00000 77c48000 C:\WINDOWS\system32\GDI32.dll
ModLoad: 77380000 77411000 C:\WINDOWS\system32\USER32.dll
ModLoad: 6fa00000 6fa35000 C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
ModLoad: 76b70000 76b7b000 C:\WINDOWS\system32\PSAPI.DLL
ModLoad: 74060000 74078000 C:\WINDOWS\system32\SPOOLSS.DLL
ModLoad: 71c00000 71c17000 C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71bf0000 71bf8000 C:\WINDOWS\system32\WS2HELP.dll
ModLoad: 71c40000 71c97000 C:\WINDOWS\system32\NETAPI32.dll
ModLoad: 76cf0000 76d0a000 C:\WINDOWS\system32\iphlpapi.dll
ModLoad: 71b20000 71b61000 C:\WINDOWS\System32\mswsock.dll
ModLoad: 76ed0000 76efa000 C:\WINDOWS\system32\DNSAPI.dll
ModLoad: 76f70000 76f77000 C:\WINDOWS\System32\winrnr.dll
ModLoad: 76f10000 76f3e000 C:\WINDOWS\system32\WLDAP32.dll
ModLoad: 76f80000 76f85000 C:\WINDOWS\system32\rasadhlp.dll
ModLoad: 76130000 76186000 C:\WINDOWS\system32\localspl.dll
ModLoad: 77670000 777a9000 C:\WINDOWS\system32\ole32.dll
ModLoad: 77d00000 77d8b000 C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 77b90000 77b98000 C:\WINDOWS\system32\VERSION.dll
ModLoad: 76be0000 76c0b000 C:\WINDOWS\system32\sfc_os.dll
ModLoad: 76bb0000 76bdb000 C:\WINDOWS\system32\WINTRUST.dll
ModLoad: 761b0000 76243000 C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 76190000 761a2000 C:\WINDOWS\system32\MSASN1.dll
ModLoad: 76c10000 76c38000 C:\WINDOWS\system32\imagehlp.dll
ModLoad: 76920000 769e2000 C:\WINDOWS\system32\USERENV.dll
ModLoad: 73070000 73097000 C:\WINDOWS\system32\winspool.drv
ModLoad: 74020000 7402e000 C:\WINDOWS\system32\cnbjmon.dll
ModLoad: 10000000 10033000 C:\WINDOWS\system32\HpTcpMon.dll
ModLoad: 00e30000 00e6e000 C:\WINDOWS\system32\HPTcpMUI.dll
ModLoad: 77530000 775c7000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Cont
rols_6595b64144ccf1df_5.82.3790.3959_x-ww_78FCF8D0\COMCTL32.dll
ModLoad: 00e70000 00e95000 C:\WINDOWS\system32\hpzjrd01.dll
ModLoad: 00ed0000 00eef000 C:\WINDOWS\system32\hptcpmib.dll
ModLoad: 72000000 72007000 C:\WINDOWS\system32\mgmtapi.dll
ModLoad: 71f50000 71f58000 C:\WINDOWS\system32\snmpapi.dll
ModLoad: 71ff0000 71ffe000 C:\WINDOWS\system32\wsnmp32.dll
ModLoad: 71b20000 71b61000 C:\WINDOWS\system32\mswsock.dll
ModLoad: 5f270000 5f2ca000 C:\WINDOWS\system32\hnetcfg.dll
ModLoad: 71ae0000 71ae8000 C:\WINDOWS\System32\wshtcpip.dll
ModLoad: 74000000 74007000 C:\WINDOWS\system32\pjlmon.dll
ModLoad: 72460000 7246e000 C:\WINDOWS\system32\tcpmon.dll
ModLoad: 76f70000 76f77000 C:\WINDOWS\System32\winrnr.dll
ModLoad: 76f10000 76f3e000 C:\WINDOWS\system32\WLDAP32.dll
ModLoad: 72010000 72018000 C:\WINDOWS\system32\tcpmib.dll
ModLoad: 71bb0000 71bb9000 C:\WINDOWS\system32\WSOCK32.dll
ModLoad: 72450000 72458000 C:\WINDOWS\system32\usbmon.dll
ModLoad: 770e0000 771e8000 C:\WINDOWS\system32\setupapi.dll
ModLoad: 770e0000 771e8000 C:\WINDOWS\system32\setupapi.dll
ModLoad: 010d0000 01110000 C:\WINDOWS\system32\spool\PRTPROCS\W32X86\hpzpp5k4.
DLL
ModLoad: 74de0000 74df2000 C:\WINDOWS\system32\clusapi.dll
ModLoad: 74ef0000 74f03000 C:\WINDOWS\system32\resutils.dll
(1238.12a8): Unknown exception - code 000006d9 (first chance)
ModLoad: 74030000 74054000 C:\WINDOWS\system32\win32spl.dll
ModLoad: 5f8c0000 5f8c7000 C:\WINDOWS\system32\NETRAP.dll
ModLoad: 766f0000 76704000 C:\WINDOWS\system32\NTDSAPI.dll
ModLoad: 74080000 74096000 C:\WINDOWS\system32\inetpp.dll
ModLoad: 74010000 74015000 C:\WINDOWS\system32\icmp.dll
ModLoad: 770e0000 771e8000 C:\WINDOWS\system32\SETUPAPI.DLL
ModLoad: 770e0000 771e8000 C:\WINDOWS\system32\SETUPAPI.DLL
eax=00000000 ebx=00000000 ecx=0007fdcc edx=00000000 esi=7c827c0f edi=00000000
eip=7c8285ec esp=0007fe34 ebp=0007ff28 iopl=0 nv up ei pl zr na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\W
INDOWS\system32\ntdll.dll -
ntdll!KiFastSystemCallRet:
7c8285ec c3 ret
0:000> k
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\W
INDOWS\system32\kernel32.dll -
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
0007ff28 77e66905 ntdll!KiFastSystemCallRet
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\W
INDOWS\system32\spoolsv.exe -
0007ff3c 01004021 kernel32!ExitProcess+0x14
0007ffc0 77e6f23b spoolsv+0x4021
0007fff0 00000000 kernel32!ProcessIdToSessionId+0x209
0:000>
I have not seen this error in a while, but we used to solve it by deleting temporary files in the spool directory. Here is a clear description of the two-prong process: (1) Remove the HKEY_LOCAL_MACHINE\SYSTEM\
If none of this helps, the event and application logs would be my next stop as well as looking into whether clients with different operating systems (32-bit, 64-bit) are accessing the print server for drivers.
P.S.: The NTDS trace might be misleading in this case. " 'ERROR: Symbol file could not be found' is not [an] application error. Debugger simply tells you it could not find file with debugging information (that's what symbol file is)." from http://forums.asp.net/t/1093832.aspx
If none of this helps, the event and application logs would be my next stop as well as looking into whether clients with different operating systems (32-bit, 64-bit) are accessing the print server for drivers.
P.S.: The NTDS trace might be misleading in this case. " 'ERROR: Symbol file could not be found' is not [an] application error. Debugger simply tells you it could not find file with debugging information (that's what symbol file is)." from http://forums.asp.net/t/1093832.aspx
Credit: The description of the process was taken from http://techrepublic.com.com/5208-11184-0.html?forumID=49&threadID=163020&messageID=1673211&tag=content;leftCol
ASKER
No joy chaps
The event logs are in no way helpful for this, just a repeat of service sent stop control, service stopped, service terminated unexpectedly, service sent start control, service started, rinse and repeat
I'll stick the debugging toolkit on to see if it gives a better idea with ntds trace
The event logs are in no way helpful for this, just a repeat of service sent stop control, service stopped, service terminated unexpectedly, service sent start control, service started, rinse and repeat
I'll stick the debugging toolkit on to see if it gives a better idea with ntds trace
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Self resolved
Stop the spooler, move all files from this directory and start it again. Does it help?
Also, any more printers defined on the server? You may have to remove them one by one. If any driver was updated recently (check Event logs) it's probably causing the issue.