print spooler halts office apps

lwp

New Member
#1
Hi gurus
I have a problem at an office with all their computers. The are 5 in total which are a mix of windows 10 and 7 (home premium) and are different brands (acer, ibm). The have directly connected and wireless network printers of various types. All computers operate Ok for a while and then randomly the printer spooler (spools.exe) will stop functioning. This causes office apps to stop loading and also to freeze when selecting the print function. Stopping the print spooler service fixes the issue for a while but soon it will reoccur.

I am told that this behavior only happens when in the office. Laptops taken elsewhere work fine.

This behavior only started a few weeks ago and I am told that there have been no new apps or manual updates or changes applied around the time it started.

Is anybody able to point me where I can start looking to solve this one?

Thanks
 


BIGBEARJEDI

Fantastic Member
Premium Supporter
#2
We would certainly need to know the configuration of the network, topology, etc. What kind of Server(s) are being run such as Microsoft Servers (v2003, v2008, v2012, etc.), Web-servers such as Apache, brands of routers such as Cisco, Firewalls, Proxy servers, etc. A network diagram would be helpful. If you don't have one of those, it's a very difficult thing to nail down a problems such as this. Hiring a licensed network engineer to create this diagram for you, along with the IP addresses of all physical devices mentioned and their layout is essential. This would include the sub-netting schema. If you didn't build this network yourself, and by that I mean go out and buy all the physical devices and cable everything together, it's going to be very challenging to fix. I've built hundreds of networks like this and some up to 10,000 computers in size. The other advantage of bringing in a network engineer is that they can attach something called a "Lanalyzer" tool to the network backbone and examine your network traffic at the packet level to discover which device or devices are "mis-shaping" packets or putting out bad information. In the meantime if you go look at all of the connecting boxes such as routers, firewalls, proxy servers, and Ethernet switches, you can identify ports the printers are connected to and look for what we call "beaconing" or excessive blinking of green activity or network traffic lights (link-lights); this can indicate excessive collisions which on an Ethernet network can be the kiss of death to network-connected peripherals such as printers.

Removing the printers one at a time from the network, watching those activity lights, can sometimes help to identify the bad port/device, or at least the subnet in your network the bad device lives on. From there you can narrow the bad device down to a particular part or subnet of the network. Once you know that, you can disconnect that entire subnet from the rest of the network, and use the "divide-and-conquer" approach to track down the offending device and repair or remove it from the network.

FYI, if you are attempting to produce your own network diagram, professional network engineers often use the Visio program to do this, and the software comes from Microsoft and is quite expensive; several hundred dollars. There are free or low-cost alternatives you can explore for this by googling "Visio" and finding them. Some have free trial periods of 30 days; try before you buy that are worth exploring. If you hire a consultant or network engineer to produce your network diagram and they offer to do it in Visio, you probably have the right guy.;)

Hope that proves helpful. Post back if you have further questions along with a network diagram.
<<<BIGBEARJEDI>>>
 


lwp

New Member
#3
Thanks heaps for your very detailed reply. I appreciate the effort that people such as yourself put into these forums. I am actually an experienced network architect so fully understand what you are asking. I'm just not right up to date with the windows internals.

The network in the building is basically like a home network with 1 internet router/switch/wireless AP. Very basic. Although I haven't ruled anything out yet I can't see it as a network related problem as such. I don't see how this would affect the spooler software, but am willing to accept suggestions on how it could be a factor.

I am still trying to get a pattern of failures and whether it is printing to the network printer or the local printers that causes the soooler to stop responding - if indeed either is the cause.

I will certainly take your advice and see if removing tge computers from the nerwork fixes the issue, but that makes it difficult to work and the problem may not be able to be replicated. Another task is to remove all the printer drivers and reinstall only the necessary ones. I did notice there were a lot of printers defined one the computer I was looking at.

Still happy to receive any other advice.

Thanks again
LP
 


BIGBEARJEDI

Fantastic Member
Premium Supporter
#4
You're welcome! Can you tell us make model of the router/switch/wireless AP? Hope none of those are either D-link or TP-link; those are both known to have inferior firmware, drivers, including poorly written spooler routines. If they are name brand (Cisco/Linksys or Netgear), you should still make sure they have up to date firmware updates in each device; check the Cisco or Netgear websites and compare with labels and model number version numbers on devices; update firmware accordingly. Any devices that fail to let you upgrade their FW are faulty and should be replaced immediately-again with only name-brand devices.


Last network I managed, I had about 90 printers on my network across multiple subnets on 2 floors in a 180,000 sq.ft. facility. Most of those were wired printers, a few wireless; that was back in 2001. Nonetheless, wireless printers are more reliable now than they used to be, so I would remove all of those first. If you have 10 printers, 7 of them wireless, remove all of those and you'll only be left with 3 wired printers to troubleshoot on 5 computers. That's only 125 possible combinations to work with, versus 10 printers and 5 computers which has 1,000 combinations! Much better odds to work with their 125 vs 1,000 don't you agree?


No offense meant here, but if you are a Network Architect, haven't you sketched out at least a layout of what your network looks like on paper?:scratch: Not sure also what kinds or sizes of networks you've designed and implemented, but if you've done any work for large companies such as Fortune1000 they have certain Standards that comply to Best Practices that require some level of network documentation. Especially if you are building networks for the Government or Military or Aerospace contractors as I have. If you never learned this in school or University, their curriculum is woefully under-preparing you.:( In any case, I would tell you that when I worked for large network providers as IBM and Wang among others if I went into an account where the existing IT engineer did not have this type of documentation even for a 3 computer network; I immediately requested that my Client fire that engineer and hire someone who can produce proper documentation. Not having this is like a Hospital or your Doctor not having a complete Medical Record on you if you are admitted for any kind of surgery! :zoned:Just my opinion of course.


Here's an example of a Customer network I prepared a Visio network diagram for back in 2004. This was an actual network that I managed.

Take a look:
http://imgur.com/a/eptuX

<<<BBJ>>>
 


Last edited:

Neemobeer

Windows Forum Team
Staff member
#5
How are you printing, direct IP, print server? If print server is there a local DNS server? When a system is acting up are there jobs stuck in the local queue? C:\Windows\System32\spool\PRINTERS
 


lwp

New Member
#6
How are you printing, direct IP, print server? If print server is there a local DNS server? When a system is acting up are there jobs stuck in the local queue? C:\Windows\System32\spool\PRINTERS
Hi need one er
They are printing directly to the liters. There is no server on the network and only very occasionlyrics do they share files - I haven't seen how they do that yet but will look more when I go in next.
When the problem occurs the local print queue won't open. I will get them to leave it open all the time to see. I have yet to see the problem actually occur other than going in after it had. After I had restarted the spooler I could not make it reoccur, but received a call later to say that it had. It has occurred daily since. While I was there I cleared some of the unnecessary programs from auto starting and restarted the computer several times.
I will go in again in a few days and hopefully the have a bit of a log of what they were doing when it occurred.
The computer that I was testing on had a local USB printer and also printed directly to the wireless printer.
 


lwp

New Member
#7
Hi need one er
They are printing directly to the liters. There is no server on the network and only very occasionlyrics do they share files - I haven't seen how they do that yet but will look more when I go in next.
When the problem occurs the local print queue won't open. I will get them to leave it open all the time to see. I have yet to see the problem actually occur other than going in after it had. After I had restarted the spooler I could not make it reoccur, but received a call later to say that it had. It has occurred daily since. While I was there I cleared some of the unnecessary programs from auto starting and restarted the computer several times.
I will go in again in a few days and hopefully the have a bit of a log of what they were doing when it occurred.
The computer that I was testing on had a local USB printer and also printed directly to the wireless printer.
 


lwp

New Member
#8
They are printing directly to the ?liters? Gotta love auto correct. The are, of course, printing directly to the printers!
 


BIGBEARJEDI

Fantastic Member
Premium Supporter
#9
Ok, no servers, but what about this question? Can you tell us make model of the router/switch/wireless AP? Can you provide us with a network diagram as per my earlier post? IP addresses on computers? Which printers are wireless and their IPs? Which printers are USB connected?

It's also very difficult when you cannot confirm the printing problem if you cannot see it occur.:furious: This is a repeatability problem. If you can't make it occur, you can't fix it.:noway: Do you trust the people who are reporting the problem to you?:question: I would ask them to use a Smartphone or digital camera and take a picture of the problem, if you can't reproduce it.

BBJ
 


lwp

New Member
#10
Internet router is Netgear cable as supplied by Telstra here. It has integrated WiFi and network switch.
There are 2 Ethernet connections from the device.
I certainly get you when you say it is difficult to solve a problem that you can't see happen. I have certainly seen the problem after it has occurred but still not been able to see it transition from a working to non-working state. I have identified that it is the print spooler app that stops, but not what is causing it to stop. After it stops, restarting the service temporarily fixes the issue. I spent 3 hours watching them one day last week and the problem did not occur while I was there. I have asked them to log what they do.
Are there any built-in logs that might help? I have turned on the operational print service log so will see if that tells me anything useful.

Interestingly when the system is printing normally, the Admin printer log tells me that any job printed to the local HP 1020 printer has failed. Yet it tells me that the correct number of pages printed and the jobs physically do print OK. Is this likely to be connected to the issue in any way?

Are there any logs that I can turn on or view that track exactly what applications are being loaded and when? Maybe if I can marry up a particular application to the failure that will be a start.

The printers in the environment are:
HP OfficeJet Pro 86004 which is wireless-connected
HP LaserJet 1020 of which there are two; both locally connected via USB to different computers
HP 1102w which is wireless-connected
They also use print to PDF a lot using an application called Paperport.

They use Office 365

All drivers are up-to-date and Windows updates are automatic on the computers.

For what it is worth the IP address scheme is 192.168.0.0/24 with the gateway as .1 The Netgear provides DHCP and there is an external DNS Server



Thanks again for any input
LP
 


BIGBEARJEDI

Fantastic Member
Premium Supporter
#11
Internet router is Netgear cable as supplied by Telstra here. It has integrated WiFi and network switch.
There are 2 Ethernet connections from the device.
I certainly get you when you say it is difficult to solve a problem that you can't see happen. I have certainly seen the problem after it has occurred but still not been able to see it transition from a working to non-working state. I have identified that it is the print spooler app that stops, but not what is causing it to stop. After it stops, restarting the service temporarily fixes the issue. I spent 3 hours watching them one day last week and the problem did not occur while I was there. I have asked them to log what they do.
Are there any built-in logs that might help? I have turned on the operational print service log so will see if that tells me anything useful.
>>>Thanks for that information. It helps a lot.;) Did you ask your Users to write down the error message with pen and paper? Or leave the screen on for you? Or take a picture with a Smarphone or Digital camera. At least one of your Users should be able to provide that level of cooperation. The log is a really good idea too, I've used that to help me track down many an intermittent problem such as yours over the years. As far as built in logs, no other printer logs that you've mentioned, but the print queue applets all tie back in to svchost.exe and the spawned services show up in Windows Event Viewer and System Viewer failures as number failure events, which you can then look up on the MSDN Knowledge Base online. Generally, it takes some advanced computer skills to interpret these, so I'm going to assume that you are aware of what these are and how to use them. Additionally, another good tool you can download for free is the PROCMON app (you can google it), and post back the resulting logs, neemo is quite skilled at interpreting the results from this app and recommends it frequently. This tool is a fine-tuning microscopic inspection version of the usual Windows event viewers I mentioned, and allows processes including the snaky ones spawned by svchost.exe to see where they are going what other processes are being generated, or failed, or called such as a missing or outdated .dll library. These often get hit by viruses/malware; so it's a good idea to scan every PC on your LAN. SAFE MODE scans are best as you are aware, use whatever built-in AV scanners are already installed on those PCs, such as Norton, Defender, McAfee, Avast, etc. and ensure they are clean. You'll also need to check for RootKit and BootKit viruses using TrendMicro's RootKit Buster; free online at trendmicro.com. Also, you should download the free MALWAREBYTES from Malwarebytes.org if you haven't already installed and are using that to check for spyware viruses. Many spyware viruses and E-mail based jscript viruses target your print queue applets and either corrupt them or disconnect them from providing proper printer operation.:headache:<<<

Interestingly when the system is printing normally, the Admin printer log tells me that any job printed to the local HP 1020 printer has failed. Yet it tells me that the correct number of pages printed and the jobs physically do print OK. Is this likely to be connected to the issue in any way?
>>>I would agree with that hypothesis. This is often due to virus/malware infection, Windows registry/hive corruption, or hardware failure; usually read sector errors on aging hard drives or bit errors in failed RAM memory sticks. You should conduct full hardware testing on each and every PC on your LAN that accesses any or all of the printers you have connected. Here's a link to do the hardware testing I wrote step-by-step as well as subsequent Windows troubleshooting and all repairs up to and including drive wiping and full Windows reinstallation from factory Recovery discs: Windows 10 - Unclickable Task Bar.
If this were my LAN, I would do all of these things, as well as create a network diagram (hopefully I beat that one to death!), and then backup all Library data on each and every PC, and do a complete scratch Windows install on all PCs, and then retest for the problem. That's how I work. When I worked for IBM, Wang, Ford, Unocal, Lockheed, and other large corporate IT shops this is how things are done. It's also how I trained students who were becoming Network Engineers and Technicians to work too.<<<:nerdie:


Are there any logs that I can turn on or view that track exactly what applications are being loaded and when? Maybe if I can marry up a particular application to the failure that will be a start.
>>>Yup, already mentioned, PROCMON, is a good one to start with. We have some talented people here who can interpret the results and guide you to possible solutions such as neemo.<<<

The printers in the environment are:
HP OfficeJet Pro 86004 which is wireless-connected
HP LaserJet 1020 of which there are two; both locally connected via USB to different computers
HP 1102w which is wireless-connected
They also use print to PDF a lot using an application called Paperport.
>>>Very standard devices. Remember to disconnect all wireless printers from the LAN while troubleshooting. Print queue problems often originate from wired printers, not wireless, and without a $30k Lanalyzer at your disposal you're not going to be able to troubleshoot BOTH wired and wireless printers at the same time on the same LAN on the same subnet (which is how you've got your PCs and printers all connected)!!!:ohno:<<<

They use Office 365
>>>Again, very standard software; I used Office365 with Office2016 version here on my home LAN with none of the printing problems you mention and I have 1 wired color laser printer (or did) and 1 wireless Canon inkjet printer. All running on the same subnet through Ethernet switches and hubs with no problems. And all my PCs are now upgrade to W10 as well.:applaud:<<<

All drivers are up-to-date and Windows updates are automatic on the computers.

For what it is worth the IP address scheme is 192.168.0.0/24 with the gateway as .1 The Netgear provides DHCP and there is an external DNS Server
>>>Also, very standard. If I was being sent in to fix your printing problem, I'd be charging about $600-$800 to produce the network diagram for this small LAN as the very first order of business. In Visio or Word or PowerPoint, I'd also put in all those devices along with their IP addresses and other nomenclature such as Make/Model of device, IP address, subnet information (which you don't have), and the topology layout. If this is a business customer, you should consider doing this and letting them know if they want their problem fixed you need to get paid for doing this part of the job, since it was obviously not in place when you got hired to work on it or fix it. :noway: That means that the business that hired you is not informed about such things, and if they didn't want to pay me for that part of the job, I'd walk away.:wave: Just because the network is simple and connected together with just a few devices doesn't mean you don't need to apply Best Practices Troubleshooting methodology IMO.<<<


Thanks again for any input
LP
>>>You're welcome! ;) Glad to try and help; intermittent printing problems are only 2nd to intermittent connection problems on a LAN in terms of frustration for both your Customer and for you trying to fix it!

Best of luck,:encouragement:
<<<BBJ>>> :cool: :brew: :clover:
 


Last edited:
This website is not affiliated, owned, or endorsed by Microsoft Corporation. It is a member of the Microsoft Partner Program.