Print spooler crash on 2003 Server SP2

[John]

If I'm posting in the wrong group please let me know. We've been experiencing
issues with the print spooler service on our print server running Windows
Server 2003 SP2. Occasionally the service will fail without any specific
errors. In the event viewer there will be the following error, event ID 7031
"The Print Spooler service terminated unexpectedly. It has done this 2
time(s). The following corrective action will be taken in 60000
milliseconds: Restart the service" I've set the service to restart
automatically if the service crashes, but I'd like to fix this issue once and
for all. I have a mini dump file that is created when the services crashes,
but I don’t have a Dr Watson log file to look into. There are no unwanted
services running on the server, and the antivirus doesn’t scan the spooling
directory. I'm really at a lost on this problem. If anyone can point me in
the right direction this would be greatly appreciated.

Thanks

 

[Alan Morris [MSFT]]

since you have the minidumps, Dorothy, you already have the pieces.

I'll wave the wand and hopefully, you can figure this out.

ntsd.exe is the application that will open the mini dumps

open a command window

change to the directory where the dmp file is located

ntsd -z minidump.dmp


this will spawn a window and leave you at a prompt

*** ERROR: Symbol file could not be found.
l.dll -
ntdll!KiFastSystemCallRet:
77039a94 c3 ret
0:108> k


type k

this will list several lines of code

0a2ea0d4 77039b6b ntdll!ExecuteHandler2+0x26
0a2ea184 770399f7 ntdll!ExecuteHandler+0x24
0a2ea184 689b9580 ntdll!KiUserExceptionDispatcher+0xf
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
hpzu
i4wm.DLL -
WARNING: Stack unwind information not available. Following frames may be
wrong.
0a2eb420 6880b238 hpzui4wm!DllGetClassObject+0x1af2c0
0a2eb430 6f11859f hpzui4wm!DllGetClassObject+0xf78
0a2eb450 6f118677 UNIDRVUI_6f110000!HComOEMDevMode+0x44
0a2eb490 6f119196 UNIDRVUI_6f110000!BCallOEMDevMode+0x67
0a2eb4d0 6f119107 UNIDRVUI_6f110000!BConvertOemPluginDevmode+0x74
0a2eb510 6f114fcc
UNIDRVUI_6f110000!PConvertToCurrentVersionDevmodeWithOemPlugin



You can either figure out the modules in the stack and determine the driver
or send the stack and I'll point to the module to look for.

The previous failure is in hpzui4wm.dll Not sure which print driver this
was for. Your results will be different depending on the print drivers you
have installed on the machine.
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[John]

Thanks Alan for the response. Here is a copy of the dump that I executed with
the NTDS utility.

ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be
wrong.
02a8b850 0503b238 hpzui4wm!DllGetClassObject+0x1af2c0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
PS5U
I.DLL -
02a8b860 459afa92 hpzui4wm!DllGetClassObject+0xf78
02a8b880 459e883f PS5UI!Ordinal283+0x3445
02a8b8c0 459e8a1e PS5UI!DrvPopulateFilterServices+0x3850d
02a8b900 459e8f9c PS5UI!DrvPopulateFilterServices+0x386ec
02a8b940 459e8ff6 PS5UI!DrvPopulateFilterServices+0x38c6a
02a8b974 459a656c PS5UI!DrvPopulateFilterServices+0x38cc4
02a8b9a4 459a67ef PS5UI!Ordinal270+0x229
02a8b9c4 459a8e75 PS5UI!Ordinal270+0x4ac
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
spoo
lss.dll -
02a8b9ec 7406afda PS5UI!DrvQueryJobAttributes+0x60
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
hpzp
p4wm.DLL -
02a8ba3c 010ff626 spoolss!GetJobAttributes+0x6b
02a8ba54 010f700e hpzpp4wm!EnumPrintProcessorDatatypesW+0x9566
02a8ee80 0111484d hpzpp4wm!EnumPrintProcessorDatatypesW+0xf4e
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
loca
lspl.dll -
02a8eeb0 7615a229 hpzpp4wm!PrintDocumentOnPrintProcessor+0x6d
02a8f948 7615aadd localspl!SplDeleteSpooler+0xbd0
*** ERROR: Symbol file could not be found. Defaulted to export symbols for
kern
el32.dll -
02a8ffb8 77e64829 localspl!SplDeleteSpooler+0x1484
02a8ffec 00000000 kernel32!GetModuleHandleA+0xdf
0:049>

If you could point me in the right direction that would be greatly
appreciated. We have a combination of HP and Xerox printers on this print
server 70 printers in all. Let me know if you need anything else.

Thanks for your help

 

[Alan Morris [MSFT]]

Excellent work!
this is the bad boy
hpzui4wm

I did not realize HP used this driver for the postscript version on the
printer. I think this is for the LJ 4345. Verify which print drivers use
this file. In a command window execute

cscript %windir%\system32\prndrvr.vbs -l |findstr /I /C:"hpzui4wm.dll"
/C:"Driver name"

this will list all the drivers just note where you also see hpzui4wm.dll



you need to pick up the latest drivers. The big problem we have hit when
just replacing the driver is there is registry data in the printer that the
old driver creates that will corrupt the application process on the clients
when they have the new driver.

I normally change the printers to use Generic Text only, delete the old
driver, install the new, and change the printers back to new driver. It
will be a pain when you have a whole bunch of printers that use the same
driver. If that does not work you will need to remove the old HP registry
stuff from the printer registry but you can get back to me if you have to go
that route.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[John]

I ran the command you mentioned and this it the output I received

"C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\hpzui4wm.DLL"

It doesnt really tell me what printer uses this driver. After looking into
some printers I've pin pointed the types of printers that use that driver (LJ
4200 & 4250). I have about 30 in all that use this driver.

Is there any documentation that explains the proper and "clean" way to
delete drivers?

Would going the registry route be more difficult?

thanks for you help

 

[Alan Morris [MSFT]]

You can try HP.com for documentation. Within the spooler we just delete the
driver when it is no longer used by any queue or connection. That means you
need to delete all the printers that use this driver. Yea. like you're
going to delete 30 queues. What I and most others do is change the driver
in use by the queue to a different driver. Once the old driver is not in
use, one can delete the old driver ( if someone has a connection open to the
server with the driver loaded, you will need to net stop spooler, net start
spooler) and add the new one. The issue with queues created using an HP
driver are HP specific registry settings that reside under the printer.
These registry setting can cause problems with the new driver, generally
creating module load errors in explorer or current application on the
clients and the clients cannot view all the print preferences pages.


If you want to delete the existing printers and recreate, that's the safest.

To verify the registry garbage
Create a printer on another machine that uses the latest driver, locate the
printer registry key under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers.
On the current server change one of the queues so it uses a different (not
an HP) driver. Look for HP data still under the changed printer registry.
The stuff that is present on the current server but not existent under the
test printer key is the data to delete.




--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[John]

Hey Alan,

Sorry for the late reply. Just wanted to let you know that I'll be doing the
driver update later tonight. I will keep you posted of the outcome.

Cheers

Justin

 

[John]

Alan,

Just wanted to thank you. I updated the drivers last week and everything
seems to be working fine. It hasnt crashed since!

Thanks again

John

 

[Alan Morris [MSFT]]

yeah

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.