Spooler SubSystem App

[Eddie]

I need some help, please. I am running Vista Home Premium (32-bit). I been
receiving an error message each morning when I turn on my machine "Spooler
SubSystem App stopped working and was closed". My local printer does not
work, nor can I print across my LAN. I wrote a question about this before
and received a suggestion to try this:

http://support.microsoft.com/default.aspx?scid=kb;en-us;324757

But that did not help the problem. I also tried a system restore to before
the time the printer problem occurred, but it failed twice when it came to
point of restoring the registry. The only thing that happened to my machine
at the time of the spooler failure was an update to Adobe Reader, so I also
tried uninstalling that, but still no success. I am at wit's end and I
really need to be able to print (for preparing my taxes). Can anyone help?

 

[Boba & Ilinka]

On the site mention in your post go only to register and remove your
printer. Reinstall drivers for the printer. Go to the acro reader and set
printer so that it print acro document as an image.
It worked for me.

Boba Vankufer

 

[Eddie]

Dear Boba,

I have removed my printer, following the procedure from the KB article, but
I cannot get the print spooler to function. I start it in services, but
after a minute or so it crashes. So I cannot reinstall the driver for my
printer. I do not have the LexBCE Server installed and there are no
dependencies listed for Print Spooler (other than DCOM Process Server
Launcher).

It seems like the Print Spooler is corrupted. How can I repair/restore the
print spooler in Vista Home Premium? I found the KB article for XP, but I
don't think that would work with Vista since the installation procedure is
very different.

 

[Alan Morris [MSFT]]

Are there any system or application events when the spooler terminates.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Eddie]

Dear Alan,

Thank you for your reply.

Are there any system or application events when the spooler terminates.

I am not certain what you are asking, but I think the answer is "No". Each
time I start my machine, as it boots I get the error message:

"Spooler SubSystem App stopped working and was closed"

This also happens when I manually restart the Print Spooler Service after
about one minute. This problem just came up one morning for no apparent
reason. The only change of which I am aware was an update from Adobe Reader.
I have tried uninstalling Adobe Reader, but it did not help the problem. I
checked the Windows update schedule, but the only updates that occurred at
the time this problem began were Defender definition updates. I also tried a
System Restore twice, but each time it failed when trying to restore the
registry.

Any help you can offer is deeply appreciated.

 

[Boba & Ilinka]

Try to go to start, print in the box regedit; go to HKEY_LOCAL_MACHINE: than
SYSTEM; ControlSet001; Control; Print; Printers. In this folder you will see
your printer (HP LJ1018 or so). Remove your printer. Try to download latest
driver for your printer and install it. Do not forget to print adobe
document as an image.

Good lack

Boba Vankufer

 

[timbob]

I hope this works for me, too, as last night I just started getting the same
message about the spooler. Of course, I was trying to print out a
presentation for the morning. Aarrgh. Why this suddenly happened after 5
months with a brand-new HP laptop with Vista and brand new HP printer just
amazes me...and frustrates me no end.

 

[Alan Morris [MSFT]]

Launch the event viewer to view the application and system events. It's in
Admin tools

Open an elevated command prompt and type

net start spooler

Are there any errors or does the spooler start successfully? The spooler
does pause about a minute before loading all the driver data.

also verify that there are no pending print jobs located in
\windows\system32\spool\printers

if there are any, copy them to another location and start the spooler again.

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Eddie]

Dear Boba,

I appreciate your trying to help me with this.

Try to go to start, print in the box regedit; go to HKEY_LOCAL_MACHINE: than
SYSTEM; ControlSet001; Control; Print; Printers. In this folder you will see
your printer (HP LJ1018 or so). Remove your printer. Try to download latest
driver for your printer and install it. Do not forget to print adobe
document as an image.

I have already removed my printer from the currentcontrolset, but not from
controlset001. I have now done that and then tried to manually restart the
print spooler, but I got the same error message. It will not allow me to
open the print spooler service to install any drivers. When I try I get the
same error message about Windows closing the Spooler SubSystem App. I also
tried having the print folder already open and then starting the print
spooler manually and got the error message:

"Windows can't open Add Printer. Operation could not be complete (error
0x000006be)."

This does appear to be a registry problem. I tried copying the spoolsv.exe
file from Vista that is installed on my laptop, but that had no effect on the
problem either.

 

[Eddie]

Dear Alan,

Thanks for your help in this. I trust that we are making progress.

Launch the event viewer to view the application and system events. It's in
Admin tools

Okay, I found it. I looked in the system and application events and I did
not find anything that appears out of place except for the print spooler
suddenly terminating three times and Windows attempting to restart it twice.
I did eliminate the Adobe update, since that actually came a few hours later
the same day. Let me know if there is something in particular I should be
looking for.

Open an elevated command prompt and type

net start spooler

Are there any errors or does the spooler start successfully? The spooler
does pause about a minute before loading all the driver data.

Yes, I immediately got an error message:

System error 5 has occurred.

Access is denied.

also verify that there are no pending print jobs located in
\windows\system32\spool\printers

I verified that folder is empty.

 

[Alan Morris [MSFT]]

What was the Adobe update for?
Drivers can corrupt the memory of the process they are run in resulting in
that process terminating.


The command prompt needs to be run as administrator, that why you are
getting the access denied error.


You will need to delete the drivers corrupting the spooler memory.


http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Alan Morris [MSFT]]

You will need to delete the drivers corrupting the spooler memory. Be sure
to launch any driver uninstall utilities as administrator. When the spooler
won't run long enough to delete the drivers, you'll need to remove the
drivers from the registry so the spooler will not load them and terminate.

http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm

If you are experiencing a spooler service failure with drivers that are
included in Vista please give the driver name.

thanks

--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Eddie]

Alan,

I appreciate all the help. I am sorry about the delay in replying. I did
not get the E-mail notification of your response this time.

What was the Adobe update for?

It was just an update for Adobe Reader from version 8.1.1 to 8.1.2. But it
came a few hours after this problem began showing up, so I am pretty certain
that we can eliminate it as a source of the problem.

Drivers can corrupt the memory of the process they are run in resulting in
that process terminating.

The command prompt needs to be run as administrator, that why you are
getting the access denied error.

I am the only user on this machine, so I assume that my account has all
admin priviledges. Even the guest account is turned off. Yet I am still
getting the error 5 message with access denied when I try to start the
spooler. When I try to stop it, I do not get the error message or access
denied, but it tells me that the spooler service is not running (which of
course it isn't). It does tell me to type net helpmsg 3521 for more
information. When I do I get the message:

The *** service is not started.

You will need to delete the drivers corrupting the spooler memory.

http://members.shaw.ca/bsanders/CleanPrinterDrivers.htm

I followed the process he described, which is similar to one found in one of
the KB articles. The only difference is that I apparently read the KB
article wrong and deleted the "version-3 registry key" itself instead of the
sub-keys only. Thankfully I did back up that key previously before deleting
it, so I was able to restore it and then delete only the subkeys this time.
I also deleted the XPS Document Writer subkey. I did not use the
cleanspl.exe tool from 2003 Resource kit since I am running Vista. But if
you think I should download that and try it then I will do that next.

I still am getting the error message when I start Vista or try to manually
start the spooler. This is quite frustrating, but I assume there is a
solution.

 

[Alan Morris [MSFT]]

To launch the command prompt elevated

All Programs
Accessories
Command Prompt Right click
Run as administrator


Allow

now at the prompt type
net start spooler





--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Eddie]

Dear Alan,

Thanks for the explanation of elevated command prompt. I was able to start
the spooler service from the command prompt. But after about one minute I
received the error message again and the spooler closed. I also tried
starting and then immediately stopping the service from the command prompt
which worked successfully. But when I tried to start the spooler and then
open the printer folder, it crashed again. I guess this is probably as
frustrating to you as it is to me. I appreciate your time and effort in
helping me through this.

 

[Alan Morris [MSFT]]

Great. one step closer. I wanted to confirm that the spooler did not throw
an error during initialization to the service control manager.

Let me make this assumption: You have a 32 bit OS and you have removed any
print vender specific software installed using a vendor provided tool or
Add/Remove Software.

Now, what print drivers, print processors, and monitors are installed on the
system? Right click the keys and you can select "Copy Key Name"

print drivers (there should be a directory and major, minor values here).
There should not be a Version-2 key under drivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
NT x86\Drivers\Version-3

print processors
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
NT x86\Print Processors

monitors
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors

You said you had already deleted the printers under this key, please verify
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers


does the machine have any printer connections? Are there any entries listed
here?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers




--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Eddie]

Dear Alan,

Great. one step closer. I wanted to confirm that the spooler did not throw
an error during initialization to the service control manager.

Fantasic. I was worried we were not getting any closer to a solution.

Let me make this assumption: You have a 32 bit OS and you have removed any
print vender specific software installed using a vendor provided tool or
Add/Remove Software.

Yes, I am running Vista Home Premium 32-bit.

No, I had not yet uninstalled the printer software, but I have now. I was
not able to uninstall the printer driver software through Add/Remove because
it said it was already uninstalled.

Now, what print drivers, print processors, and monitors are installed on the
system? Right click the keys and you can select "Copy Key Name"

print drivers (there should be a directory and major, minor values here).
There should not be a Version-2 key under drivers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
NT x86\Drivers\Version-3

There is nothing here except the default key. I do not have the directory,
major, minor keys because one of the web based solutiuon sites said to delete
every subkey under this directory. I did make a backup of this registry key,
so I can restore it.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3

print processors
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
NT x86\Print Processors

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors\winprint

It has the default key and a driver key with value localspl.dll

monitors
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Local Port
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard
TCP/IP Port
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard
TCP/IP Port\Ports
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard
TCP/IP Port\Ports\192.168.254.254
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\USB Monitor

You said you had already deleted the printers under this key, please verify
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\Microsoft
XPS Document Writer

Also there are two key values set under printers: DefaultSpoolDirectory and
LANGIDOfLastDefaultDevmode

does the machine have any printer connections?

My printer (Epson Stylus Photo R280) is still connected by USB cable, but
turned off

Are there any entries listed here?
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\RITA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\RITA\Forms
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\RITA\Monitors
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\RITA\Printers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Print\Providers\Client Side Rendering Print
Provider\Servers\RITA\Providers

That is my wife's computer which is connected by LAN. There is a local
printer (Canon) installed on her machine. But it is not listed in the
printers subkey.

Thanks again for all the help.

 

[Alan Morris [MSFT]]

You need the values under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows
NT x86\Drivers\Version-3

Directory this is a string value

MajorVersion this is a DWORD set to 3

MinorVersion this is a DWORD set to 0

If you do restore the key from backup be sure to delete the driver named
keys.

You most likely still have a connection to the printer attached to \\RITA

the registry for the connection is under

HKEY_CURRENT_USER\Printers\Connections

delete the ,,RITA,,printname key


are there any spl files in
\windows\system32\spool\printers

if there are, delete or move the spl and shd files

now start the spooler.

if that fails again, delete the printer

Microsoft XPS Document Writer

but I can't see how that would matter since there is not a driver and you
should get a system event that the printer was not enumerated due to no
driver (I think this is event 28).



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Eddie]

Dear Alan,

You need the values under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3

Directory this is a string value

MajorVersion this is a DWORD set to 3

MinorVersion this is a DWORD set to 0

If you do restore the key from backup be sure to delete the driver named
keys.

Okay, I restored the key and then deleted the driver named keys, except
Microsoft XPS Document Writer

You most likely still have a connection to the printer attached to \\RITA

the registry for the connection is under

HKEY_CURRENT_USER\Printers\Connections

delete the ,,RITA,,printname key

You were correct. That key has now been deleted.

are there any spl files in
\windows\system32\spool\printers

No, there were no files at all in that directory.

if there are, delete or move the spl and shd files

now start the spooler.

if that fails again, delete the printer

Microsoft XPS Document Writer

It did fail again, but I decided not to delete that printer yet until
searching through the registry for all keys that relate to the printers that
have been installed on this system at one time or another. I found these
keys.

HKEY_CURRENT_USER\Printers\Settings
HKEY_USERS\S-1-5-21-2943314224-2146634662-2678190527-1000\Printers\Settings

These each have a binary subkey for a Lexmark printer which is no longer used

HKEY_CURRENT_USER\Printers\DevModePerUse
HKEY_USERS\S-1-5-21-2943314224-2146634662-2678190527-1000\Printers\DevModePerUser

These each have two binary subkeys for the Epson printer that is locally
connected

HKEY_CURRENT_USER\Printers\DevModes2
HKEY_USERS\S-1-5-21-2943314224-2146634662-2678190527-1000\Printers\DevModes2

These each have a binary subkey for the Epson printer that is locally
connected

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBPRINT\EPSONStylus_Photo_R280
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\USBPRINT\EPSONStylus_Photo_R28
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBPRINT\EPSONStylus_Photo_R280

I did nothing with these keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBPRINT\EPSONStylus_Photo_R280\6&1847499c&0&USB001\Properties

That key returned an error message when I tried to open it

I also found and deleted this key

HKEY_USERS\S-1-5-21-2943314224-2146634662-2678190527-1000\Software\Printers\Connections\,,RITA,Canon PIXMA iP4000

Finally, I did backup and then delete these two keys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\Microsoft XPS Document Writer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\Microsoft
XPS Document Writer

But I am still receiving the same error message. So I restored them.

What do I try next? Do I need to do something with the other keys that I
listed above?

Thanks again for your patience with me.

 

[Alan Morris [MSFT]]

Was this an upgrade from XP or new install?

Which lexmark printer model?

Look in \windows\system32 for any lex* files.

are any crash files created when the spooler terminates?

on a elevated command line
cd\
dir spooler* /s

I'm looking for these files in the WER directory

Directory of
c:\ProgramData\Microsoft\Windows\WER\ReportQueue\Report17218c57

02/08/2008 10:16 AM <DIR> .
02/08/2008 10:16 AM <DIR> ..
02/18/2008 10:38 AM 6,018 Report.wer
02/08/2008 10:15 AM 75,222 spooler.xml
02/08/2008 10:16 AM 506 WER7F9A.tmp.version.txt
02/08/2008 10:16 AM 18,576 WER7F9B.tmp.appcompat.txt
02/08/2008 10:16 AM 41,877,089 WER7FAC.tmp.hdmp
02/08/2008 10:16 AM 2,485,025 WER8B70.tmp.mdmp



--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base here:
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.