ntdll.dll crash print spooler server 2012

Question

_{Monday, April 25, 2016 7:16 PM}

Hello since last Thursday our print server has been having issue.  Here is the event log:

Event 1000, Application Error

Faulting application name: spoolsv.exe, version: 6.3.9600.17415, time stamp: 0x54503ab3
Faulting module name: ntdll.dll, version: 6.3.9600.18194, time stamp: 0x56951674
Exception code: 0x80000003
Fault offset: 0x00000000000921e0
Faulting process id: 0xf3c
Faulting application start time: 0x01d19f241e77cb74
Faulting application path: C:\Windows\System32\spoolsv.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 5cea3d94-0b17-11e6-80c8-0050568bf550
Faulting package full name: 
Faulting package-relative application ID: 

I've did a clean boot and still the print spool starts off stopped, restarted it, then crashes/stops again.   I've deleted reg file w/ printers located here %systemroot%\system32\spool\drivers\W32x86 or for 64bit: %systemroot%\system32\spool\drivers\x64.    Deleted the printer spooler.  Uninstalled the printers from programs and feature, but can't delete them from drivers located in print management as the print spooler can't stay working long enough.

I have a Canon ir-adv c7055, Epson WF3640, and Xerox7800 and xerox 8560.

Please help!  Thanks.

All replies (2)

_{Tuesday, April 26, 2016 6:48 AM ✅Answered}

Hi,

Thanks for your post.

please perform the following steps to troubleshoot this issue.

<Suggestion 1-Clear spool file>

Open Windows Explorer, refer to C:\windows\system32\spool\printers, and delete all of files in this folder (Do not delete the folder itself).

If it is possible, please disable/uninstall Antivirus software on the printer server to test. It was reported that some Antivirus software, such as MacAfee, may cause this issue. If you are using any printer monitor software, please uninstall them too. Please also boot into Clean Boot environment to test.

<Suggestion 2-Change the spooling format>

Let us set the spooling format to RAW, and then try to print directly to the printer instead of spooling the print job. To do this:

a. Right-click the printer that you are using, and then click "Properties".

b. In the Advanced tab, click "Print Processor".

c. Set the default "Data type" to "RAW" for both "WinPrint" and "ModPrint".

d. Click OK.

e. In the Advanced tab, select “Print directly to the printer”.

f. Click OK, and then close the Printers dialog box.

Best Regards,

Alvin Wang

Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected].

_{Wednesday, April 27, 2016 4:50 AM ✅Answered}

The crash pointing to ntdll is typically when one of the print drivers is corrupting the memory of the spoolsv.exe process.

The print drivers will also load Print Provider software from C:\Windows\System32\spool\prtprocs\x64

and Language Monitors from C:\Windows\System32\

Most likely the LM would be from the Epson driver.

Is there a dmp or hdmp file created when the spooler crashes?  If there is, please copy to a shared drive.  It only takes a couple minutes to find the failure point. 

The file may be in C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Just for accuracy , you are running Server 2012R2.  Server 2012 is build 9200, 2012R2 is build 9600.

Thanks

Alan Morris formerly with Windows Printing Team