Is anyone seeing excessive handle usage and high memory usage in spoolsv.exe after recent Windows update?

Question

So I am seeing a couple locations where the spooler handle count is greater than 1 million and the memory used by spoolsv.exe is GIGs

The handles are file handles.

I was able to trace the stack but just curious if anyone else has hit this.

@Alan Morris

Thanks

Answer 1

Answer 2

Hello

Yes, there have been reports of high memory usage and excessive handle usage by the spoolsv.exe process after recent Windows updates. Some users have reported that the spooler handle count is greater than 1 million and the memory used by spoolsv.exe is in gigabytes. This issue could be related to a problem with the Windows printing system, such as a print queue full of jobs, buggy printer drivers or utilities, or a misconfigured printer.

It is recommended to run the Windows printing troubleshooter and update the printer drivers to their latest version to try and resolve the issue.

If the issue persists, it may be helpful to check for any lingering files in the C:\WINDOWS\system32\spool\PRINTERS folder and delete them before restarting the print spooler service.

https://superuser.com/questions/98139/spoolsv-exe-consumes-all-cpu-and-ram-resources

https://www.reddit.com/r/sysadmin/comments/t8y257/print_spooler_huge_memory_usage_server_2019_rdsh/

Answer 3

Hi @Wesley Li-MSFT

Has the issue been reported to the development team?

This is the stack of the leaking file handle.

0x00007ffafc81fb44: ntdll!NtOpenFile+0x0000000000000014

0x00007ffaf9e19705: KERNELBASE!FindFirstFileExW+0x00000000000001d5

0x00007ffaf9e19f1c: KERNELBASE!FindFirstFileW+0x000000000000001c

0x00007ffae36cddf1: localspl!NPackageInstallLocalspl::TLinkedDriverPackage::RemovePreviousCab+0x00000000000001dd

0x00007ffae36cdb8f: localspl!NPackageInstallLocalspl::TLinkedDriverPackage::GetCabPath+0x000000000000014b

0x00007ffae36cd99e: localspl!NPackageInstallLocalspl::TLinkedDriverEnvironment::GetDriverPackagePath+0x000000000000012a

0x00007ffae375eda1: localspl!SplGetPrinterDriverPackagePath+0x0000000000000181

0x00007ffae3755bb6: localspl!NPackageInstallLocalspl::TPackageInstallLocalspl::GetDriverPackagePath+0x0000000000000046

0x00007ff67c3bac91: spoolsv!RouterGetPrinterDriverPackagePath+0x00000000000000d1

0x00007ff67c392cbe: spoolsv!YGetPrinterDriverPackagePath+0x000000000000009e

0x00007ff67c3a223e: spoolsv!TFunction8HR<unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long,unsigned long * __ptr64,enum Call_Route>::Run+0x000000000000009e

0x00007ff67c35a120: spoolsv!NThreadingLibrary::TWorkCrew::tpSimpleCallback+0x0000000000000040

0x00007ffafc787233: ntdll!TppSimplepExecuteCallback+0x00000000000000a3

Even if this where vendor driver caused the spooler should be cleaning up after the call.

Thanks