The Print Spooler service terminated unexpectedly

Question

Hi

I have windows server 2016 with 100 network printers, in the last week printspooler service crashed a 3-4 time per day.

EventViewer show about 7031 and 7034 ID

I have been tried to check here: C:\ProgramData\Microsoft\Windows\WER\ReportQueue, and i have seen that reports show about PnPDriverImportError

Here the log:

Version=1
EventType=PnPDriverImportError
EventTime=132265919710791008
Consent=1
ReportIdentifier=75e99d5f-531a-11ea-a2c1-0050568bcc6b
AppSessionGuid=00002ef8-0002-0016-1be8-b4101de7d501
TargetAppId=W:0000f519feec486de87ed73cb92d3cac802400000000!0000c4cf887c2b9e013f14e4d8ebb5cb1b72dc186909!PrintBrmEngine.exe
TargetAppVer=2017//09//07:05:18:48!45651!PrintBrmEngine.exe
BootId=4294967295
Response.type=4
Sig[0].Name=Architecture
Sig[0].Value=x64
Sig[1].Name=Win32 error
Sig[1].Value=E0000242
Sig[2].Name=Inf name
Sig[2].Value=citizen.inf
Sig[3].Name=Driver Package hash
Sig[3].Value=dc333aceb4b80619050417031560820bfefeb32d
DynamicSig[1].Name=OS Version
DynamicSig[1].Value=10.0.14393.2.0.0.272.7
DynamicSig[2].Name=Locale ID
DynamicSig[2].Value=1033
FriendlyEventName=Could not install driver software
ConsentKey=PnPDriverImportError
AppName=Driver software installation
AppPath=C:\Windows\System32\spool\tools\PrintBrmEngine.exe
ReportDescription=Windows could not copy all of the files needed to install this device driver software. This sometimes happens when the driver software was not designed for this version of Windows.
ApplicationIdentity=00000000000000000000000000000000
MetadataHash=-1194163697

Answer 1

Hello, Currently having this issue with 2012r2- Faulting module path: C:\Windows\System32\wsnmp32.dll

I disabled the SNMP STATUS as referenced by @Llewellyn Duvenhage on the most recent Konica Machines- no Change wsnmp32.dll continues to crash every few hours.

We are using SentinelOne for AV wasn't sure if anyone else is which could be the cause. I've reached out to their support. They just recommended exclusions for the C:\Windows\System32\spoolsv.exe directory.

I also ran "sfc /scannow" and "DISM.exe /Online /Cleanup-image /Restorehealth" which made no difference.

Answer 2

Standard TCP/IP ports use SNMP.

There is a check box in the port configuration to disable the SNMP queries.

If you have a bunch of printers using Standard TCP/IP port, you can run a vbs command to disable the setting on all ports.

Answer 3

Also, for Konica Minolta printers, Standard TCP/IP port auto configuration sets up the port in LPR mode which seems odd.

The printers fully support Raw 9100 port so maybe flipping the port configuration to Raw and SNMP true might work too.

So, disable SNMP on all Standard TCP/IP ports.

If that works, introduce SNMP back but configure a port or two to Raw and SNMP enabled.

If that tanks the spooler, then KM are passing some data that the port monitor is not handling.

That would be a bug on MS part to not crash on bad data but we can let KM and MS battle that out.

Thanks

Answer 4

@Karl Watson
Disabling SNMP on the port will stop all SNMP queries to the printer so the spooler will never find out the state of the printer before starting the job.

For instance, when the printer is turned off, normally the Standard TCP/IP port has queried the printer and the printer is placed into an offline status. The jobs will come in and the spooler will not schedule any jobs to start printing. The print jobs will retain a status of 0 , no status.

With SNMP queries disabled, the printer will be in a Ready status even when powered off. The spooler will schedule one job to the printer. The WritePort call will fail and the job will be placed into Error - Printing status and shortly afterward the printer will be marked in Error. The spooler will not schedule any other jobs until the WritePort call succeeds, the job in error is deleted, or the print spooler is restarted.

Answer 5

Update- So after setting every single Konica Minolta protocol to RAW the last crash was 11/3
at 9:45am! since changing the protocol to raw. Will start introducing SNMP slowly and check for errors.

257303-prsrvcl.jpg