Share via

How Network Printing Works

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

How Network Printing Works

In this section

  • Terms and Definitions

  • Network Printing Architecture

  • Network Printing Protocols

  • Network Printing Processes and Interactions

  • Network Ports used by Network Printing

  • Related Information

Network Printing enables users in locations geographically separate from each other and from their print devices to produce documents for themselves and others. Print servers enable multiple clients to share one or more print devices. By using the Active Directory directory service in the Windows 2000 Server and Windows Server 2003 operating systems, users can locate printers in a target location that supports the features necessary to produce their documents.

This section describes the components and processes of network printing with print servers running Windows Server 2003.

Terms and Definitions

The following three terms are data types associated with Network Printing.


Data type used in a page description language that is ready to be sent to a print device; for example, PCL or PostScript. This is the default data type for print jobs on computers that are not running Windows XP Professional or Windows 2000. These RAW files are device-dependent; that is, the spooled data is destined and formatted for a particular device.


Data type used between print clients running Windows XP Professional and print servers running Windows Server 2003. With an enhanced metafile (EMF), the Graphics Device Interface (GDI) releases console control after generating the EMF. The EMF data is then interpreted in the background on a spooler thread and sent to the printer driver. Splitting the rendering of a print job in this way is especially useful for very large documents because the application is not tied up for the entire rendering time.

EMF spool files are encoded to provide greater printer independence. For example, a graphic measuring 2 inches by 4 inches on a video graphics adapter (VGA) display and stored in an EMF maintains those dimensions whether it is printed on a 300-dpi laser printer or a 75-dpi dot-matrix printer. The EMF data type also ensures that the print server uses the fonts you specified.


Data type used to send a simple-text print job to a printer (such as a PostScript device) that cannot interpret simple text. The spooler creates a new print job, embedding the text in print instructions that are derived from the printer’s defaults for font, form, and orientation. Several character sets are in common use, and text files do not indicate which one to use. The TEXT data type uses the ANSI character set, so it might print some characters incorrectly if the application uses a different set.

Network Printing Architecture

Network printing components include a server spooler on a print server running a product in the Windows Server 2003 family and a client spooler running on a client computer. Because print jobs usually originate on a client computer, this section first describes the architecture of the client spooler.

Client Spooler

The client spooler (Winspool.drv) is the component on Windows operating systems that delivers print jobs from applications on the client computer to print servers. On client computers running Windows XP Professional or Windows 2000 operating systems, print jobs are delivered directly to the client spooler; on other Windows operating systems, a redirector is necessary to deliver print jobs to the client spooler, and on non-Windows operating systems, other mechanisms are required to complete a print job.

The following figure shows the components involved in generating and sending print jobs to the print server.

Components of Client Computers That Generate and Send Print Jobs

Client Computers That Generate and Send Print Jobs


  • The preceding figure is a simplification of network printing processes. Specific platforms use different components and processes. For information about printing processes specific to your environment, you might need to refer to documentation specific to your platform.

Windows clients and non-Windows clients include the following operating systems:

Windows Clients

Client computers running Windows 95, Windows 98, Windows Millennium Edition, Windows 2000, Windows XP, or Windows Server 2003.

Non-Windows Clients

Client computers running UNIX, Apple Macintosh, or MS-DOS. This group also includes NetWare clients.

The following table defines the client components that generate and send print jobs.

Components of Client Computers That Generate and Send Print Jobs

Component Description

Windows Application

Any program that creates printable data.

Non-Windows Application

Any program that creates printable data.

Client Spooler

Processes and sends print jobs from the client to the print server.

Graphics Device Interface (GDI)

Provides services to the printer driver, including caching, client-server communications, and character conversion.

Printer Driver

Communicates with print devices to generate output from data supplied by the GDI.

Line Printer Remote (LPR)

Protocol that sends print jobs to a server running the server-side protocol, Line Printer Daemon (LPD).


Protocol used by Macintosh clients and Windows servers, when Services for Macintosh is installed on the servers.


Protocol used by NetWare clients for file and print services and by Windows servers when NWLink is installed on the server.

Local Print Device

Prints device-specific data. This device is attached to a local port on the server.

Remote Print Device

Prints device-specific data. This device is directly connected to the network and managed by this print server.

Remote Print Server

Accepts print jobs for print devices it manages.

Server Spooler

Windows Server 2003 accepts and delivers print jobs using a variety of protocols to serve a diversity of client computers and print devices. The server spooler is the primary component of network printing architecture on Windows Server 2003. The server spooler and its components are consolidated into a single architecture, providing smooth background printing by using background thread processing. Because the thread processing for one print job must complete before the processing begins for the next print job, the spooler passes data to the printer only when the printer is ready to receive more data.

The following figure illustrates the server spooler and how it processes a print job.

Components of Windows Server 2003 Print Server

Components of Windows Server 2003 Print Server

The following table defines the components of network printing on Windows Server 2003.

Components of Network Printing on Windows Server 2003

Component Description

Print Spooler Service

Manages the printing process, which includes retrieving the location of the correct printer driver, loading the driver, spooling high-level function calls into a print job, scheduling the print job for printing, and so on.

Print Router

Routes print jobs. The print router determines which print provider to call based on a printer name or other information supplied with the print job.

Local Print Provider

Provides job control and printer management capabilities for all printers that are accessed through the print monitors of the local print provider.

Print Monitor

Directs print jobs to the language monitor and port monitor.

Language Monitor

Provides bidirectional communication between the print device and the client.

Local and Remote Port Monitors

Sends print jobs to print devices that are attached to local and remote ports.

Graphics Device Interface (GDI)

Provides services to the printer driver, including caching, client-server communications, and character conversion.

Printer Driver

Communicates with print devices to generate output from data supplied by the GDI.

Remote Print Provider

Directs print jobs to remote print servers.

Local Print Device

Prints device-specific data. This device is attached to a local port on the server.

Remote Print Device

Prints device-specific data. This device is directly connected to the network and managed by this print server.

Remote Print Server

Accepts print jobs for print devices it manages.

Network Printing Protocols

The following protocols are used by Windows Server 2003 when providing network print services. Note that some protocols might not be used, depending on the needs of the client computers.

Server Message Block (SMB)

A file-sharing protocol designed to allow network computers to transparently access files that reside on remote systems over a variety of networks. The SMB protocol defines a series of commands that pass information between computers. SMB uses four message types: session control, file, printer, and message.

Line Printer Remote (LPR)

A connectivity tool that runs on client computers and that is used to print files to a computer running a Line Printer Daemon (LPD) server.

Line Printer Daemon (LPD)

A service on a print server that receives print jobs from Line Printer Remote (LPR) tools that are running on client computers.

remote procedure call (RPC)

A message-passing facility that allows a distributed application to call services that are available on various computers on a network. Used during remote administration of computers.

Internetwork Packet Exchange (IPX)

A network protocol native to NetWare that controls addressing and routing of packets within and between local area networks (LANs). IPX does not guarantee that a message will be complete (no lost packets).

Internet Printing Protocol (IPP)

The protocol that uses the Hypertext Transfer Protocol (HTTP) to send print jobs to printers throughout the world. Windows 2000, Windows XP, and Windows Server 2003 support Internet Printing Protocol (IPP) version 1.0.

Transmission Control Protocol/Internet Protocol (TCP/IP)

A set of networking protocols widely used on the Internet that provides communications across interconnected networks of computers with diverse hardware architectures and various operating systems. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic.


The set of network protocols on which AppleTalk network architecture is based. The AppleTalk Protocol is installed with Services for Macintosh to help users’ access resources on a network.

Simple Network Management Protocol (SNMP)

A network protocol used to manage TCP/IP networks. In Windows, the SNMP service is used to provide status information about a host on a TCP/IP network.

Network Printing Processes and Interactions

This section briefly describes the network printing process on the client and then the server, followed by a more detailed description of the components and their activities. This section describes a fully functional network with all required software installed on the server and the clients. It also assumes that the print server is running Windows Server 2003.

The components and processes involved in printing vary depending on the client and the operating system, even within the Windows family of operating systems. Because of differences between print clients, the components used in the server process can also vary. Since the following description of the printing process is simplified, the print clients can be grouped into Windows and non-Windows platforms.

Client Computers Running a Windows Operating System

On client computers running Windows 2000 or Windows XP operating systems, the client spooler sends an enhanced metafile (EMF) through the client spooler to the spooler on the print server.

The client spooler forwards information and data from the GDI and the printer driver as an EMF to the spooler on the print server. The client spooler does this by making a remote procedure call (RPC) to the server spooler (Spoolsv.exe), which makes a direct application programming interface (API) call to the print router (Spoolss.dll). The print router polls the remote print providers, and the remote print provider (Win32spl.dll) makes an RPC to the server spooler, which receives the print job over the network.

On clients running Windows 95, Windows 98, or Windows Millennium Edition, a Windows-based application creates an EMF, which is then rendered to a page description language (PDL). Next, the print job is sent to a local printer port, where it would go if printing to a local printer, by the Server Message Block (SMB) redirector. The redirector delivers the job to the print server service running on the print server.

On clients running Windows NT 4.0, applications create output in a page-description language (PDL). Next, the PDL data is sent with an RPC over SMB to the server spooler.

Client Computers Running a Non-Windows Operating System

On client computers running a non-Windows operating system, or using an application that is designed for a non-Windows operating system, a software component performs functions similar to that of the Graphics Device Interface (GDI). Next, the device information and print data are sent to the print server. Windows Server 2003 can accept print jobs sent from a client using Line Printer Remote (LPR), AppleTalk, and NetWare when the server is running, respectively, the Line Printer Daemon (LPD) service, Print Server for Macintosh, or File and Print Services for NetWare. Typically, such clients would be running UNIX, Apple Macintosh, and NetWare, though additional software could enable them to use a protocol associated with a different system. Also, a client might send a print job by using Internet Printing Protocol (IPP).

On the print server, the service that initially receives incoming print jobs depends on the protocol used by the client to submit the print job. Print jobs sent by way of AppleTalk are received by the Service for Macintosh component, print jobs sent by way of LPR are received by the LPD service, and print jobs sent by way of SMB are received by the Server service.

However, print jobs from most client computers running Windows are received by the Spooler service by way of RPC. This includes print jobs from client computers running Windows 2000 and Windows XP, and it is print jobs from such clients that this section describes.

The Spooler service, Spoolsv.exe, is an executable file that is installed as a service. The spooler is loaded when the operating system starts, and it continues to run until the operating system is shut down. The Spooler service manages the printing process, which includes such tasks as retrieving the location of the correct printer driver, loading that driver, spooling high-level function calls into a print job, and scheduling the print job for printing. When the tasks for a particular print job are complete, the Spooler service passes the job to the router.

The spooler router, Spoolss.dll, determines which print provider to call, based on a printer name or other information provided with the print job. If the print job is for a printer served by the local server, the provider is the local print provider, Localspl.dll; if the print job is for a printer served by a remote server, the job is routed to a remote print provider.

The print provider is the software that supports the specified print device. The local print provider, Localspl.dll, actually calls the printer driver to render the print job. The print provider is also responsible for spooling the print job.

After a print job is spooled, it is the Print Monitor that directs the output to the appropriate port monitor. Port monitors provide a communications path between the print spooler and the port drivers that access the port hardware. Port monitors serve both local print devices connected directly to the server and remote print devices connected directly to the network.

In addition to the port monitor, when the target print device supports two-way communication, a language monitor provides a communication path for configuration and status information. The language monitor supports delivery of unsolicited information from the printer, for example, notice that it has run out of paper.

Printing Components in Detail

The following sections cover in greater detail some of the components on the client and server involved in network printing.

Remote Print Provider

When the server spooler receives a print job from the client spooler, the print router queries the remote print providers, and gives control of the print job to the first provider that recognizes the destination printer. Remote print providers can be created by other companies; Microsoft supplies the following three remote print providers:


Win32spl.dll is the remote print provider on a Windows-based network. Win32spl.dll sends jobs to print servers running Windows NT 4.0 or Windows for Workgroups. For a print server running Windows Server 2003, Win32spl.dll makes an RPC to the spooler on the server (Spoolsv.exe), which makes a call to the print router (Spoolss.dll). The print router receives the job over the network and passes it to the local print provider as if a local client had submitted it.


Inetpp.dll performs specific processing on Internet print servers. For an Internet print server, Inetpp.dll recognizes the printer name by its URL and submits the print job to the appropriate printer by using IPP.


Nwprovau.dll performs specific processing on NetWare print servers. For a NetWare print server, Nwprovau.dll recognizes the printer name when the print router on the print server running Windows Server 2003 polls it. Nwprovau.dll takes control of the print job and sends a message to the NetWare Workstation Service, which in turn passes control to the NetWare redirector. The NetWare redirector sends the print job to the NetWare print server.

When submitting a document for printing, the application communicates with the client side of the spooler (Winspool.drv). Winspool.drv makes an RPC connection to the server side of the spooler (Spoolsv.exe), which makes a direct API call to the print router (Spoolss.dll), which is also on the server side of the spooler. The print router passes the print job to the local print provider.

Graphics Device Interface (GDI)

The GDI calls the printer driver and provides information about the type of printer needed and the data type used. The printer driver responds by sending printer data to the GDI, which the GDI passes to the spooler.

Computers running Windows 2000, Windows XP Professional, and any 32-bit version of Windows Server 2003 can run 16-bit applications through a process called Windows on Windows (WOW). WOW allows 16-bit applications to run on an x86-based computer.

WOW interacts with the applications through the GDI and with printer drivers through the device driver interface (DDI). The GDI also provides services to the printer driver, including caching, client and server communications, and conversion from American National Standards Institute (ANSI) character set to Unicode.


  • The 64-bit versions of Windows XP Professional and Windows Server 2003 do not support 16-bit applications. However, WOW 64 does allow 32-bit applications to run on 64-bit versions of Windows XP Professional and Windows Server 2003.

Printer Drivers

A printer driver is a software program that understands how to communicate with printers and plotters (devices used to draw charts, diagrams, and other line-based graphics). Printer drivers translate the information that an application sends through the GDI into drawing commands that the printer understands. These drawing commands are for creating text and graphics. Various drivers must be installed on the print server to support different hardware and operating systems. For example, an administrator who uses a computer that is running Windows Server 2003 and who shares a printer with clients that are running Windows 95, Windows 98, and Windows Millennium Edition, might need to install the appropriate drivers so that clients that are running these versions of Windows are not prompted to install the missing drivers.

The printer driver sends information about the printer settings, including the specifications that are needed to produce each character of the document, to the GDI. The printer driver also transmits helper services or utilities required to make the output print correctly.

Some kernel-mode printer drivers might cause the system to stop responding. Windows Server 2003 gives you the ability to control the installation of printer drivers. By default, all editions of Windows Server 2003 block the installation of kernel-mode drivers, but you can allow their installation by disabling the Group Policy setting Disallow installation of printers using Kernel Mode drivers. This setting affects only the installation of new kernel-mode drivers. If you are upgrading your system, existing kernel-mode drivers are unaffected.

Windows Server 2003 provides the following three generic printer drivers:

  • Universal (Unidriver)

  • PostScript

  • HP-GL/2 plotter

Universal printer driver (Unidriver)

The Unidriver is also called the raster driver because it supports raster (bitmap) graphics printing and is compatible with many printers. This driver supports the following features:

  • Color printing at various depths, such as 4 bits per pixel (bpp), 8 bpp, and 24 bpp.

  • Scalable TrueType and OpenType fonts, device fonts (including double-byte), grayscale printing, font substitution, run length encoding (RLE), Tag Image File Format (TIFF) version 4.0, and Delta Row Compression (DRC).

  • An extension interface that allows printer manufacturers to customize the driver for specific models.

  • Vector graphics languages HP-GL/2 and PCL-XL, monochrome, and color. This is a change from the version of Unidriver that shipped with Windows 2000. (The added HP-GL/2 support, which is used with normal PCL5e printers, is different from the HP-GL/2 for plotters, which is used only for plotters.)

The Unidriver contains the following component files:

  • Unidrv.dll is the printer graphics driver file for printer languages based on raster images, including most inkjet and dot-matrix printer languages.

  • Unidrvui.dll is the configuration file. It displays the user interface for Unidrv.dll.

  • Unires.dll, Stdnames.gpd, Ttfsub.gpd and some other support files.

  • Raster minidriver, which has the file name extension .gpd, is the data file, and is also called the characterization file. The file name depends on the printer or printer family.

PostScript printer driver

The Windows Server 2003 PostScript driver sets up the print jobs for printers that have an onboard PostScript interpreter. This driver automatically supports key features — including binary transfer compression, resolution, and paper source — for printers reporting as PostScript levels 1, 2, and 3. Its output is fully compliant with Document Structuring Convention (DSC) 3.0, a structural specification for PostScript documents.

This driver contains the following component files:

  • Pscript5.dll is the driver file.

  • Ps5ui.dll is the configuration file. It displays the user interface for the driver file, reports device capabilities to applications, and handles DevMode settings. Ps5ui.dll also allows you to enable TrueType and OpenType font substitution and image color matching and to determine whether color matching needs to be done on the host or on the printer.

  • The data file, which has the file name extension .ppd, is also known as a characterization file. The file name preceding the .ppd extension varies and is typically determined by the printer manufacturer. PPD files are the only printer driver files that are generally binary-compatible across processors and platforms.

HP-GL/2 plotter driver

The Windows Server 2003 plotter driver supports diverse plotters that use the HP-GL/2 language; however, Windows Server 2003 does not support HP-GL. The output from an HP-GL/2 driver requires a plotting device that can process all the enhancements built into the HP-GL/2 language.

This driver contains the following component files:

  • Plotter.dll is the driver file.

  • Plotui.dll is the configuration file. It displays the user interface for Plotter.dll.

  • The driver contains a data file, which has the file name extension .pcd. The file name preceding the .pcd extension varies and is typically determined by the plotter manufacturer.

Local Print Provider

The local print provider, Localspl.dll, writes the job data to a spool (.spl) file. It also tracks administrative information, such as user name, document name, and data type, in a shadow (.shd) file. Spooling protects a print job by saving it on disk. If a power failure or other disaster occurs before all jobs in the queue are printed, the .spl and .shd files preserve the documents and prevent loss of data after processing resumes.


  • If the print job is only partially saved to disk, the spooler might recognize the print job as corrupt and delete it upon restart.

Next, Localspl.dll polls the print processors for recognition of the document data type. If no data type has been set, Localspl.dll receives the job and uses the default data type.

By default, .spl and .shd files are written to the folder systemroot\System32\Spool\Printers, and they are deleted after the job prints. If the hard disk partition containing Windows Server 2003 does not have enough space for these files, you can change the location of the folder. You might also move the spool files if you want to move the spooling load to a separate disk array.


  • Do not attempt to spool to the root of a disk, such as D:\. This causes the files to spool to the old default spool folder.

The print processor is a part of the spooler process. If the job type is EMF, the print processor works with GDI to move the spooled print jobs from the hard disk to the printer driver. If the data type is RAW, the print processor helps in moving the job directly to the printer. The print processor controls certain features of the print job, depending on the kind of job. For example, if the data type of the spooled job is EMF, the print processor can help in printing the document in reverse order or it can print it in booklet form instead of the default one-page-per-sheet form. Winprint.dll is the name of the default print processor on Windows Server 2003. Winprint.dll is part of Localspl.dll.

Software vendors can develop their own print processors for custom data types. A printer vendor can also develop a custom print processor if the vendor has its own printer driver or supports a data type other than the three that WinPrint.dll supports. Also, a vendor can write a custom print processor if the vendor wants to add functionality that Winprint.dll does not provide. Usually, the print processor is installed when the printer driver is installed.

Windows Server 2003 supports two kinds of print monitors:

  • Language monitors

  • Port monitors

    Port monitors are further subdivided into:

    • Local port monitors

    • Remote port monitors

Language monitor

The language monitor provides the common language that is needed for the client and printer to understand each other in bidirectional communication so that you can configure the printer and monitor printer status. You can request configuration and status from the printer, and the printer can send unsolicited status information (such as “Paper tray empty”) to the client.

Windows Server 2003 includes Pjlmon.dll, a language monitor that uses Printer Job Language (PJL). PJL is the language that implements the bidirectional communication; it does this by using a parallel port connection, such as one between a Hewlett-Packard LaserJet 5Si and the computer. Any bidirectional printer that uses PJL can use Pjlmon.dll.

If a printer uses a different printer language, the vendor can develop a language monitor for it. A vendor might also develop a language monitor to add data, such as printer-specific control information, to the print stream that is going to a unidirectional printer.

To take advantage of bidirectional printing, you need a bidirectional printer, and a correctly configured bidirectional port and port monitor. The standard port monitor supports bidirectional communication by default.

Local port monitor

The local port monitor controls parallel and serial input/output (I/O) ports where a printer might be attached. The local port monitor sends print jobs to local devices, including those on familiar ports such as LPT1, COM1, or FILE (Print to File).

A second local port monitor, Usbmon.dll, controls communication through universal serial bus (USB) ports. Usbmon.dll installs automatically whenever you plug a USB printer into the correct physical port on your computer. If USB has been enabled in the BIOS, Windows XP Professional detects the device and displays its settings on the screen.

Installation opens the USB Root Hub and a generic USB printer port (for example, USB001, USB002), and copies the printer Plug and Play driver.

Remote port monitors

All other port monitors that are supplied with Windows Server 2003 are remote monitors that enable printing to remote printers. An example is the standard TCP/IP port monitor.

Network Ports Used by Network Printing

The following table lists services used in network printing and the protocols they provide in the network printing process. Not all services are installed or active at all times, and the protocols used in network printing depend on the type of clients submitting jobs to the print server.

Port Assignments for Network Printing

Service Name UDP TCP

Services for Macintosh (uses AppleTalk)

201, 202, 204, 206

201, 202, 204, 206

Internet Printing Protocol (uses HTTP)



NWLink (uses IPX/SPX)



LPDSVC (accepts LPR)



LPR Port (sends LPR)

721-731, >1023

721-731, >1023

Server (using SMB)

137, 138


Server (using RPC)



Standard Port Monitor (using SNMP)

161, 162

161, 162

Standard Port Monitor (using LPR)

> 1023

> 1023

Standard Port Monitor (using RAW)

2000, 2501-2503, 3001, 6869, >=9100

2000, 2501, 2503, 3001, 6869, >=9100

Standard LPR, according to RFC 1179 from the Internet Engineering Task Force, uses ports 721 through 731 to send data. However, Windows Server 2003 can be configured on a per-port or per-server basis to use port number higher than 1023 for sending data with LPR.

Also different from RFC 1179 is the standard port monitor, which sends documents to a printer by using either the RAW or LPR printing protocol. Together, these protocols support most current TCP/IP printers.

The RAW protocol is the default print protocol for most print devices. To send a job formatted with RAW, the print server opens a TCP stream to the printer's port 9100 or another port number and selects the connections to multiport external devices. For example, on certain print devices port 9101 goes to the first parallel port, 9102 goes to the second parallel port, and so on.

The standard port monitor uses the LPR protocol when you specify LPR protocol during port installation or reconfiguration, or when the RAW protocol cannot be established.

The standard port monitor deviates from the LPR standard in the following ways:

  • The standard port monitor does not conform to the RFC 1179 requirement that the source TCP port must lie between port 721 and port 731. The standard port monitor uses ports from the general, unreserved pool of ports (1024 and above).

  • The standard port monitor sends a print job to the spooler without determining the actual job size and designates a default job size, regardless of the actual size of the job. The LPR standard states that print jobs must include information about the size of the job the port monitor sends. Sending a print job that contains job size information requires that the port monitor spool the job twice — once to determine size, and once to send the job to the spooler. Spooling the job once, by using the standard port monitor, improves printing performance.

The following resource contains additional information that is relevant to this section.

  • RFC 1179 in the IEFC RFC Database