This chapter covers troubleshooting print spooler issues on Windows systems, a common scenario in CompTIA A+ 220-1102 exam domain 3.1 (Software Troubleshooting). Print spooler problems account for roughly 5–10% of exam questions, often appearing as performance or connectivity issues. Mastering spooler troubleshooting is critical because it affects all network and local printing, a core responsibility of IT support. We'll dissect the spooler's architecture, common failure modes, and step-by-step diagnostic procedures.
Jump to a section
Think of the print spooler like the order rack in a busy restaurant kitchen. When a server (application) takes a customer's order (print job), they don't hand it directly to the chef (printer). Instead, they clip it onto a metal rack (spooler queue) in chronological order. The rack holds multiple orders at once, each with its own ticket (job ID and metadata like pages, copies, collation). The head chef (spooler service) pulls orders from the rack one by one and calls them out to the line cooks (printer drivers and language monitors). If the chef gets a bad order—say, illegible handwriting (corrupt job data)—the order might get stuck on the rack, blocking all orders behind it. The chef can manually remove that ticket (cancel the job) or, if the rack itself is jammed (spooler service hung), must clear the entire rack and restart the process (restart spooler service). Sometimes the kitchen runs out of tickets (disk full), so new orders can't be clipped. Or the chef might be trying to send orders to a station that's closed (printer offline), causing a backlog. The order rack is the central coordination point that decouples the fast-paced server side from the slower, mechanical printer side, just as the spooler decouples application print calls from physical printer output.
What is the Print Spooler and Why Does It Exist?
The print spooler (spoolsv.exe) is a Windows service that manages print jobs sent to local or network printers. Its primary purpose is to decouple application printing from physical printer output. Without a spooler, an application would have to wait for the printer to finish each page before sending the next, blocking the application. The spooler stores print jobs on disk as temporary files (spool files) and feeds them to the printer at the printer's speed. It also handles multiple concurrent print jobs from different applications and users, queuing them in order.
How the Print Spooler Works Internally
When a user clicks Print:
1. The application calls the Graphics Device Interface (GDI) or Windows Print API, which creates an Enhanced Metafile (EMF) or raw printer data (PCL, PostScript, XPS).
2. The print processor (e.g., winprint.dll) converts the data into a spool file format. Two types of spool files exist: SHD (shadow file, containing metadata like job ID, owner, priority) and SPL (spool file, containing the actual print data).
3. The spooler service (spoolsv.exe) writes these files to the spool directory, typically %systemroot%\System32\spool\PRINTERS\.
4. The router (spoolss.dll) determines the print provider: local (localspl.dll) or network (win32spl.dll).
5. The print provider sends the job to the print processor, which renders the data into the printer's language.
6. The language monitor (e.g., pjlmon.dll for HP printers) handles bidirectional communication with the printer.
7. The port monitor (e.g., USBMON, TCPMON) sends the data to the physical port.
8. The printer receives the data and prints.
Key Components, Defaults, and Timers
Spooler Service: Runs as spoolsv.exe. Default startup type: Automatic. Recovery options: Restart the service after first failure, then restart the computer after subsequent failures.
Spool Directory: C:\Windows\System32\spool\PRINTERS\. This folder stores .SHD and .SPL files. If disk space runs low (< 100 MB free), new jobs may fail.
Default Spooler Behavior: "Spool print documents so program finishes printing faster" is default. "Start printing after last page is spooled" vs. "Start printing immediately" affects job completion time.
Job Priority: 1 (lowest) to 99 (highest). Default is 1.
Timeout Values: The spooler uses a default timeout of 60 seconds for retrying failed jobs. Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\ contains NetPrinterDecayPeriod (default 3600 seconds) and PortThreadTimeout (default 60000 ms).
Event Log: Spooler errors are logged in System event log under source "Print" or "Spooler".
Configuration and Verification Commands
net start spooler / net stop spooler – Start/stop the spooler service from command line.
sc query spooler – Query the spooler service status.
print /d:\\server\printer filename – Send a file directly to a printer.
rundll32 printui.dll,PrintUIEntry /il – Install a printer.
prnmngr.vbs – VBScript for managing printers.
PowerShell: Get-Service -Name Spooler, Restart-Service -Name Spooler -Force.
Spooler Logging: Enable spooler debug logging via registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Debug – create LogFile (REG_SZ) and set LogLevel (REG_DWORD) to 1.
How the Spooler Interacts with Related Technologies
Group Policy: Policies like "Do not allow installation of printers using kernel-mode drivers" or "Allow printer drivers that match the OS version" affect spooler stability.
Driver Signing: Unsigned drivers can cause spooler crashes. Windows 10/11 enforce driver signing by default.
Print Server Role: On Windows Server, the Print and Document Services role includes the spooler, print queue management, and web-based printing.
XPS vs. GDI: XPS-based printing uses the XPS print path, which bypasses the GDI and uses XML-based spool files. This can cause compatibility issues with older printers.
Virtual Printers: Microsoft Print to PDF, OneNote, and fax use the spooler but redirect output to files or applications.
Common Spooler Issues
Spooler Service Crashes: Often due to corrupt printer drivers. Symptoms: All printers disappear from Devices and Printers, jobs stuck in queue. Fix: Restart spooler, update or remove problematic driver.
Print Jobs Stuck in Queue: Caused by corrupt spool files, printer offline, or insufficient permissions. Fix: Clear spool folder manually after stopping spooler.
Spooler Won't Start: Corrupt spooler files, missing dependencies (RPCSS, HTTP), or malware. Fix: Check dependencies, run system file checker (sfc /scannow), scan for malware.
Permission Errors: User needs "Manage documents" permission on the printer to pause/resume/cancel jobs. Default: Creator Owner has manage permissions.
Disk Full: Spool directory fills up with .SPL files. Fix: Clean old files, move spool location to another drive via registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory.
Network Printing Issues: Printer disconnected, TCP/IP port misconfigured, or SNMP status enabled but unreachable. Fix: Verify port settings, disable SNMP status if not needed.
Troubleshooting Methodology
Identify Symptoms: User reports "can't print" or "job stuck in queue". Check other users and printers to isolate.
Check Spooler Status: Run services.msc or net start spooler. If not running, start it.
Clear Stuck Jobs: Stop spooler, delete files from %windir%\system32\spool\PRINTERS\, restart spooler.
Check Event Log: Look for event ID 20 (error), 10 (information), or 808 (driver failure).
Update/Reinstall Driver: Go to Print Management console, remove all printer drivers, reinstall.
Check Disk Space: Ensure spool directory has sufficient free space.
Check Permissions: Ensure user has print permissions.
Run Printer Troubleshooter: Built-in Windows troubleshooter can reset spooler and clear queue.
Advanced: Spooler in Network Environments
In domain environments, print servers centralize spooler management. Group Policy can deploy printers and restrict spooler settings. The spooler service on the print server handles all jobs, reducing load on client machines. Issues often arise from driver mismatches between server and client (architecture mismatch, e.g., x86 driver on x64 server). The spooler uses RPC (Remote Procedure Call) to communicate with clients; firewall rules must allow RPC endpoints (ports 135 and dynamic high ports).
Summary of Key Values
Spooler service executable: spoolsv.exe
Default spool directory: %systemroot%\System32\spool\PRINTERS\
Spool file extensions: .SHD (shadow), .SPL (spool)
Default print processor: winprint.dll
Default language monitor: pjlmon.dll (HP) or usbmon.dll (USB)
Event log: System, source Print/Spooler
Recovery: First failure restart service, second failure restart computer
This deep understanding of spooler internals will help you diagnose any spooler issue on the exam and in real-world support.
Identify Spooler Symptoms
Begin by gathering information from the user. Common symptoms: print jobs stuck in queue, printer shows 'error' or 'offline', applications freeze or crash when printing, or the spooler service stops unexpectedly. Check if the issue affects one printer or all printers. If all printers are affected, the spooler service is likely the problem. If only one printer, focus on that printer's driver or connection. Use Event Viewer to look for spooler-related events (source: Print, ID 20 for errors). Also check the spool directory for oversized or corrupt .SPL files. Document error messages like 'Print Spooler service is not running' or 'Unable to print'.
Verify Spooler Service Status
Open Services console (services.msc) and locate 'Print Spooler'. Check its status: should be 'Running' and startup type 'Automatic'. If stopped, right-click and start. If it fails to start, note the error message. Common errors: 'Access denied' (permissions), 'File not found' (corrupt files), or 'Dependency failed' (RPCSS or HTTP service not running). From command line, use `net start spooler` to see exact error. Also check dependencies: Remote Procedure Call (RPC) and HTTP service must be running. If the service starts but stops immediately, look for crashing drivers. Use `sc query spooler` to get detailed status.
Clear the Print Queue
If jobs are stuck, stop the spooler service (`net stop spooler`). Navigate to `C:\Windows\System32\spool\PRINTERS\` and delete all files (both .SHD and .SPL). Do NOT delete the folder itself. Then restart the spooler (`net start spooler`). This removes all queued jobs, including corrupt ones. On a print server, be careful — this clears all users' jobs. Alternatively, use Print Management console (printmanagement.msc) to clear individual jobs without stopping the service. After clearing, test printing from a simple application like Notepad to verify.
Check Disk Space and Permissions
The spool directory needs free space to write spool files. Ensure the drive has at least 100 MB free, preferably 1 GB or more. If low, move the spool directory to another drive via registry: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory`. Also check NTFS permissions on the spool folder: SYSTEM and Administrators should have Full Control; Print Operators group should have Modify. Users need 'Print' permission on the printer itself, not necessarily on the folder. Use `icacls` to verify: `icacls C:\Windows\System32\spool\PRINTERS`.
Update or Reinstall Printer Driver
Corrupt or incompatible printer drivers are the leading cause of spooler crashes. Open Print Management (printmanagement.msc), expand 'Print Servers', select your server, then 'Drivers'. Remove all drivers for the problematic printer. Download the latest driver from the manufacturer's website, ensuring it matches the OS architecture (x64 for 64-bit Windows). Install via 'Add Printer' or using `rundll32 printui.dll,PrintUIEntry /il`. For network printers, ensure the driver is signed and compatible with the OS version. After reinstalling, test print. If the spooler crashes again, the driver may still be faulty; try a different driver or use the Microsoft generic driver.
Check for Malware and System File Corruption
Malware can infect the spooler service or spool files. Run a full antivirus scan using Windows Defender or a third-party tool. Also run System File Checker (`sfc /scannow`) to repair corrupt system files. If sfc finds issues but cannot fix, run DISM (`DISM /Online /Cleanup-Image /RestoreHealth`). Additionally, check for third-party print monitors or spooler add-ons that may be incompatible. Use `msconfig` or Task Manager to disable startup programs that interact with printing. Finally, consider performing a clean boot to isolate the cause.
Enterprise Scenario 1: Centralized Print Server Spooler Crash
A large enterprise runs a Windows Server 2019 print server handling 500+ printers and 10,000 users. Suddenly, all users report they cannot print. The spooler service on the server has stopped. The IT team restarts it but it crashes again within minutes. Investigation reveals a corrupt printer driver installed by a user with local admin rights. The driver was unsigned and incompatible with the server OS. The fix: remove all third-party drivers, enforce driver signing via Group Policy, and restrict driver installation to IT staff only. Performance consideration: the spool directory must be on a fast SSD with ample space (at least 50 GB) to handle peak loads. Monitoring tools like PRTG or SCOM alert on spooler service failures. Misconfiguration: allowing users to install drivers can lead to spooler instability; best practice is to use Point and Print restrictions.
Enterprise Scenario 2: Stuck Jobs Due to Network Printer Offline
A mid-size company uses TCP/IP network printers. Users report that jobs are stuck in the queue and never print. The spooler is running, but jobs show 'Error - Printing'. Investigation reveals that the printer's IP address changed due to DHCP lease renewal, but the port configuration on the print server still points to the old IP. The fix: either assign a static IP to the printer or update the port in Print Management. Also, the SNMP status feature was enabled on the port, causing the spooler to wait for a response from the printer that never came (because the IP was wrong). Disabling SNMP status monitoring resolves the issue. Performance: for large print jobs, ensure the spool directory has enough space. Misconfiguration: using DHCP for printers without reservations leads to IP changes; always use DHCP reservations or static IPs.
Enterprise Scenario 3: Spooler Service Fails to Start After Windows Update
An organization deploys a Windows 10 feature update across 2000 workstations. After the update, many users cannot print because the spooler service fails to start with error '1079: The account specified for this service is different from the account specified for other services running in the same process'. This occurs because the update changed the spooler service's logon account from LocalSystem to a virtual account. The fix: open Services, go to Print Spooler properties, Log On tab, change to 'Local System account', and restart. Alternatively, use sc config spooler obj= "NT Authority\System". This is a known issue with certain cumulative updates. Misconfiguration: manually changing the spooler account to a domain user can cause similar failures. Always use LocalSystem.
What 220-1102 Tests on Print Spooler Issues
The exam objective 3.1 (Given a scenario, troubleshoot common Windows OS problems) includes print spooler issues. Specifically, you must know how to identify spooler symptoms (stuck jobs, service not running), clear the queue, restart the service, and update drivers. The exam expects you to know the spooler's role and common failure points.
Most Common Wrong Answers and Why Candidates Choose Them
Reinstall Windows: Candidates often jump to a full OS reinstall when the spooler fails. This is wrong because spooler issues are almost always fixable by restarting the service, clearing the queue, or updating drivers. Reinstalling is excessive and time-consuming.
Replace Printer: When jobs are stuck, candidates think the printer is broken. But the issue is usually software-side: corrupt spool files or driver problems. Always troubleshoot software first.
Disable Spooler: Some think disabling the spooler will allow direct printing. This is wrong because most applications require the spooler; without it, printing will fail. The correct action is to fix the spooler, not disable it.
Run Printer Troubleshooter Only: The built-in troubleshooter can fix some issues, but it may not resolve driver corruption or disk space issues. Candidates rely too heavily on automated tools. The exam tests manual steps like clearing the spool folder.
Specific Numbers, Values, and Terms on the Exam
Spooler service executable: spoolsv.exe
Default spool directory: %systemroot%\System32\spool\PRINTERS\
File extensions: .SHD and .SPL
Commands: net stop spooler, net start spooler
Event log source: Print or Spooler
Driver issues: kernel-mode driver crashes the spooler
Permission: 'Manage documents' permission allows canceling others' jobs
Edge Cases and Exceptions
Spooler on Windows Server Core: No GUI; must use PowerShell or CLI.
XPS Spooler: If XPS is enabled, spool files are .XPS format; clearing the queue still involves deleting files from the same folder.
Print Server in Cluster: Failover may cause spooler to be unavailable; check cluster resources.
Virtual Desktop Infrastructure (VDI): Spooler may be disabled to reduce resource usage; printing redirected to client.
SID History: After domain migration, permissions may break; check printer security.
How to Eliminate Wrong Answers
If a question says 'spooler service is not running', the first step is to start it, not reinstall drivers.
If jobs are stuck, clearing the queue is the fastest fix, not restarting the computer.
If the spooler crashes after installing a new printer, the driver is likely the cause; remove that printer driver.
Always consider disk space: if the spool directory is full, jobs fail.
For network printers, check the port configuration before blaming the spooler.
The print spooler service executable is spoolsv.exe.
Default spool directory: %systemroot%\System32\spool\PRINTERS\.
Spool files have .SHD (shadow) and .SPL (spool) extensions.
To clear stuck jobs: net stop spooler, delete files in spool\PRINTERS, net start spooler.
Corrupt printer drivers are the #1 cause of spooler crashes.
The spooler requires at least 100 MB free disk space to function.
Use Event Viewer (source: Print) to find spooler errors.
These come up on the exam all the time. Here's how to tell them apart.
Restart Spooler Service
Quick fix for service crashes
Loses all queued jobs
Does not remove corrupt spool files that may cause re-crash
Can be done remotely via PowerShell
May not fix underlying driver issue
Clear Spool Queue Manually
Targeted removal of corrupt jobs
Preserves other jobs if done selectively
Requires stopping the service first
More time-consuming
Allows inspection of spool files for corruption
Mistake
Clearing the print queue requires reinstalling the printer.
Correct
You can clear the queue by stopping the spooler service, deleting files from %windir%\System32\spool\PRINTERS\, and restarting the service. No need to reinstall the printer.
Mistake
The print spooler is only used for network printers.
Correct
The spooler handles both local and network printers. Even a USB printer uses the spooler to queue jobs.
Mistake
If the spooler service is stopped, you can still print directly to a locally connected printer.
Correct
Most applications rely on the spooler. Without it, print calls fail. Some command-line tools (e.g., `print /d:lpt1 file.txt`) may bypass the spooler, but this is rare and not typical.
Mistake
Print spooler issues are always caused by malware.
Correct
While malware can cause spooler problems, the most common causes are corrupt drivers, disk full, or service misconfiguration. Always check those first.
Mistake
Deleting the spool directory will fix all spooler issues.
Correct
Deleting the folder itself can cause the spooler to fail because it cannot create the directory. You should only delete the files inside the folder, not the folder.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
First, try canceling the job from the print queue window. If that fails, stop the spooler service (net stop spooler), delete all files from C:\Windows\System32\spool\PRINTERS\, then restart the spooler (net start spooler). This removes all queued jobs. On the exam, this is the correct answer for stuck jobs.
The most common cause is a corrupt or incompatible printer driver. When a driver crashes, it takes down the spooler service. Check Event Viewer for driver-related errors. Update or remove the problematic driver. Also check for malware or system file corruption using sfc /scannow.
.SHD (shadow) files contain metadata about the print job, such as job ID, owner, priority, and document name. .SPL (spool) files contain the actual print data (EMF, XPS, or raw printer commands). Both are needed for a job; if one is missing, the job is corrupt.
Yes. Edit the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers\DefaultSpoolDirectory and set it to a new path (e.g., D:\Spool). Then restart the spooler. This is useful if the system drive is low on space.
In Printer Properties > Security tab, add the user and grant them 'Manage documents' permission. This allows them to pause, resume, and cancel any user's jobs. By default, only the job creator has this permission.
Check dependencies (RPC and HTTP services must be running). Look for error messages in Event Viewer. Try starting from command line to see exact error. Run sfc /scannow to repair system files. If a recent driver install caused it, boot into Safe Mode and remove the driver.
Yes, the spooler can be started in Safe Mode. This is useful for troubleshooting because third-party drivers are not loaded. If the spooler works in Safe Mode but not normal mode, a third-party driver is likely the cause.
You've just covered Troubleshoot: Print Spooler Issues — now see how well it sticks with free 220-1102 practice questions. Full explanations included, no account needed.
Done with this chapter?