No Printers Installed Error; Print Spooler Hangs & PC Stops Respon

We're a Windows XP Pro shop running Office 2007 Enterprise. All systems have
the most recent patches/updates as made available on the Microsoft Update
website. WSUS also helps keep us up to date.
We also use McAfee with ePO as our Antivirus & HIPS (running in adaptive
mode) solution.

We've seen an increase in the number of calls from our users stating that
when they try to print (from Outlook 2007 to Notepad to whatever), they
receive an error stating that there are no printers installed. Not only is a
default printer installed & defined, they have multiple printers installed
ranging from the Lexmark T644 next to them, the Xerox WorkCentre Pro 55's &
DocuColor3535 PS's down the hall and to the handful of virtual printers for
PDF conversions.

When users receive this error, the machine no longer responds correctly to
mouse clicks and other actions; In most cases, Explorer.exe seems to crash or
hang entirely. When this happens, or rather after, there are no *.SHD or
*.SPL files in %WINDIR%\System32\Spool\PRINTERS, and wiping out that
location, along with all the printers, and readding them doesn't permanently
fix the problem. It only fixes it for that moment, a few hours, maybe even
the day.

When the machine is in its hung state, restarting the print spooler seems to
fix this problem, but again, not permanently. While its good to know for a
quick fix, its not clear what caused this problem to begin with, and because
it can happen multiple times a day, nearly every day, its a problem.
Now, when we stop the print spooler, the stopping service message sits on
screen seemingly forever. After waiting a considerable amount of time, we
click close and upon inspection, the service is stopped. We click start, and
a few moments later its running. Immediately after it enters the running
state, the various actions that were queued up during the hung state process.
The Start Menu pops up and down a few times, and other mouse clicks execute.
We investigated the Event Viewer and found the following:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 10/20/2009
Time: 9:38:48 AM
User: N/A
Computer: XX-YYY-123456
Description: Timeout (30000 milliseconds) waiting for a transaction response
from the Spooler service.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 10/20/2009
Time: 9:39:18 AM
User: N/A
Computer: XX-YYY-123456
Description: Timeout (30000 milliseconds) waiting for a transaction response
from the service.
---------

Related to this, the week before we started seeing the 'No Printers
Installed' error, we received a number of calls from users telling us that
their machines hung during the login process once entering their credentials.
Waiting even 20 minutes didn't fix the problem, and rebooting the machine
took care of it. We have a lengthy login script so I added lines
surrounding, and within, the various functions, calls, WMI queries etc within
to figure out what might be causing the problem. Turns out, when the script
got to the point where it enumerated the printer list via WMI calls, it hung
the machine. (Code at the bottom.) Once I commented out this code, users
were logging in fine, and upon checking their machines, we found the same
Spooler timeout error above at a time that correlated to when the login
script reached that point.

Sounds to me like we have a possible spooler problem, or maybe there's
something interefering with it. Aside from removing & readding printers and
their drivers, I'm not quite sure where else to look, or why this only
affects a small percentage of our population, and more importantly, all of a
sudden.

If things weren't complicated enough already: one of my highly esteemed
colleagues deleted a file shortly after logging on, and found that his
machine froze. On a whim he restarted his spooler service and the system
resumed normal operation. This same colleague pointed out that the McAfee
HIPS policy is enabled on our machines in adaptive mode and after some quick
Googling, it appears it could be the culprit.

http://community.mcafee.com/showthread.php?p=566656
http://forums.mcafeehelp.com/showthread.php?t=232978

We've reached a point where we're looking for suggestions on how to
troubleshoot spooler related issues. Is there a verbose logging element we
can tap into? Is there anyway we can have something running in the
background logging all process creations, hooks, API calls, WMI queries etc
that we could refer to once we run into this problem?

We're open to suggestions on what else we should be looking at and trying,
other than what's already been mentioned. Bottom line, none of these are
[permanently] fixing the problem: deleting & readding printers, reinstalling
print drivers, creating a new profiles, rebooting, restarting the spooler,
clearing hung jobs in the queue, clearing *.SHD or *.SPL files, reimaging
the computer, switching print servers.


//*Login Script Snippet that Caused the Login Process to Hang
login_printer_list= ""
Set colSettings = objWMIService.ExecQuery ("Select * from Win32_Printer")
' I previously had a 'debug' function that would write to a log file
' just before the For Each statment listing. While the log
' contained the line stating it was starting the process...
For Each objWMI_Item in colSettings
' It didn't process anything beyond the above code. Where this
' comment is, I had another line where it would output
' objWMI_Item.name in the debug log.
' Needless to say, the log didn't contain anything in or after this
' For loop, and the script halted entirely.
' Restarting the spooler, even during the login process,
' unhangs' the machine.
login_printer_list= login_printer_list & "--" & objWMI_Item.name
If objWMI_Item.Default = True Then login_default_printer=objWMI_Item.name
Next
---EOF

Any help is greatly appreciated.


--
Julius G. Perkins, IV
Enterprise Systems
Workstation Architect

Monitor the CPU utilization when the machines are unresponsive may show that
the spoolsv.exe process or explorer.exe process is using all the CPU cycles.

If the printers "go away" this normally indicates the spooler service has
terminated.

Most spooler failures are caused by print drivers corrupting the memory used
by the spooler process.

You will only have print jobs in system32\spool\printers for local printers.

Are there a drwatsn32.log file in windows\? If there is open it up and
search for FAULT (case matching). There will be a stack trace of the
failure. send it back to this post.

I'll be out for a week so I can't respond immediately. Hopefully more
information can lead you to the solution.
--
Alan Morris
Windows Printing Team
Search the Microsoft Knowledge Base he
http://support.microsoft.com/search/?adv=1

This posting is provided "AS IS" with no warranties, and confers no rights.

"JuliusPIV" wrote in message
...
We're a Windows XP Pro shop running Office 2007 Enterprise. All systems
have
the most recent patches/updates as made available on the Microsoft Update
website. WSUS also helps keep us up to date.
We also use McAfee with ePO as our Antivirus & HIPS (running in adaptive
mode) solution.

We've seen an increase in the number of calls from our users stating that
when they try to print (from Outlook 2007 to Notepad to whatever), they
receive an error stating that there are no printers installed. Not only
is a
default printer installed & defined, they have multiple printers installed
ranging from the Lexmark T644 next to them, the Xerox WorkCentre Pro 55's
&
DocuColor3535 PS's down the hall and to the handful of virtual printers
for
PDF conversions.

When users receive this error, the machine no longer responds correctly to
mouse clicks and other actions; In most cases, Explorer.exe seems to crash
or
hang entirely. When this happens, or rather after, there are no *.SHD or
*.SPL files in %WINDIR%\System32\Spool\PRINTERS, and wiping out that
location, along with all the printers, and readding them doesn't
permanently
fix the problem. It only fixes it for that moment, a few hours, maybe
even
the day.

When the machine is in its hung state, restarting the print spooler seems
to
fix this problem, but again, not permanently. While its good to know for
a
quick fix, its not clear what caused this problem to begin with, and
because
it can happen multiple times a day, nearly every day, its a problem.
Now, when we stop the print spooler, the stopping service message sits on
screen seemingly forever. After waiting a considerable amount of time, we
click close and upon inspection, the service is stopped. We click start,
and
a few moments later its running. Immediately after it enters the running
state, the various actions that were queued up during the hung state
process.
The Start Menu pops up and down a few times, and other mouse clicks
execute.
We investigated the Event Viewer and found the following:

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 10/20/2009
Time: 9:38:48 AM
User: N/A
Computer: XX-YYY-123456
Description: Timeout (30000 milliseconds) waiting for a transaction
response
from the Spooler service.

Event Type: Error
Event Source: Service Control Manager
Event Category: None
Event ID: 7011
Date: 10/20/2009
Time: 9:39:18 AM
User: N/A
Computer: XX-YYY-123456
Description: Timeout (30000 milliseconds) waiting for a transaction
response
from the service.
---------

Related to this, the week before we started seeing the 'No Printers
Installed' error, we received a number of calls from users telling us that
their machines hung during the login process once entering their
credentials.
Waiting even 20 minutes didn't fix the problem, and rebooting the machine
took care of it. We have a lengthy login script so I added lines
surrounding, and within, the various functions, calls, WMI queries etc
within
to figure out what might be causing the problem. Turns out, when the
script
got to the point where it enumerated the printer list via WMI calls, it
hung
the machine. (Code at the bottom.) Once I commented out this code, users
were logging in fine, and upon checking their machines, we found the same
Spooler timeout error above at a time that correlated to when the login
script reached that point.

Sounds to me like we have a possible spooler problem, or maybe there's
something interefering with it. Aside from removing & readding printers
and
their drivers, I'm not quite sure where else to look, or why this only
affects a small percentage of our population, and more importantly, all of
a
sudden.

If things weren't complicated enough already: one of my highly esteemed
colleagues deleted a file shortly after logging on, and found that his
machine froze. On a whim he restarted his spooler service and the system
resumed normal operation. This same colleague pointed out that the McAfee
HIPS policy is enabled on our machines in adaptive mode and after some
quick
Googling, it appears it could be the culprit.

http://community.mcafee.com/showthread.php?p=566656
http://forums.mcafeehelp.com/showthread.php?t=232978

We've reached a point where we're looking for suggestions on how to
troubleshoot spooler related issues. Is there a verbose logging element
we
can tap into? Is there anyway we can have something running in the
background logging all process creations, hooks, API calls, WMI queries
etc
that we could refer to once we run into this problem?

We're open to suggestions on what else we should be looking at and trying,
other than what's already been mentioned. Bottom line, none of these are
[permanently] fixing the problem: deleting & readding printers,
reinstalling
print drivers, creating a new profiles, rebooting, restarting the spooler,
clearing hung jobs in the queue, clearing *.SHD or *.SPL files, reimaging
the computer, switching print servers.


//*Login Script Snippet that Caused the Login Process to Hang
login_printer_list= ""
Set colSettings = objWMIService.ExecQuery ("Select * from Win32_Printer")
' I previously had a 'debug' function that would write to a log file
' just before the For Each statment listing. While the log
' contained the line stating it was starting the process...
For Each objWMI_Item in colSettings
' It didn't process anything beyond the above code. Where this
' comment is, I had another line where it would output
' objWMI_Item.name in the debug log.
' Needless to say, the log didn't contain anything in or after this
' For loop, and the script halted entirely.
' Restarting the spooler, even during the login process,
' unhangs' the machine.
login_printer_list= login_printer_list & "--" & objWMI_Item.name
If objWMI_Item.Default = True Then login_default_printer=objWMI_Item.name
Next
---EOF

Any help is greatly appreciated.


--
Julius G. Perkins, IV
Enterprise Systems
Workstation Architect