SBS 2003 Prem - SpoolSv.exe faulting regularly
Alan
Hi All,
The print spooler on our SBS 2003 Prem machine is faulting regularly
(around once a week or so with no pattern of time or cause that I can
discern so far- could be twice this week, and then nothing for a
fortnight).
An example of the details from the event viewer are as follows:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Event Type: Error
Event Source: Application Error
Event Category: (100)
Event ID: 1000
Date: 03/07/2006
Time: 15:17
User: N/A
Computer: MYSERVER
Description:
Faulting application spoolsv.exe, version 5.2.3790.1830, faulting
module rpcrt4.dll, version 5.2.3790.2568, fault address 0x0000f557.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 73 70 6f ure spo
0018: 6f 6c 73 76 2e 65 78 65 olsv.exe
0020: 20 35 2e 32 2e 33 37 39 5.2.379
0028: 30 2e 31 38 33 30 20 69 0.1830 i
0030: 6e 20 72 70 63 72 74 34 n rpcrt4
0038: 2e 64 6c 6c 20 35 2e 32 .dll 5.2
0040: 2e 33 37 39 30 2e 32 35 .3790.25
0048: 36 38 20 61 74 20 6f 66 68 at of
0050: 66 73 65 74 20 30 30 30 fset 000
0058: 30 66 35 35 37 0f557
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
I am wondering if I should re-install a copy of the rpcrt4.dll file?
If so, what is the right / best way to actually do that?
Am I barking up the wrong tree here? Is there something else I should
be looking at?
Thanks,
Alan.
--
The views expressed are my own, and not those of my employer or anyone
else associated with me.
My current valid email address is:
This is valid as is. It is not munged, or altered at all.
It will be valid for AT LEAST one month from the date of this post.
If you are trying to contact me after that time,
it MAY still be valid, but may also have been
deactivated due to spam. If so, and you want
to contact me by email, try searching for a
more recent post by me to find my current
email address.
The following is a (probably!) totally unique
and meaningless string of characters that you
can use to find posts by me in a search engine:
ewygchvboocno43vb674b6nq46tvb
Steven Zhu [MSFT]
Thanks for posting here.
From your post, my understanding on this issue is: you find the Event 1000
error message in Event log. If I am off base, please feel free to let me
know.
Based on my research, the error can be caused by that the rpcrt4l.dll file
is corrupt or some other third-party applications call this DLL file
illegally. Please perform the following convenient trouble shooting steps
to isolate the root cause for this issue:
1. It is reported that this issue can be caused by Antivirus applications,
such as McAfee guard dog. Please temporarily uninstall such kind of
applications to test.
2. To isolate the influence of additional services and start up items,
please boot the system into a Clean Boot environment to see whether this
issue continues. To use the tool, please refer to the following Microsoft
Knowledge Base article:
Q310560 How to Troubleshoot By Using the Msconfig Utility in Windows XP
http://support.microsoft.com/support/kb/articles/q310/5/60.asp
NOTE: It also applies to Windows Server 2003.
3. If this problem continues in a Clean Boot environment, please boot the
system into Safe Mode to further isolate the issue. To use a Safe Boot
option, follow these steps:
a. Restart your computer, and when the Boot menu appears, press F8.
b. When the "Windows Advanced Options" menu appears, select an option for
your current Operate System, and then press ENTER.
c. When the Boot menu appears again, with the words "Safe Mode" displayed
in red at the bottom, select the installation you want to start, and then
press ENTER.
I hope that the above information can be of assistance.
Have a nice day!
Best Regards,
Steven Zhu
MCSE
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
======================================================
PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were
updated on February 14, 2006.? Please complete a re-registration process
by entering the secure code mmpng06 when prompted. Once you have
entered the secure code mmpng06, you will be able to update your profile
and access the partner newsgroups.
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================
Alan
"Steven Zhu [MSFT]" <v-st...@online.microsoft.com> wrote in message
news:FJLszszn...@TK2MSFTNGXA01.phx.gbl...
Hi Steven,
Thank you for your response.
I am not sure how I can implement any of the above troubleshooting
suggestions.
Please remember that this is an intermittent issue. Sometimes it is a
fortnight before the print spooler fails and that our business relies
totally on the SBS 2003 Prem server for DC, Exchange Server, ISA etc
etc so we cannot take it down for any extended period of time.
1) I don't think I can realistically disable our anti-virus for two
weeks potentially!
2) I am not sure what a 'Clean Boot' environment means. Do you mean
simply to re-boot the server? If so, I have done that quite a few
times already, and the spooler continues to fail after random periods
of time (a few days, a week, a couple of weeks - no particular
pattern).
If you mean that I should use MSConfig to select the option for a
"Diagnostic Startup - load basic devices and services only" then,
again, I could not realistically run like that for a week waiting for
the spooler to die since users would not be able to access the
network.
3) Safe Mode - Same issue.
Am I missing something here?
Is it not eaiser to just replace the rpcrt4l.dll file? If so, what
would be the recommended way to actually do that? Is there something
akin to the old System File Checker (SFC.EXE) that used to be in Win98
(GUI?) and seems to still be available under WinXP Pro albeit as a
command line tool only?
Steven Zhu [MSFT]
Thanks for your new information.
Please refer to the following steps to perform clean boot:
Clean Boot.
-----------------
a. Click Start, click Run, type "msconfig" (without the quotation marks) in
the Open box, and then click OK.
b. In the Startup tab, click the "Disable All" button.
c. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button.
d. Click OK and restart your computer.
Please test this issue on the Clean Boot environment, if the issue
disappears in the Clean Boot environment, we can use a 50/50 approach to
quickly narrow down which entry is causing the issue.
Also, for the rpcrt4l.dll file issue, please try copy the correct file to
original location and run the following command:
Regsvr32 rpcrt4l.dll
Please let me know the result above.
Thanks and have a good day.
Alan
"Steven Zhu [MSFT]" <v-st...@online.microsoft.com> wrote in message
news:6AFelv$nGHA...@TK2MSFTNGXA01.phx.gbl...
Hi Steven,
Thank you for your reply.
I think I am still misunderstanding though.
Are you suggesting that I perform the clean boot, and then leave the
server in that state for (potentially) a week or so until the spooler
happens to fault again?
Surely in that clean boot state, the SBS Server and hence the entire
network would be unavailable to our users effectively shutting down
the entire business?
If so, I think I'll just have to go with replacing the file and
re-registering it.
Steven Zhu [MSFT]
Thanks for your update.
Please refer my previous reply to replacing this file and re-registering it:
Regsvr32 rpcrt4l.dll
Hope this method can help you.
Have a great day.