Tracking print related application failures back to a print driver name

KB Home   |   Tracking print related application failures back to a print driver name

Print drivers can cause failures in the Windows Print Spooler and PaperCut Print Provider services as well as applications when calling into print driver methods. If there is a dialog message stating “’Application Name’ has stopped working” or an expected running service is no longer running, one can track these failures reviewing events in Windows Logs.

How to identify the binary causing the crash.

Start → Server Manager → Tools → Event Viewer. From here, expand Windows Logs → Application. Right click, Filter Current Logs, set Event sources: Application Error. This will provide a list of events with ID 1000. Search through the events for Faulting application name: spoolsv.exe or pc-print.exe. Failures related to other print components are printisolationhost.exe and splwow64.exe as well as the executable for an application. Each event will contain “Faulting module name” data. Failures that can be traced further have information with a print driver binary name. Ignore module names of ntdll.dll and kernel32.dll, print drivers will call into these modules but they do not directly link back to the print driver.

In the following example MyTestPrintDriver.dll is causing a failure in the print spooler service.

Faulting module name: MyTestPrintDriver.DLL, version:, time stamp: 0x52fd1c1a
Exception code: 0xc00000fd
Fault offset: 0×00000000001500da
Faulting process id: 0×2d9c
Faulting application start time: 0×01d0e431c4b366c5
Faulting application path: C:\Windows\system32\spoolsv.exe
Faulting module path: C:\Windows\system32\spool\DRIVERS\x64\3\MyTestPrintDriver.DLL
Report Id: 257c39f8–5025–11e5–82ae-00249b0fae66

How to identify the driver

On Server 2012 and newer, use PowerShell to perform a search of the print drivers installed to determine the print driver associated with this dll file. Open Windows Powershell, execute the get-printerdriver commandlet. One can use wildcard characters with a partial binary name. Substitute the binary name identified in the Windows event.

get-printerdriver | where {$_.ConfigFile -like "*MYTestPrintDriver*" -or $_.DependentFiles -like "*MyTestPrintDriver*" -or $_.Monitor -like "*MYTestPrintDriver*"}

will return

Name PrinterEnvironment MajorVersion Manufacturer
---- ------------------- ------------- --------------
My Test Print Driver Windows x64 3 TestPrintDriverVendor

On Server 2008 and newer one can use the vbs scripts included with the operating system to filter for the driver name and the binary name. This method works for Server 2012 and 2012R2 but the previous PowerShell command is the better choice.

cscript c:\Windows\System32\Printing_Admin_Scripts\en-US\PRNDRVR.VBS -l |findstr /i /c:"Driver Name" /c:MyTestPrintDriver

Note replace en-US with the locale information of your operating system.

This will provide a complete listing of the driver names due to the search on “Driver Name”. Look through the list and find the one that uses the faulting module name.

Driver name My Test Print Driver, 3, Windows x64

Steps to a solution

Armed with the print driver name, one can determine the printers impacted and determine if there is an updated driver for the device or one can evaluate a compatible replacement that would work better in their environment. Check the vendor website and Windows Update for driver updates. Test with another driver for the device.

Categories: Administration, Tips & Tricks, Windows, Debugging, Troubleshooting

Keywords: crash


Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.

Article last modified on November 04, 2015, at 02:19 AM
Printable View   |   Article History   |   Edit Article