Print Hive Clean / Reset

I need not to explain why or when you would clean/reset print hive. If you are reading this, you already know that.

There is a PERFGURU TechNet Blog that explain this process however that is little bit confusing for new bees. So I thought, let’s make that simple and re-write the same at least in way that I understand even after 10 years.

Before you begin,

i)             You should know how many printers are there and their names.

To know the printers name and their share names, run following command: get-WmiObject -class Win32_printer | ft name, shareName

ii)             Its need not to mention that before you change the registry, you always keep a backup of the same. Run the following command to save a backup on C:\ & the file name would be PrintHive.reg;

reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print C:\PrintHive.reg

During printer driver installation settings got changed (in not recommended manner) and after sometimes that cause “spoolsv.exe” to crash. Print Spooler crash happens most of the time due to third party print processors and print monitors. We can set printers to use default print processor and monitor by changes in the registry. That DOES NOT mean existing printers will be uninstalled or will not work. They will remain and will be using Windows default and recommended settings. However their functionality may reduce.

So, what is print processor and print monitor?

Print Processor: The print processor tells the spooler to alter a job according to the document data type. It works together with the printer driver to move the spooled print jobs from the hard disk drive to the printer.

Print Monitor: The print monitors are the name of any component that processes the print job after it has spooled and are responsible for directing the output to the print device. Print monitors can be divided into two classes:

·         Language monitors

·         Port monitors

Language monitors are typically used only for bi-directional printers. A bi-directional printer supports two-way communication to answer status, and configurations questions sent to it. A

Bi-directional printer can also give unsolicited status information about the job being printed, and error conditions such as paper out.

Port monitors consist of user-mode DLLs. They are responsible for providing a communications path between the user-mode print spooler and the kernel-mode port drivers that access I/O port hardware.

Okay, enough talking… let’s start..

STEP 1:

Confirm the default Local Print Provider

1) Confirm that the Driver value in the Local Port Registry key is set to Localspl.dll. If it is not, double-click the "Driver" value to edit the Data String and set it to Localspl.dll.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\Local Port

_______________________________________________________________________

STEP 2:

Remove 3rd Party Port and Language Monitors

1) Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors.

2) Note any 3rd-party Monitors that are listed in the Monitors Registry key for future reference:

The default Monitors are:

==========================

AppleTalk Printing Devices

BJ Language Monitor

Local Port

LPR Port

PJL Language Monitor

Standard TCP/IP Port

USB Monitor

Windows NT Fax Monitor

==========================

Note: Not all of the above default Port Monitors will be present in all cases. You may also see the Microsoft Office Document Imaging Monitor which is installed by MS Office.

The 2 types of monitors that may be listed here are Port Monitors and/or Language Monitors. As a general rule, Language Monitors will not have any printer ports defined in the Ports subkey and may be removed without causing a problem. Port Monitors such as HP Standard TCP/IP, however, may have active printers using this port type.

If a 3rd-party Port Monitor is in use, with printers defined in the Ports subkey under the Port Monitor, you will need to convert the port(s) to a Standard TCP/IP Port (Standard Port Monitor). To identify the ports used against any printer, refer the Print Management Console > Print Servers > Ports.

_______________________________________________________________________

STEP 3:

Convert 3rd-party Port Monitor to Standard TCP/IP Port Monitor

1) Open the Printers and Faxes folder.

2) Right-click the printer that was identified as using the 3rd-party Port Monitor and select Properties.

3) In the Properties for the printer, click the Ports tab.

4) On the Ports tab, click the Add Port button.

5) In the Printer Ports dialog, select Standard TCP/IP and click the New Port button to start the Add Standard TCP/IP Printer Port Wizard.

6) Click “Next” when the Add Standard TCP/IP Printer Port Wizard starts to specify the printer that will be using this new port.

7) Enter the Printer Name or IP Address for the printer that will be using this new port and click Next.

Note: The wizard automatically fills in the port name for you in the Port Name box. You can either accept this name or type the name that you want to use, and then click “Next”. Standard Port Monitor then sends a query to the print device. Based on the SNMP values that are returned, the device details are determined and the appropriate device options are displayed. If the print device cannot be identified, you must supply additional information about it.

8) If the Additional Port Information Required page is displayed, perform one of the following tasks under Device Type:

Click Standard, click the appropriate device in the list, and then click “Next”.

-Or-

Click Custom, click Settings, specify the protocol settings (RAW or LPR) and the SNMP status settings that you want to use, click OK, and then click Next.

10) If the wizard prompts you for the print server protocol, specify the protocol that you want to use, either RAW or LPR.

11) If the wizard prompts you to select a port, specify the port that you want to use in the Device Port box, and then click “Next”.

12) Click Finish, and then click Close. On the Ports tab in the Properties for the printer, you should see that the printer is now set to use the new Standard TCP/IP Port that you just created. The new Standard TCP/IP port is also displayed in the Ports on this server list on the Ports tab in the Print Server Properties (File > Server Properties from within the Printers folder)

13) You can then delete the 3rd-party port from the Ports tab within the Print Server Properties.

14) Repeat these steps for all printers that are using a 3rd-party Port Monitor.

After moving all printers to the Standard TCP/IP Port Monitor, we can delete the 3rd-party Port Monitor’s Registry key under the Monitors key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors

_______________________________________________________________________

STEP 4:

Remove All Other 3rd party Monitors

For any other 3rd party Monitors that are identified under the Monitors key and are confirmed to NOT have any printer ports listed under the Ports subkey for the Monitor, we will need to perform the following 2 steps

·         Identify printers configured to use the 3rd party Monitor.

·         Delete the reference to the Monitor for that printer.

·         Delete the Registry key for the 3rd party Monitor.

1) Note the name of the 3rd-party Monitor that is being removed. We will use this name to search the Print Registry key for references to this Monitor.

Assume, for example, that the HP Master Monitor is installed:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Monitors\HP Master Monitor

EOJTimeout REG_DWORD 0xea60

Driver REG_SZ HPBMMON.DLL

2) In Regedit, click to highlight the Print key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

3) Press F3, or click the Edit menu and select Find.

4) In the “Find what” field, type the name of the 3rd-party Monitor that is being removed, HP Master Monitor in this example, and click Find Next. Identify printers that are configured to use the Monitor that we are removing, for example:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\HP Color LaserJet 2500 PCL 6

Configuration File REG_SZ HPBF342E.DLL

Data File REG_SZ HPBF342I.PMD

Driver REG_SZ HPBF342G.DLL

Help File REG_SZ HPBF342E.HLP

Monitor REG_SZ HP Master Monitor

5) Double-click the Monitor value to delete the 3rd party Monitor data string. In this example, delete the “HP Master Monitor” value. The Monitor value will be left with a blank data string, as follows:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\HP Color LaserJet 2500 PCL 6

Configuration File REG_SZ HPBF342E.DLL

Data File REG_SZ HPBF342I.PMD

Driver REG_SZ HPBF342G.DLL

Help File REG_SZ HPBF342E.HLP

Monitor REG_SZ

6) Repeat the steps above for all 3rd-party Monitors.

7) Stop and restart the Print Spooler service for the changes take effect.

Net stop spooler && Net start spooler

Note: In most cases, removing the 3rd party Monitors will not affect normal printing. If new problems are seen after removing the 3rd party Monitors, we can restore the backed up Print Registry key to restore the original configuration.

You can then perform the steps above again in smaller steps, stopping and starting the Print Spooler service more frequently, to determine if a specific component is required. If so, skip the removal of this component and continue removing the other 3rd-party items.

Note: If the problem is easily reproducible, you may also individually remove the 3rd-party Monitors to try to narrow the problem down to a particular Monitor. This procedure will take more time and may require restarting the Print Spooler service multiple times.

_______________________________________________________________________

STEP 5:

Remove 3rd-party Print Providers

1) Remove 3rd party Print Providers by deleting the 3rd-party providers in the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Providers

2) The default Print Providers are:

- Internet Print Provider

- Lanman Print Services

3) Stop and restart the Print Spooler service for the changes take effect.

Net stop spooler && Net start spooler

_______________________________________________________________________

STEP 6:

Remove 3rd Party Print Processors

Perform the following steps to confirm that all printers are configured to use the WinprintPrint Processor.

·         Identify printers that are configured to use a 3rd party Print Processor.

·         Change the 3rd party Print Processor to Winprint.

·         Delete the Registry key for the 3rd party Print Processor.

Note: the name of the installed Print Processors under the following Registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors

The default Print Processor is Winprint.

1) Assume, for example, that the HPPRN05 is installed:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Environments\Windows NT x86\Print Processors\HPPRN05

Driver REG_SZ HPPRN05.DLL

-- In that example, delete "HPPRN05" key.

2) In Regedit, click to highlight the Print key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print

3) Press F3, or click the Edit menu and select Find.

4) In the “Find what” field, type Print Processor and click Find Next. Identify the Print Processor being used for each printer:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print\Printers\Client1

ChangeID REG_DWORD 0x1b9fa8c9

Status REG_DWORD 0x180

Name REG_SZ Client\XPWS

Share Name REG_SZ

Print Processor REG_SZ HPPRN05

5) Double-click the Print Processor value to change the 3rd party processor data string to Winprint.

6) Repeat the steps above for all 3rd-party Print Processors.

7) Stop and restart the Print Spooler service for the changes to take effect.

Net stop spooler && Net start spooler

_______________________________________________________________________

STEP 7:

Additional steps to be done

1) Check the Spool folder to see if there are any old files in the folder. When printing is working properly, the files in the Spool folder are deleted as the jobs are printed. The default Spool folder is:

systemroot\System32\Spool\Printers

The Spool folder location can be confirmed by checking the DefaultSpoolDirectory Registry value in the following Registry key:

Move any old files that are in the Spool folder to see if the problem still occurs. Corrupt files in the Spool folder can cause Print Spooler service problems. You may need to stop the Print Spooler service to move the files from the Spool folder.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers

2) The Print Spooler service is, by default, dependent only upon the Remote Procedure Call (RPC) service, RPCSS. To confirm the Spooler dependencies, check the DependOnService value in the following Registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler

Confirm that the dependent services are started. If there are any other dependent services listed, in addition to RPCSS, edit the DependOnService Registry value to remove all dependencies except RPCSS.

3) Configure the installed antivirus application to exclude scanning the Spool folder. There can be contention between the antivirus application and the Print Spooler service that may cause intermittent printing problems.

_______________________________________________________________________

STEP 8:

Take a break, Lit up a cigarette..  and make sure you come back …

Okay, that was the manual process to do a print hive clean. However for Server 2008R2 there was a FIXIT available but, the same is not available anymore.

Ref: https://blogs.technet.microsoft.com/askperf/2012/02/24/microsoft-fixit-for-printing/

There is a PowerShell script available doing the same for Windows 7 and Windows 2008 R2 Remote Desktop Servers. It doesn’t (yes, you heard me right) work for Print Servers. L

Ref: https://printreset.codeplex.com/

Note: I have made some changes in that, and now it is a universal script and can run on ANY Windows 7 & 2008R2 computer and above. However you SHOULD NOT run that on print servers.

To get that Universal Script you need to get in touch with me.

Make sure you take a backup of your existing Print hive: reg export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print C:\PrintHive.reg

If your computer has never run any PowerShell scripts, then we need run this command (as administrator) to allow script execution: “Set-ExecutionPolicy Unrestricted“

Following command resets print environment to out of box:

print-reset.ps1 -full

Following command corrects common printing issues:

print-reset.ps1 -light

Explanation of Light Mode and Full Mode

-light: Light mode - Corrects common printing issues.

1. Stop spooler service and dependents.

2. Do not backup spooler service configuration: hklm\system\currentcontrolset\services - warn user -printbrm/PMC

3. Do not Backup print configuration: hklm\system\currentcontrolset\control\print

4. Do not backup files in %windir%\system32\spool\printers\ directory - warn user - back up manually

5. Import default print monitors (USB, Local Port, TCP/IP, WSD, and Microsoft Shared Fax registry configuration)

6. Import spooler service default configuration

7. Import print processor configuration for correct machine architecture: hklm\system\currentcontrolset\control\print\environments\(machine architecture)\winprint

8. Detect if spoolsv.exe, spoolss.dll, localspl.dll, or win32spl.dll are not present in %windir%\system32, write error to log.

9. Copy NTPrint.inf from %windir%\driverstore if not present in %windir%\inf. If (also) not present in driverstore, write error to log.

10. Test the path for hklm\system\currentcontrolset\control\print\printers\.DefaultSpoolDirectory. If it is not a valid path, write error to log. Correct this condition by setting it to the default path.

11. Delete all files from the spooler directory

12. Start the spooler service and dependents

-full: Full mode. Resets spooler service and print key to defaults.

1. Stop spooler service and dependents.

2. Do not Backup spooler service configuration: hklm\system\currentcontrolset\services

3. Do not Backup print configuration: hklm\system\currentcontrolset\control\print

4. Do not Backup Lanmanserver/Shares key

5. Do not Backup HKCU\Printers\Connections

6. Import default print key for correct machine architecture

7. Import spooler service default configuration

8. Detect if spoolsv.exe, spoolss.dll, localspl.dll, or win32spl.dll are not present in %windir%\system32, write error to log.

The following command line switches are supported

-light Light Mode - Corrects common printing issues

-full Full mode - Resets spooler service and print registry keys to defaults

-force Do not prompt for confirmation

-quiet Do not display console output

A log is created automatically and saved in %windir%\printreset

The above mentioned script does not work on Print Servers. So in a Print Server you need to do this manual. But just think, why we use scripts or commands. In Windows most things can be done using GUI and using mouse clicks, but script or commands works faster. So there are PowerShell commands that would do this for you (almost). These commands technically do the same, however this is not recommended way and just a temporary work around to get the Spooler Service up.

NOTE* these commands only work on standalone Print Servers and will not work on Clustered Servers.

** Make sure you have backed up the print key. **

Command to change Print Processor of all Printers to “WinPrint”

set-itemproperty -path ‘HKLM:\system\currentcontrolset\control\print\printers\*’ -name ‘Print Processor’ -value WinPrint

Command to change Print Monitor to “Blank”

For x64 Drivers

set-itemproperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3\*’ -name ‘Monitor’ -value $null

For x86 Drivers

set-itemproperty -path ‘HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows NT x86\Drivers\Version-3\*’ -name ‘Monitor’ -value $null

Basically, I have given three different ways to achieve almost same thing; make sure that every printer uses the Windows default print processor and print monitors.

The most recommended way I the first one, the manual way however I will take time. You need to decide which one of them to use at what scenario.

Make sure you have backup of “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print” key. The reason I am mentioning this because once I have taken backup of “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers” and after full clean up all printers were gone from the print server. I was lucky as that was a VM and customer took a snapshot just before we started troubleshooting.

All right, hope this will help. Bye ..