spoolsv.exe using up network bandwidth


Recommended Posts

We just implemented Meraki Wireless (Z1 model) to all of our outside agents. I've noticed on one user so far that there is a TON of data going across the VPN to our print server (uses about 1mb of his connection). Total 3Gbs this morning. I went to our print server, opened up resource monitor and found that the spoolsv.exe is the process that is using the data. His laptop isn't the only one doing this. There are also internal users that this is happening to. He has nothing to print, and the other users don't have anything printing or in the queue either. You can tell when a user that is working correctly, prints. The data spikes until the print job is finished sending. The users that are having this problem is constantly sending data, both send and receive.

has anyone else ran into this problem? I've looked all over the internet and found some users that have had the problem but nothing to fix it. I can shutdown the spooler service, but once it's started again the data starts to flow. I've done that on both the clients and the server. I've also made sure to check/clear the queue on both the server and the clients.

Yes it is going to. print jobs are huge, and they aren't compressed. a 2 meg word file could be a 100meg raw file (which is what gets sent to the printer), it depends on what they are printing. fix this issue by having local printers or by finding a way to transmit the print job compressed over the vpn to the printer network end and uncompress there.

We have done this with terminal servers being accessed over the vpn for years with the use of universal print servers like uniprint, screwdrivers, thinprint, etc. Basically you print on the terminal server, it compresses the print job to your client and it uses your client printer to expand and print the job locally. This worked great for dial up users trying to print locally when using rdp connecting to the server at the office. It saved a ton on bandwidth and kept printing quick vs waiting 30 min to print a job.

  On 22/02/2013 at 19:44, sc302 said:

Yes it is going to. print jobs are huge, and they aren't compressed. a 2 meg word file could be a 100meg raw file (which is what gets sent to the printer), it depends on what they are printing. fix this issue by having local printers or by finding a way to transmit the print job compressed over the vpn to the printer network end and uncompress there.

We have done this with terminal servers being accessed over the vpn for years with the use of universal print servers like uniprint, screwdrivers, thinprint, etc. Basically you print on the terminal server, it compresses the print job to your client and it uses your client printer to expand and print the job locally. This worked great for dial up users trying to print locally when using rdp connecting to the server at the office. It saved a ton on bandwidth and kept printing quick vs waiting 30 min to print a job.

I'm sorry, but I don't think it's that easy. Since he's an outside user, he has his own printer and he prints to that. It doesn't do him that well since he works out of the office however he has the ability to print to a printer here. He doesn't though, and even if you he did, he's not printing stuff all day. Today he's transfered 7.71GB to our print server on port 49162 if that helps anyone. Almost all day it has transfered at 1.6 mb/s continuously.

One of the users that it happens to here I was on her computer, she was definetly not printing anything. It also transfers a small amount about all day.

I just printed out a 2.9MB pdf. Watching the spooler it was a 800+MB raw file being printed. You can easily see that if I were to print that over the internet it would take a lot of bandwidth and it would take forever to print on a slow connection.

Does he print to the printer there, is that were you are seeing this or does he print to his printer next to him and that is where you are seeing it?

If he is printing next to him through a remote desktop connection or someone is send him a job over the internet, oh yes it will take every bit of that and is absolutely no surprise to me. Just think, how many times I would have to print that to reach your total...maybe 8 copies?

The only way around that is to compress it and get it to spool locally.

post-118098-0-44693900-1361569978.jpg

post-118098-0-09697900-1361570124.jpg

Ok, if you aren't printing, how are you monitoring this on your network? Ignore the above if you are sure the end users aren't printing.

btw

http://www.neuber.co...poolsv.exe.html

"The spoolsv.exe file is located in the folder C:\Windows\System32. In other cases, spoolsv.exe is a virus, spyware, trojan or worm!"

Could be something not nice.

  On 22/02/2013 at 21:53, sc302 said:

I just printed out a 2.9MB pdf. Watching the spooler it was a 800+MB raw file being printed. You can easily see that if I were to print that over the internet it would take a lot of bandwidth and it would take forever to print on a slow connection.

Does he print to the printer there, is that were you are seeing this or does he print to his printer next to him and that is where you are seeing it?

If he is printing next to him through a remote desktop connection or someone is send him a job over the internet, oh yes it will take every bit of that and is absolutely no surprise to me. Just think, how many times I would have to print that to reach your total...maybe 8 copies?

The only way around that is to compress it and get it to spool locally.

I'm telling you it's not that easy. If he prints it's going to be to the printer next to him, not over the VPN back to the main office. We can monitor how much and where the data is going from meraki. 2 days he sent 13.13 gb over the VPN. 11.26gb of that was to the print server, and he's not printing anything. Definetly not any books! The rest of the 1.87gb is email, VOIP phone, and file sharing...

  On 22/02/2013 at 22:12, sc302 said:

Ok, if you aren't printing, how are you monitoring this on your network? Ignore the above if you are sure the end users aren't printing.

btw

http://www.neuber.co...poolsv.exe.html

"The spoolsv.exe file is located in the folder C:\Windows\System32. In other cases, spoolsv.exe is a virus, spyware, trojan or worm!"

Could be something not nice.

Meraki gives you a lot of information on what is going on, on your network. I can look at how much file sharing is going on, what computers are sending a lot of data and to who. They've got graphs and everything.. I noticed a lot of data going across the VPN from one user, I look and see most of the data is going to our print server. On our print server (Windows 2008), I went to Performance Monitor and you can drill down to what process is using the network. I did that and found it was spoolsv.exe.

It's defenetly not a virus... (On the server anyway, it's a brand new build).

The only thing I found so far was that it's possibly a corrupt printer install. I'm going to attempt to reinstall the printers sometime this week. Here is where I found some more information.

http://devhen.wordpress.com/2006/12/18/windows-spoolsvexe-using-99-cpu

It's not causing any CPU usage problem...

  • 2 months later...
  • 3 years later...
This topic is now closed to further replies.
  • Posts

    • +1 for LibreOffice. At least you should try it. The one from M$ is just a bloated turd at this point.
    • Yeah, I've had a Recycle Bin on my taskbar since XP and till last year when I got a new laptop with Windows 11. It was especially useful for touch workflow - I could drag files into Recycle Bin from anywhere because my Taskbar is always visible, unlike desktop icons.
    • Not after SP1. There was a legitimate file copy issue prior.
    • Microsoft 365 security in the spotlight after Washington Post hack by Paul Hill The Washington Post has come under cyberattack which saw Microsoft email accounts of several journalists get compromised. The attack, which was discovered last Thursday, is believed to have been conducted by a foreign government due to the topics the journalists cover, including national security, economic policy, and China. Following the hack, the passwords on the affected accounts were reset to prevent access. The fact that a Microsoft work email account was potentially hacked strongly suggests The Washington Post utilizes Microsoft 365, which makes us question the security of Microsoft’s widely used enterprise services. Given that Microsoft 365 is very popular, it is a hot target for attackers. Microsoft's enterprise security offerings and challenges As the investigation into the cyberattack is still ongoing, just how attackers gained access to the accounts of the journalists is unknown, however, Microsoft 365 does have multiple layers of protection that ought to keep journalists safe. One of the security tools is Microsoft Defender for Office 365. If the hackers tried to gain access with malicious links, Defender provides protection against any malicious attachments, links, or email-based phishing attempts with the Advanced Threat Protection feature. Defender also helps to protect against malware that could be used to target journalists at The Washington Post. Another security measure in place is Entra ID which helps enterprises defend against identity-based attacks. Some key features of Entra ID include multi-factor authentication which protects accounts even if a password is compromised, and there are granular access policies that help to limit logins from outside certain locations, unknown devices, or limit which apps can be used. While Microsoft does offer plenty of security technologies with M365, hacks can still take place due to misconfiguration, user-error, or through the exploitation of zero-day vulnerabilities. Essentially, it requires efforts from both Microsoft and the customer to maintain security. Lessons for organizations using Microsoft 365 The incident over at The Washington Post serves as a stark reminder that all organizations, not just news organizations, should audit and strengthen their security setups. Some of the most important security measures you can put in place include mandatory multi-factor authentication (MFA) for all users, especially for privileged accounts; strong password rules such as using letters, numbers, and symbols; regular security awareness training; and installing any security updates in a timely manner. Many of the cyberattacks that we learn about from companies like Microsoft involve hackers taking advantage of the human in the equation, such as being tricked into sharing passwords or sharing sensitive information due to trickery on behalf of the hackers. This highlights that employee training is crucial in protecting systems and that Microsoft’s technologies, as advanced as they are, can’t mitigate all attacks 100 percent of the time.
    • Comments like these are genuinely fascinating to me because they're so far from anything I experience as a daily user of Win 11 since the first public beta. AI stuff? Have it turned off completely, never pops up anywhere. Forced MS account? Yes, they strongly recommend it and kinda push it lately during big updates and such, but it's still not forced. Pop up dialogs when you're not using Edge? Yeah, I vaguely remember seeing some reminders about using Edge a long time ago. I just clicked them away and kept using Vivaldi as usual (but frankly, I'd still much rather use Edge than Chrome - which I'm forced to use at work - I've grown to dislike Google a lot more than Microsoft lately, even if I am still deeply rooted in their ecosystem unfortunately). Awful context menus? A single simple tweak will get you the old context menus. Search in Windows using Bing? People use search in Windows for anything else than to search for local files or apps? Why? I just don't get a lot of the complains people have about Win 11.
  • Recent Achievements

    • One Month Later
      Jdoe25 earned a badge
      One Month Later
    • Explorer
      Legend20 went up a rank
      Explorer
    • One Month Later
      jezzzy earned a badge
      One Month Later
    • First Post
      CSpera earned a badge
      First Post
    • One Month Later
      MIR JOHNNY BLAZE earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      618
    2. 2
      ATLien_0
      277
    3. 3
      +FloatingFatMan
      179
    4. 4
      Michael Scrip
      151
    5. 5
      Steven P.
      116
  • Tell a friend

    Love Neowin? Tell a friend!