spoolsv.exe using up network bandwidth

By TrevorLahey
in Microsoft (Windows)

 Share

Recommended Posts

Grand Master

TrevorLahey

Posted
Posted

We just implemented Meraki Wireless (Z1 model) to all of our outside agents. I've noticed on one user so far that there is a TON of data going across the VPN to our print server (uses about 1mb of his connection). Total 3Gbs this morning. I went to our print server, opened up resource monitor and found that the spoolsv.exe is the process that is using the data. His laptop isn't the only one doing this. There are also internal users that this is happening to. He has nothing to print, and the other users don't have anything printing or in the queue either. You can tell when a user that is working correctly, prints. The data spikes until the print job is finished sending. The users that are having this problem is constantly sending data, both send and receive.

has anyone else ran into this problem? I've looked all over the internet and found some users that have had the problem but nothing to fix it. I can shutdown the spooler service, but once it's started again the data starts to flow. I've done that on both the clients and the server. I've also made sure to check/clear the queue on both the server and the clients.

Grand Master

sc302 Veteran

Posted
  • Veteran
Posted

Yes it is going to. print jobs are huge, and they aren't compressed. a 2 meg word file could be a 100meg raw file (which is what gets sent to the printer), it depends on what they are printing. fix this issue by having local printers or by finding a way to transmit the print job compressed over the vpn to the printer network end and uncompress there.

We have done this with terminal servers being accessed over the vpn for years with the use of universal print servers like uniprint, screwdrivers, thinprint, etc. Basically you print on the terminal server, it compresses the print job to your client and it uses your client printer to expand and print the job locally. This worked great for dial up users trying to print locally when using rdp connecting to the server at the office. It saved a ton on bandwidth and kept printing quick vs waiting 30 min to print a job.

Grand Master

TrevorLahey

Posted
  • Author
Posted

Yes it is going to. print jobs are huge, and they aren't compressed. a 2 meg word file could be a 100meg raw file (which is what gets sent to the printer), it depends on what they are printing. fix this issue by having local printers or by finding a way to transmit the print job compressed over the vpn to the printer network end and uncompress there.

We have done this with terminal servers being accessed over the vpn for years with the use of universal print servers like uniprint, screwdrivers, thinprint, etc. Basically you print on the terminal server, it compresses the print job to your client and it uses your client printer to expand and print the job locally. This worked great for dial up users trying to print locally when using rdp connecting to the server at the office. It saved a ton on bandwidth and kept printing quick vs waiting 30 min to print a job.

I'm sorry, but I don't think it's that easy. Since he's an outside user, he has his own printer and he prints to that. It doesn't do him that well since he works out of the office however he has the ability to print to a printer here. He doesn't though, and even if you he did, he's not printing stuff all day. Today he's transfered 7.71GB to our print server on port 49162 if that helps anyone. Almost all day it has transfered at 1.6 mb/s continuously.

One of the users that it happens to here I was on her computer, she was definetly not printing anything. It also transfers a small amount about all day.

Grand Master

sc302 Veteran

Posted
  • Veteran
Posted

I just printed out a 2.9MB pdf. Watching the spooler it was a 800+MB raw file being printed. You can easily see that if I were to print that over the internet it would take a lot of bandwidth and it would take forever to print on a slow connection.

Does he print to the printer there, is that were you are seeing this or does he print to his printer next to him and that is where you are seeing it?

If he is printing next to him through a remote desktop connection or someone is send him a job over the internet, oh yes it will take every bit of that and is absolutely no surprise to me. Just think, how many times I would have to print that to reach your total...maybe 8 copies?

The only way around that is to compress it and get it to spool locally.

post-118098-0-44693900-1361569978.jpg

post-118098-0-09697900-1361570124.jpg

Grand Master

sc302 Veteran

Posted
  • Veteran
Posted

Ok, if you aren't printing, how are you monitoring this on your network? Ignore the above if you are sure the end users aren't printing.

btw

http://www.neuber.co...poolsv.exe.html

"The spoolsv.exe file is located in the folder C:\Windows\System32. In other cases, spoolsv.exe is a virus, spyware, trojan or worm!"

Could be something not nice.

Grand Master

TrevorLahey

Posted
  • Author
Posted

I just printed out a 2.9MB pdf. Watching the spooler it was a 800+MB raw file being printed. You can easily see that if I were to print that over the internet it would take a lot of bandwidth and it would take forever to print on a slow connection.

Does he print to the printer there, is that were you are seeing this or does he print to his printer next to him and that is where you are seeing it?

If he is printing next to him through a remote desktop connection or someone is send him a job over the internet, oh yes it will take every bit of that and is absolutely no surprise to me. Just think, how many times I would have to print that to reach your total...maybe 8 copies?

The only way around that is to compress it and get it to spool locally.

I'm telling you it's not that easy. If he prints it's going to be to the printer next to him, not over the VPN back to the main office. We can monitor how much and where the data is going from meraki. 2 days he sent 13.13 gb over the VPN. 11.26gb of that was to the print server, and he's not printing anything. Definetly not any books! The rest of the 1.87gb is email, VOIP phone, and file sharing...

Ok, if you aren't printing, how are you monitoring this on your network? Ignore the above if you are sure the end users aren't printing.

btw

http://www.neuber.co...poolsv.exe.html

"The spoolsv.exe file is located in the folder C:\Windows\System32. In other cases, spoolsv.exe is a virus, spyware, trojan or worm!"

Could be something not nice.

Meraki gives you a lot of information on what is going on, on your network. I can look at how much file sharing is going on, what computers are sending a lot of data and to who. They've got graphs and everything.. I noticed a lot of data going across the VPN from one user, I look and see most of the data is going to our print server. On our print server (Windows 2008), I went to Performance Monitor and you can drill down to what process is using the network. I did that and found it was spoolsv.exe.

It's defenetly not a virus... (On the server anyway, it's a brand new build).

The only thing I found so far was that it's possibly a corrupt printer install. I'm going to attempt to reinstall the printers sometime this week. Here is where I found some more information.

http://devhen.wordpress.com/2006/12/18/windows-spoolsvexe-using-99-cpu

It's not causing any CPU usage problem...

  • 2 months later...
  • 3 years later...
This topic is now closed to further replies.
 Share
Go to topic listing

  • Posts

    • JetBrains is working to cut false positives in RustRover 2026.2

      By David Uzondu · Posted

      JetBrains is working to cut false positives in RustRover 2026.2 by David Uzondu Recently, JetBrains released the fifth EAP build of its dedicated IDE, RustRover 2026.2, bringing improvements like a Run gutter icon for criterion_main! macro benchmarking and a feature that alerts you when there are unused traits in your current scope. Now, the company is out with a blog post addressing one of the "most common" complaints from users: false positives. In RustRover, a false positive occurs when the editor incorrectly highlights something as an error even though the project compiles and runs successfully. This mismatch flags a gap between the IDE's internal intelligence and the actual compiler. When the editor flashes red warnings over perfectly valid code, developers lose trust in the tool, which stalls momentum. Traditionally, RustRover runs cargo check to detect compiler errors and warnings, but it also relies on its own code analysis engine to power real-time features. To provide quick feedback, this engine parses your source code into a syntax tree while inferring types and resolving names as you type. Because this engine must work on broken, half-written code and react instantly, its logic sometimes diverges from the compiler's, producing false positives that do not exist in the compiler's eyes. JetBrains said that it has a "dedicated task force" focused specifically on identifying and fixing false positives by analyzing user reports and examining large-scale open-source projects. To speed up this process, the team built an internal system modeled after Crater, the famous Rust project that compiles and runs tests for every single crate published on crates.io. This automated pipeline compares the diagnostics from RustRover's analysis with actual compiler output to catch discrepancies before they reach users, ensuring smoother workflows. RustRover, for those who're unaware, is a dedicated IDE designed specifically for Rust developers. It's been around for a couple of years now, providing features like built-in debugging via LLDB, seamless cargo integration, advanced macro expansion, and HTML support. JetBrains distributes the app under two licensing models: a paid commercial subscription and a free option for non-commercial use.
    • Save 31% on Samsung T7 Portable SSD

      By Eric Biran · Posted

      Last year I bought the 2TB variant for $114 on Amazon. That's crazy that the 1TB is now 67% more expensive for half the storage, even with the newer T9 already on the market. And that's considered a good deal.
    • Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow

      By JohnMXN · Posted

      You can disable all non needed features from Brave. There is also Brave Origin which removes them entirely and it is free for Linux.
    • Google Chrome is killing all uBlock Origin bypasses, Microsoft Edge, Opera to follow

      By JohnMXN · Posted

      I wish I could use Brave but the tab suspension feature is horrible. It doesn't suspend them like Edge does. Even after 2h open with 70+ tabs (same as Edge), it has 2GB more consumption than Edge for no reason.
    • TeamViewer 15.78.4.0

      By Copernic · Posted

      TeamViewer 15.78.4.0 by Razvan Serea TeamViewer is the fast, simple and friendly solution for remote access over the Internet - all applications in one single, very affordable module. Remote control of computers over the Internet, Instantly take control over a computer anywhere on the Internet, even through firewalls. No installation required, just use it fast and secure. Training, sales and teamwork, TeamViewer can also be used to present your desktop to a partner on the Internet. Show and share your software, PowerPoint presentations etc. File transfer, chat and more, Share your files, chat, switch the direction during a teamwork session, and a lot more is included in TeamViewer. TeamViewer key features: Cross-platform remote access (Windows, macOS, Linux, Android, iOS, IoT) Attended and unattended remote control Secure file transfer between devices Remote printing to local printers Multi-monitor support with easy switching Wake-on-LAN for sleeping devices Session links for quick connections (no password sharing) Web client access (no installation needed) End-to-end encryption (AES-256) Two-factor authentication and access controls AI-powered session insights and reporting Mass deployment and device management tools Customizable allow/block lists for security Command line and script execution remotely Performance monitoring and analytics dashboards TeamViewer 15.78.4.0 changelog: Improvements Permissions inheritance has been improved, increasing reliability when permissions are assigned to user group managers. Bugfixes Fixed a bug where 'Show details' button was not showing up on command bar upon selection of a device group. Fixed a bug which was causing the legacy groups to disappear when applying hide offline filter in basic view. Fixed a bug where devices were loading infinitely after login. Fixed a bug which was causing crash in application. Download: TeamViewer 15.78.4.0 | 32-bit | Portable | Mac | ~70.0 MB (Free for personal use) View: TeamViewer Home Page | Release Notes | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware

  • Recent Achievements

    • One Year In
      Primer1st earned a badge
      One Year In
    • Experienced
      JayZJay went up a rank
      Experienced
    • Reacting Well
      Sir_Timbit earned a badge
      Reacting Well
    • Week One Done
      rubentuben8 earned a badge
      Week One Done
    • Week One Done
      ARaclen earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      517
    2. 2
      PsYcHoKiLLa
      229
    3. 3
      Edouard
      135
    4. 4
      ATLien_0
      87
    5. 5
      Steven P.
      82
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!