Время на прочтение2 мин
Количество просмотров13K
Исследователи Алекс Ионеску и Ярден Шафир недавно обнаружили уязвимость в службе Windows Print Spooler, основном компоненте ОС Windows, отвечающем за управление операциями печати. Ей присвоен номер CVE-2020-1048. Уязвимость затрагивает все версии ОС Windows c 1996 года от NT 4.0 до текущих версий этой ОС.
В настоящее время Microsoft выпустила патчи для закрытия этой уязвимости для Windows 10 версий 1803/1809/1909/1709/1903/1607, Windows 7/8.1/RT 8.1, Windows Server версий 1803/1909/1903, а также Windows Server 2019/2016/2012(R2)/2008(R2). Эти патчи также вошли в состав обновления безопасности «майский вторник патчей» от Microsoft (May 2020 Patch Tuesday), которое стало доступно всем пользователям 12 мая 2020 года.
Ионеску и Шафир назвали эту уязвимость PrintDemon и раскрыли на портале Windows Internals подробности об ее обнаружении и способах использования.
Attackers can exploit CVE-2020-1048 with a single PowerShell command:
Add-PrinterPort -Name c:\windows\system32\ualapi.dll
On an unpatched system, this will install a persistent backdoor, that won’t go away *even after you patch*.
See https://t.co/9yMSWNM8VG for more details.
— Alex Ionescu (@aionescu) May 13, 2020
Фактически, это некритичная уязвимость локального повышения привилегий (local privilege escalation, LPE), используя которую злоумышленник может повысить свои привилегии в системе. Конечно, при условии, что ранее данные пользователя этой ОС уже были скомпрометированы, так как эту уязвимость нельзя использовать для проведения прямой удаленной атаки на ПК с ОС Windows.
Механизм использования PrintDemon прост — одна непривилегированная команда в PowerShell (для текущих версий ОС Windows), чтобы получить привилегии уровня администратора для всей ОС:
Add-PrinterPort -Name c:\windows\system32\ualapi.dll
В более старых версиях Windows необходимо дополнительно сделать еще некоторые операции.
Поскольку служба Windows Print Spooler предназначена для того, чтобы быть доступной любому приложению, которое хочет напечатать файл, она доступна для всех приложений, работающих в системе, без ограничений. Злоумышленник может создать задание на печать, которое печатает в файл, например локальный файл DLL, используемый ОС WIndows или другим приложением. Таким образом, злоумышленник может инициировать операцию печати, преднамеренно завершить работу службы диспетчера очереди печати и затем возобновить его работу, но на этот раз операция печати выполняется с привилегиями SYSTEM, что позволяет перезаписывать любые файлы в ОС Windows.
Ионеску выложил на GitHub информацию об этой уязвимости (PoC-эксплоит для PrintDemon) с целью помочь ИБ-специалистам и системным администраторам понять уязвимость и подготовить меры по ее устранению и обнаружению.
Ранее в начале мая 2020 года Microsoft перенесла на конец мая 2020 начало развертывания большого майского обновления Windows 10 May 2020 Update (версия 2004) для обычных пользователей. Ранее компания планировала выпустить это обновление 12 мая 2020 года. Теперь этот срок сдвинут по соображениям безопасности еще на две недели из-за необходимости исправить выявленную в последний момент уязвимость нулевого дня в Windows 10.
In this article…
- What is the Spooler service?
- What happens if I stop the Spooler service?
- Is it safe to disable the Spooler service?
- What should I do if the Spooler service isn’t working?
- I made a mistake. How do I cancel all printing?
- Canceling didn’t work. Is there another way to clear out all pending documents?
- The Spooler service won’t start (Error 1053)
- The Spooler service is stuck in the “Stopping” state — Help!
- The Spooler service keeps stopping for no reason. How do I keep it running?
- Questions? Problems?
What is the Spooler service?
The Windows Print Spooler is a key operating system component that manages all printing on your computer. It is started when your PC boots and runs unattended, 24×7 as a Windows Service.
The Windows Service is named Spooler and its display name is Print Spooler. The service runs inside a process called spoolsv.exe:
The Spooler:
-
Runs silently in the background
-
Accepts files to be printed, from all applications
-
Facilitates concurrent printing
- Adds a new item (a print job) to the print queue.
- Sends the print job to the printer (when the printer is ready).
- Monitors the printer as it produces pages.
- Removes the job from the queue once the printer has produced all pages.
-
Open the Control Panel (available from the Start menu).
-
Type the word printers into the search box and click the View devices and printers link on the left:
-
Find your printer in the list. Right click the printer and select See what’s printing from the menu:
-
A window showing all pending print jobs will come up. Here we see one item for Administrator — a text file printed from the Notepad application:
From there, you can cancel all print jobs (“clear the queue”), pause a specific job or stop printing altogether.
-
Will do everything in its power to ensure that documents are printed
The Spooler does not show any windows or tray icons. It is an invisible technical component that presents an Application Programming Interface (API) to programs looking to manage printing.
The Spooler is always listening for print requests. It accepts documents from any application running on your computer.
The process of handing off a document to the Spooler is called Spooling. Once an application is done spooling a document, the Spooler is responsible for the actual printing. The application can go back to its normal tasks.
For example, let’s say you’re printing a spreadsheet from Microsoft Excel. You will notice a brief period as Excel prepares the document and hands off the print request to the Spooler. And during that time, a helpful window will announce that Excel is printing. However Excel is really sending the spreadsheet to the Spooler (i.e. spooling):
After the window has disappeared (i.e. Excel is done spooling), you will be free to edit your spreadsheet while the actual printing proceeds simultaneously. You can even close Excel! None of that matters to the Spooler, which will ensure that your spreadsheet makes it to the printer — independent of Excel.
Ever printed several, lengthy documents at the same time? The Spooler makes that possible — without overwhelming your printers.
The Spooler maintains a queue of requests (a print queue) for each printer on your computer. When you print a document, the Spooler:
Windows allows you to see (and manage) each printer’s queue. To open a print queue:
The Spooler’s mission is to make sure that all your documents are printed — even if there is a brief outage or interruption.
For example, if your printer temporarily disappears from the network, the Spooler will wait a reasonable time for the device to come back before declaring a failure.
And if your request to print a single page is stuck behind a 200-page behemoth, the Spooler will ensure that your document gets its turn, eventually.
What happens if I stop the Spooler service?
Nothing can be printed when the Spooler service is stopped. And if you try to print without the service running, Windows will insist that no printers are installed:
Indeed, when the service is running, printers show up as ready and waiting. Printing works fine:
But all printers become inaccessible the instant the service is stopped:
Is it safe to disable the Spooler service?
If you don’t have any physical printers attached to your computer and you and never plan to do any printing, you can safely disable the Spooler service.
However, watch out for applications that silently use the printing API. They will also fail when the service is disabled.
What should I do if the Spooler service isn’t working?
If the Spooler is misbehaving, you should restart it. You can do so from the Services Control Panel application, or by running a couple of NET commands:
NET STOP Spooler
NET START Spooler
Be sure to run those commands from an elevated command prompt, otherwise they will fail with permissions errors.
I made a mistake. How do I cancel all printing?
To clear all printing, open the printer queue (see above) and select Cancel All Documents from the Printer menu:.
Give the Spooler (and your printer) a few seconds to respond to the request.
Canceling didn’t work. Is there another way to clear out all pending documents?
Try running this sequence of commands to stop the Spooler, remove all files from the print queue, and restart the service. You will need to have admin rights:
NET STOP Spooler
DEL /Q /F /S C:\Windows\System32\spool\PRINTERS\*
NET START Spooler
The Spooler service won’t start (Error 1053)
As reported in Microsoft’s technical forum, the problem may be with “desktop interaction” — an obscure windows service setting.
To fix the issue:
- Open the Spooler service (from the Services Control Panel application)
- Switch to the Log On tab
- Un-check the Allow service to interact with desktop box:
- Click OK to save your change.
Afterwards, you should be able to start the service.
The Spooler service is stuck in the “Stopping” state — Help!
In that unusual situation, find and terminate the spoolsv.exe process from the Task Manager (admin rights required):
The service should transition to the stopped state.
The Spooler service keeps stopping for no reason. How do I keep it running?
Our Service Protector utility may be able to help. Please follow this step-by-step tutorial showing how to protect the Spooler service.
Questions? Problems?
If you would like to know more about the Windows Print Spooler service, or you have a specific problem, please feel free to get in touch. We will do our best to help you!
You may also like…
-
Home
-
Knowledge Base
- What Is Print Spooler and How to Reset It on Windows 10?
By Daisy | Follow |
Last Updated
What is a Print Spooler? How to reset Print Spooler? If you are looking for the answers to the above questions, you can read this post carefully. Besides, you can also know what to do when you encounter the Print Spooler issue.
What Is Print Spooler
What is Print Spooler? It is a small application that manages paper print jobs sent from the computer to the printer or print server. It can store multiple print jobs in the print queue or buffer retrieved by the printer or print server.
Tip: If you want to learn more information about the printer or you encounter some issues when using the printer, you can go to the MiniTool official website.
Why You Need Print Spooler
Sometimes, the printer cannot immediately process all the information about what you are printing because it is not fast enough and has low storage space.
Therefore, the printer needs a program to decide in which order the documents should be printed (depending on who clicked print first), and then slowly pass the list of documents to be printed instead of sending all the documents at once.
If you use the Windows operating system, a background processing program will be built into the device. It is used with your printer to order print jobs. Spooler means you don’t have to wait for one job to finish before you can load another job. That is Print Spooler.
How to Reset Print Spooler
When you use Print Spooler, you may also encounter many issues, such as Print Spooler keeps stopping, Print Spooler service not running, and so on. Most of the issues can be fixed by resetting or restarting the Print Spooler. The following are the methods for you to restart Print Spooler.
Way 1: Use Task Manager
The easiest way to reset or restart the print spooler is using Task Manager. The steps are listed below:
Step 1: Right-click the Start button and choose Task Manager.
Step 2: Go to the Services tab.
Step 3: Scroll down to locate the Spooler service, right-click it, and choose Restart.
Way 2: Use Command Prompt
Alternatively, you can also reset or restart Print Spooler Windows 10 in Command Prompt.
Step 1: Press Windows + R to open the Run window. Then, input cmd and press Ctrl + Shift + Enter to run Command Prompt as an administrator.
Step 2: When you receive a User Account Control (UAC) window, click OK to confirm the operation.
Step 3: In the command console, input net stop spooler and press the Enter key to stop Print Spooler.
Step 4: To resolve print or print spooler problems, you can navigate to the directory C:\Windows\System32\Spool\Printers and delete all the contents in the Printers folder to remove the print jobs.
Step 5: Now, you can go back to Command Prompt, type net start spooler, and press Enter to start print spooler.
After that, you can start your print tasks again and they should be completed properly.
Way 3: Use Services
You can also perform the same operation in the Services app. Besides, you can make more changes in the service here.
You just need to invoke the Run window, input services.msc in the empty box, and click OK to open the Services app. Then, scroll down to locate the Print Spooler service.
To stop/restart print spooler, you can click Stop the service/Restart the service in the left pane, or right-click the service and choose Stop/Restart. If the service is stopped, you can click Start the service in the left pane, or choose Start from the context menu.
To make more configuration for the service, you can double-click it to open its Properties. Here, you can also stop/start Print Spooler by clicking the Stop/Start button. And you are allowed to choose a Start type from the drop-down list as your needs.
Final Words
To sum up, this post has introduced what the Print Spooler is and how to reset it on Windows 10. I hope that this post can be helpful to you.
About The Author
Position: Columnist
Having been an editor at MiniTool since graduating college as an English major, Daisy specializes in writing about data backups, disk cloning, and file syncing as well as general computer knowledge and issues. In her free time, Daisy enjoys running and going with friends to the amusement park.
Last Updated :
26 Dec, 2023
The print spooler is a small program/software that manages the order of documents to proceed to the print queue. It manages all print jobs that are submitted to the computer printer. In this article we are going to learn what is Print spooler, How does Print Spooler work, the Need of a Print Spooler, some common problems related to Print Spooler, Error handling in Print Spooler, and how to restart the Print Spooler if we are facing issues.
What is a Print Spooler?
The Print Spooler is software built into the Windows operating system that temporarily stores print jobs in the computer’s memory until the printer is ready to print them. It also allows a user to delete a print job when it is being done. The primary function of the Print Spooler is to organize and control the print jobs. The print spooler allows for more efficient use of the printer by managing the order in which those jobs are sent to the printer. Print Spooler allows us to send a document to the printer while another one is printing.
Working on Print Spooler
The print spooler takes incoming printing requests and puts them into an area called a spool. This area acts as a queue and stores all tasks that require printing. When it is time to start executing each task, they are taken from the queue one by one and sent off to the printer. The entire process is automatic, we don’t have to manually sit and wait until the print task is completed in order for it to be printed out.
.jpg)
Need of Print Spooler
The printer alone is not able to handle all the printing jobs. This is because the printer is too slow and lacks sufficient memory. We can understand this by taking an example, suppose more than 10 computers are connected from one printer and more than two people request printing at the same time, The print spooler service will schedule the printing job by putting them into a queue and decides the order of printing the documents, which document will be printed first. One who click print first will get priority.
Some Common Problems Related to Print Spoolers
Sometimes we face issues during printing, involved with the Spooler with printers. Some common problems related with Print Spooler are mentioned below :
- Print Spooler Service not Running.
- Print Jobs stuck in the queue.
- Printer Driver issues.
- Corrupted Print Spooler files.
- Dependency Service not Running.
- Incorrect Printer Port.
- Outdated Operating System or Software Updates.
Stuck in Print Queue
When printer stops printing job in the middle them it is called the print job stuck in the print queue. When this happens then cancel and delete button might do not respond to input. We can clear this problem by restarting the print spooler. First we have to stop the working of print spooler and delete the current printing job and then start the print spooler again. This way we can make print spooler function normal again.
Steps to Clear Print Queue
After deleting all files in printing job we can clear Print Queue. We can clear our printer queue in windows operating system by following steps :
- In the search box next to start on the taskbar.
- search for Control Panel.
- Click on Control Panel and look for Administrative Tools.
- Double click on the service icon.
- Scroll down and select the print spooler service.
- Click on stop.
- Type C:\WINDOWS\System32\spool\PRINTERS into the address bar of your internet browser.
- Delete all the files in this folder.
Now, our Print Queue is cleared.
Error Handling in Print Spooler
The print spooler handles all the printing tasks and errors. Sometimes we face issues while printing such as paper jam or low ink levels, the print spooler manage all the errors, pause the printing job and notify us or administrator about the problem.
How to Restart the Print Spooler Service?
Sometimes we face difficulty in sending a job to printer, the problem may be the Print Spooler service. We can restart the Print Spooler by following steps given below if Print Spooler service stops working :
- Open the Windows Task Manager.
- Click the service tab in the task manager window.
- Click the description column header to sort the list of services by description.
- Scroll down and find the print spooler service in the description column. The service is named Spooler in the name column.
- Right-click the print spooler service and select restart in the pop-up menu.
- We can again start the printing job in printer, after print spooler service is restarted.
Printers are an integral part of many business operations, and to ensure seamless printing, Windows relies on a service called the Print Spooler. In this article, we’ll delve into what the Windows Print Spooler service is, and how to troubleshoot various issues that might arise with it.
The Print Spooler service is a software program in Windows that manages all print jobs sent to the printer. If you’ve ever queued multiple documents to be printed, it’s the Print Spooler that lines them up and manages their orderly processing. Essentially, it spools these documents, holding them and releasing them for printing one at a time.
Why is the Print Spooler Important?
Without the Print Spooler, your printing tasks might become chaotic. This service:
- Allows multitasking: While one job is printing, you can send another job without waiting.
- Manages print priorities: If multiple users or applications are sending print jobs, the Print Spooler can prioritize based on various parameters.
- Retains print jobs: In the event of a printer error, the job remains in the queue, allowing you to address the issue without losing the print data.
Troubleshooting Common Print Spooler Issues
Print Spooler Service Not Running:
- Open ‘Services’ (you can search for it in the Start menu).
- Look for ‘Print Spooler’ in the list.
- Right-click and choose ‘Start’ if it’s not running.
- If it fails to start, check for error messages which can give clues about the underlying problem.
Print Jobs Stuck in Queue
- Navigate to ‘Devices and Printers’ in the Control Panel.
- Right-click on your printer and choose ‘See what’s printing’.
- If there are print jobs in the queue that aren’t processing, right-click and ‘Cancel’ them. Restart the Print Spooler service via ‘Services’.
Printer Spooler Errors
Errors can sometimes be caused by corrupted printer drivers or files. Navigate to C:\Windows\System32\spool\PRINTERS and delete any files in this folder (ensure the Print Spooler service is stopped while you do this). Then, restart the service.
Reinstalling Printer Drivers
In some instances, it may be necessary to reinstall or update your printer drivers. Ensure you download the latest drivers from the manufacturer’s website.
System File Checker
Corrupted system files can affect the Print Spooler. Run System File Checker by opening Command Prompt as an administrator and entering sfc /scannow.
Malware Check
Ensure that your system hasn’t been compromised. Malware can sometimes target services like the Print Spooler. Regularly scan your system using reputable antivirus software.
Check for Windows Updates
It’s possible that Microsoft has released patches or updates that address Print Spooler problems. Always keep your Windows OS updated.
Conclusion
The Windows Print Spooler service, while often running quietly in the background, is a pivotal component for ensuring efficient printing tasks. If you experience issues, the above troubleshooting steps can guide you towards a resolution. As always, ensure you have backups of important documents and consult with IT professionals if problems persist.
Hope this helps you understand the Windows Print Spooler service and the steps to address its issues!