Print Spooler Crashes on Remote Desktop Hosts: Driver Checks

Direct answer: A Print Spooler stop on a Remote Desktop host has more than one candidate cause. Microsoft's printing troubleshooting guide names corrupted files in the spool folder and the spooler's service dependencies, and its driver documentation explains that a printer driver running inside the spooler process can halt the print service. Collect the crash evidence first and only treat a driver as the suspect when that evidence names it. Driver isolation contains a faulty driver by running it outside the spooler; it does not repair the driver. The repair is a fixed or replaced driver from the vendor, confirmed by a real print test. Keep the effective Point and Print protections in place throughout.

Why it matters

Every signed-in user on a Remote Desktop host prints through the same spooler. When it stops, printing stops for all of them, and jobs in progress may be lost. The quick reactions, a scheduled spooler restart or loosening driver installation rules so users can add whatever driver works, either hide the fault or reopen the security issues Microsoft addressed in 2021.

How it works

Scope

This article covers printer drivers installed on the Remote Desktop host itself, for example printers connected from a print server or added locally by an administrator. Remote Desktop printer redirection and Easy Print, where the user's own client printers appear in the session, use a different path and are not covered.

What Microsoft lists for a spooler crash

Microsoft's "Troubleshooting scenarios for printing" page (supported versions of Windows Server) gives a "Print Spooler crash" scenario. It says: "Corrupted files in the Spool folder can cause Print Spooler service problems." The default folder is %systemroot%\System32\Spool\Printers, and the DefaultSpoolDirectory value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers shows the actual location. It also states: "By default, the Print Spooler service is dependent on only the RpcSs", and points to the DependOnService value of the Spooler service key to check that. The same page mentions antivirus exclusions for .SHD and .SPL files and, for print failures, updating the driver from the manufacturer or trying a generic in-box driver.

Drivers inside the spooler process

Microsoft's driver documentation: "Printer driver isolation improves the reliability of the Windows print service, by enabling printer drivers to run in processes that are separate from the process in which the print spooler runs." And: "By isolating the driver, the administrator can prevent a fault in a driver component from halting the print service." A driver whose INF does not declare isolation support (DriverIsolation=2) is configured to run in the spooler process; omitting the keyword equals DriverIsolation=0.

Microsoft states that ideally a driver runs in shared mode, and that a driver may need isolated mode if, for example, it has file names that conflict with related drivers, faults, or leaks memory. Microsoft states that a computer administrator "can use the Windows Print Management console or call the Windows spooler functions" to configure the mode for each driver. Group Policy can disable isolation for all drivers; when isolation is on, a driver without a mode setting that is compatible runs shared, and for a driver that is not compatible "the group policy override determines whether the driver runs in shared mode or none mode". Not every driver can be moved: compatibility comes from the driver.

Isolation keeps a driver fault from taking the spooler down. The driver is still faulty and its own process can still fail; the user of that printer is still affected.

Point and Print: what is actually protective

These are separate controls; check each one rather than reading any single "disabled" or "not configured" state as safe or unsafe.

1. Administrator-only driver installation. KB5005652 (CVE-2021-34481) describes RestrictDriverInstallationToAdministrators under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint. Set to 1 it requires administrator privilege for any printer driver installed through Point and Print and "will override all Point and Print Restrictions Group Policy settings". Microsoft states: "There is no combination of mitigations that is equivalent to setting RestrictDriverInstallationToAdministrators to 1." Updates from August 2021 make administrator-only installation the default when the value is not defined.
2. Warning and elevation prompts. KB5005010 (CVE-2021-34527) lists a not-vulnerable state as NoWarningNoElevationOnInstall = 0 or not defined, UpdatePromptSettings = 0 or not defined, and the Point and Print Restrictions policy not configured. Setting either value to non-zero is the state Microsoft calls vulnerable. A policy that is not configured is therefore not, by itself, a weakness.
3. Server trust list. The Point and Print Restrictions policy can limit users to named print servers.
4. Print server installation. KB5005010 states that after the July 2021 updates only administrators can install signed and unsigned printer drivers to a print server; printer operators no longer can.

KB 2307161 states that for Windows Server 2012 R2 and Windows 7 SP1, Point and Print Restrictions set under User Configuration are ignored because the policy moved to Computer Configuration, Policies, Administrative Templates, Printers, and recommends setting both locations for mixed-level clients. It is a legacy article; it is not a rule for current Server versions.

Client and server driver mismatch

KB5005652 explains that if a print server's driver files in spool\drivers\x64\3 do not come from the same package offered in its PCC folder, the client detects a mismatch at every print and prompts. Microsoft recommends the latest drivers and, where possible, the same driver version on print client and print server.

Read-only checks

None of these were run for this article. Reading the event logs, the registry and the console changes nothing.

1. When and how the spooler stopped. Read the System and Application event logs around each stop and record the time and any faulting module named for spoolsv.exe. No fetched Microsoft page gives event IDs for this; it is an editorial recommendation. Keep any crash records the host already holds before anything is restarted or cleaned.
2. Spool folder location and contents. Read DefaultSpoolDirectory and list the folder. Old .SHD/.SPL files that remain while nothing is printing match Microsoft's corrupted-spool-file candidate. Listing does not move them.
3. Spooler dependencies. Read DependOnService under HKLM\SYSTEM\CurrentControlSet\Services\Spooler and compare with Microsoft's stated default (RpcSs only).
4. Drivers and isolation modes. In Print Management, list drivers on the host and record each driver's isolation mode and version without changing anything.
5. Point and Print values. Read RestrictDriverInstallationToAdministrators, NoWarningNoElevationOnInstall and UpdatePromptSettings, and record whether the Point and Print Restrictions policy is configured, and where.
6. Print server side. If users print through a print server, record the driver version there and on the host.

Candidate causes (hypotheses to test)

Decision guidance

Every item below is a change. Each needs a change record, a maintenance window, and a print test afterwards, because spooler restarts and driver changes interrupt printing for everyone on the host. None were executed for this article.

What not to do

• Do not set RestrictDriverInstallationToAdministrators to 0, or NoWarningNoElevationOnInstall or UpdatePromptSettings to non-zero, to let users install drivers. Microsoft states the prompt values make devices vulnerable and that nothing is equivalent to the administrator-only setting.
• Do not enable Point and Print Restrictions with "Do not show warning or elevation prompt" to stop prompts. KB 2307161's legacy resolution shows that choice; KB5005010, written after the 2021 vulnerabilities, recommends "Show warning and elevation prompt" for both new and updated connections.
• Do not add users to printer operators or administrators to get drivers installed.
• Do not treat isolation as the fix, or a scheduled spooler restart as one.
• Do not disable driver isolation by policy except as a short, recorded troubleshooting step.
• Do not delete spool files or registry print components without a recorded export and a window.

Limitations

• Untested: no step was run in a lab.
• No fetched Microsoft page gives spooler crash event IDs or a dump procedure; check 1 is editorial.
• The Print Management view was not opened for this article; no specific column or screen is described.
• PowerShell print cmdlets were not fetched, so no command is given.
• Printer redirection and Easy Print are out of scope.
• KB5005010 and KB5005652 retrieved copies do not display an update date.

Acceptance checklist

• [ ] Crash records for each stop are kept, with time and any named module.
• [ ] The cause is named from evidence (spool files, dependency, or a specific driver), not assumed.
• [ ] Any driver moved to isolated or shared mode is recorded as containment, with a vendor fix or replacement tracked.
• [ ] RestrictDriverInstallationToAdministrators is 1 or not defined; prompt values are 0 or not defined.
• [ ] After each change, an actual print to each affected printer succeeds from a user session.
• [ ] No further spooler stop in the agreed observation window, stated with its start and end dates.

Sources

Displayed dates as shown when accessed on 30 October 2026.

• Microsoft Learn, Troubleshooting scenarios for printing. 2026-02-12.
• Microsoft Learn, Printer driver isolation. 2025-05-01.
• Microsoft Learn, V4 printer driver. 2025-10-31.
• Microsoft Support, KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates. Not displayed in retrieved copy.
• Microsoft Support, KB5005652: Manage new Point and Print default driver installation behavior (CVE-2021-34481). Not displayed in retrieved copy.
• Microsoft Learn, Point and Print Restrictions policies are ignored in Windows. 2026-02-12.

Related articles

• Remote Desktop licensing errors: grace period, licence server discovery and CAL mode
• Windows server runs out of memory without a busy process: measure first, then check pool and handle growth
• Group Policy not applying on a hosted server: gpresult, event logs and SYSVOL replication

Learning notes

1. A spooler stop has several candidates; Microsoft names spool files and dependencies as well as drivers.
2. Isolation contains a driver fault; a fixed driver repairs it.
3. Point and Print safety rests on separate values; "not configured" is not itself a weakness.
4. Administrator-only driver installation has no equivalent mitigation; keep it.
5. A change is accepted after a real print test, not after a quiet period alone.