EventID Windows Server

Event ID 7031: Service terminated unexpectedly

Windows Server medium severity service-control-managersystem-logcrash
The Print Spooler service terminated unexpectedly.  It has done this 3 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
On this page

What you see

System log shows 7031, sometimes followed by 7034 (terminated unexpectedly, no recovery) or 7000/7009 (failed to start). Users notice the feature before you notice the log.

Why it happens

7031 is the Service Control Manager reporting a death it did not order. The service process exited or was killed:

  • an unhandled exception in the service
  • the process hit a memory limit or was killed by a resource policy
  • a dependency (database, network share, license server) disappeared
  • a bad update replaced a DLL the service loads
  • the service account password expired and the process could not reauthenticate

Fix

1. Get the crash detail from the Application log.

Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Application Error'; StartTime=(Get-Date).AddDays(-2)} |
  Select-Object TimeCreated, Id, Message -First 10

An Application Error or .NET Runtime event within a second of the 7031 gives you the faulting module. That name is the lead, not the service name.

2. Check for 7034 and 7000 as well.

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031,7034,7000,7009; StartTime=(Get-Date).AddDays(-7)} |
  Group-Object Id | Select-Object Name, Count

3. Confirm the service account is still valid.

Get-CimInstance Win32_Service -Filter "Name='Spooler'" | Select-Object Name, StartName, State, ExitCode

If StartName is a domain account, check its password expiry and lockout state.

4. Check dependencies before blaming the service.

Get-Service Spooler | Select-Object -ExpandProperty ServicesDependedOn

5. Add recovery actions so a single crash does not page anyone.

sc failure Spooler reset= 86400 actions= restart/60000/restart/60000/restart/60000

That restarts after 60 seconds, three times, then resets the counter daily. This buys time; it is not a fix.

6. If it crashes repeatedly after an update, roll the update back.

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5

Correlate the first 7031 timestamp with the install time before you uninstall anything.

7. Capture a dump for the vendor.

New-Item -ItemType Directory -Force C:\dumps
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\spoolsv.exe" /v DumpFolder /t REG_EXPAND_SZ /d C:\dumps /f
reg add "HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\spoolsv.exe" /v DumpType /t REG_DWORD /d 2 /f

The next crash writes a full dump you can hand to support.

Verify

Get-WinEvent -FilterHashtable @{LogName='System'; Id=7031; StartTime=(Get-Date).AddHours(-24)}

No new events over a normal business day, and the service state stays Running.

More event IDs