You do not have to guess which driver is crashing your spooler — Windows writes the name down at every crash. This guide shows you where the report lives and how to read it like a technician.
Most spooler advice is a list of things to try. This article is different — it is how to know. Two minutes in Event Viewer gives you the faulting module name, and the pattern across a few crashes tells you whether you are hunting one driver, one add-on, or a wider system problem.
Faulting application name: spoolsv.exe, version: 10.0.19041.1
Faulting module name: CNMLMCI.DLL, version: 2.1.0.4
Exception code: 0xc0000005
That module name is the fingerprint of one printer's driver. The spooler is the victim in this report, not the criminal.
Every time the spooler crashes, Windows records a crash report. Not a vague one — a report that names the exact file that was running when the process died. Ninety per cent of spooler troubleshooting is reading that name correctly. Everything else is acting on it.
The report lives in Event Viewer, and it takes two minutes to reach.
eventvwr.msc, press Enterspoolsv.exeThe line Faulting module name is the whole game:
spoolsv.exe itself or a spooler component → suspect a corrupt job in the spool folder or a damaged print processor; clear the folder and retestntdll.dll or KERNELBASE.dll → these are usually messengers, not causes. A driver or add-on passed bad data and the core file took the fall. Continue to the pattern check belowOne event can mislead; five cannot. Select several spooler crash events across different days and compare the faulting module:
A faulting module name converts your fix from folklore to evidence. Repair or remove exactly the component named, restart the spooler, and then watch the Application log for a few days of normal printing.
No new 1000 events for spoolsv.exe means the diagnosis was right and the case is closed. New events naming a different module mean there were two culprits — repeat the same reading. The log will keep telling you the truth as long as you keep reading it.
The full print spooler repair — finding the real culprit and stopping the crash loop — is shown step by step in the video.
▶️ Watch Full VideoIn Event Viewer under Windows Logs, Application log — Error events from the source Application Error, Event ID 1000, naming spoolsv.exe as the faulting application. The companion entries in the System log from Service Control Manager, Event IDs 7031 and 7034, record each time the service terminated.
Almost certainly not. ntdll.dll and KERNELBASE.dll are core files that thousands of programs pass through; when bad data from a driver reaches them, they are the ones standing at the crash site. Treat them as messengers — compare several crash events and look for the driver or add-on that is present in the pattern.
You can, and a short clean log is easier to read — but export or note the existing faulting module names first. Deleting the logs destroys the evidence you need. Read first, write the names down, then clear if you want a clean slate for monitoring.