The Print Spooler That Lied: Killing a Phantom DLL After a Bad CU

Monday morning. Print spooler is dead on a Server 2019 RDS host. About three dozen network printers mapped via GPO, and not a single one is working. Event log is throwing this:

The print spooler failed to load a plug-in module
C:\Windows\system32\spool\DRIVERS\x64\3\PS5UI.DLL, error code 0x7F.

0x7F is ERROR_PROC_NOT_FOUND. The DLL loaded fine — the spooler just couldn't find an exported function it expected to be there. That's not a missing file problem. That's a mismatched or corrupted driver problem.

What Was Actually Going On

PS5UI.DLL is a PostScript driver UI component. It lives in the driver store and gets referenced by any printer using a PostScript driver — which, on most environments, means your Ricoh, Xerox, Konica, or any other fleet copier running a PS3 driver.

In this case, KB5078752 (a Server 2019 cumulative update) had introduced a version mismatch. The update touched spooler components but left an old PS5UI.DLL sitting in the x64\3\ driver staging folder. The spooler tried to load it, expected certain functions, didn't find them, and crashed. Every time. Before it could even start.

The Fix: Reset the Driver Environment

The safest approach here is to stop the spooler, strip out all third-party drivers from the store, and let GPO repopulate everything cleanly. Here's the script we used:

$logFile = "C:\Temp\SpoolerReset_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"
New-Item -ItemType Directory -Force -Path "C:\Temp" | Out-Null

function Log($msg) {
    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "$ts  $msg" | Tee-Object -FilePath $logFile -Append
}

Log "Starting spooler reset"

# Stop spooler
Stop-Service -Name Spooler -Force -ErrorAction SilentlyContinue
Log "Spooler stopped"

# Clear the print queue
Get-ChildItem "C:\Windows\System32\spool\PRINTERS" -ErrorAction SilentlyContinue |
    Remove-Item -Force -Recurse -ErrorAction SilentlyContinue
Log "Print queue cleared"

# Remove all non-Microsoft printer drivers
$drivers = Get-PrinterDriver -ErrorAction SilentlyContinue |
    Where-Object { $_.Manufacturer -notmatch "Microsoft" }

foreach ($d in $drivers) {
    try {
        Remove-PrinterDriver -Name $d.Name -ErrorAction Stop
        Log "Removed driver: $($d.Name)"
    } catch {
        Log "Could not remove $($d.Name): $_"
    }
}

# Start spooler
Start-Service -Name Spooler -ErrorAction SilentlyContinue
Start-Sleep -Seconds 5

$status = (Get-Service -Name Spooler).Status
Log "Spooler status after restart: $status"

if ($status -ne "Running") {
    Log "FAILED - spooler did not start. Check PrintService event log."
} else {
    Log "SUCCESS - spooler running. GPO will repopulate drivers as users connect."
}

What This Keeps

The script only removes non-Microsoft drivers. The Microsoft-supplied components — Enhanced Point and Print, Remote Desktop Easy Print, WSD drivers — stay in place. The spooler comes back up clean, and on the next GP refresh (or when users log in), their printers repopulate automatically from the print server.

Requirements and Notes

• Must be run as Administrator
• Spooler does not need to be running beforehand — the script handles a dead spooler
• Intended for print servers and RDS hosts where printers are GPO-managed
• Not ideal for standalone workstations where users installed drivers manually
• Log file drops to C:\Temp\SpoolerReset_<timestamp>.log

If the Spooler Still Dies After Running

If you run this and the spooler still won't start, the problem isn't in the driver store anymore. Check Microsoft-Windows-PrintService/Admin in Event Viewer immediately after attempting to start it — you'll usually see a second DLL being called out. Also worth checking whether a recent Windows Update is the culprit:

Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

If a specific KB lines up with when the problem started, test uninstalling it in a maintenance window before spending more time chasing the driver store.

Wrapping Up

This whole incident came down to a 2016-vintage Lexmark Universal PS3 driver with a mismatched PS5UI.DLL that survived years of updates without issue — until KB5078752 changed what the spooler expected to find in that file. Two minutes to run the script, five minutes for GPO to redistribute drivers, done. Nobody lost their printers for more than a morning.

The real lesson: if the spooler dies right after a CU and the error is 0x7F pointing at a PostScript DLL, don't spend time hunting the file. The file is there. It's the version that's wrong. Clear the driver environment and let it rebuild clean.