You are hereWindows Terminal Server 2003 Crash Problems

Windows Terminal Server 2003 Crash Problems

By steve - Posted on 26 January 2007

My client was having problems with Windows Terminal Server 2003 crashing after a week or two. The system had been running fine for 2 years.

The problem turned out to be a program ZSHP1020.EXE that installed as part of the driver package for a remote client's HP 1020 laserjet printer. There were about 77 copies of the program running in the task manager.

I reviewed the errors in the event log and they included:

EventID 333
An I/O operation initiated by the Registry failed unrecoverably. The Registry could not read in, or write out, or flush, one of the files that contain the system's image of the Registry.

EventID 1508
Windows was unable to load the registry. This is often caused by insufficient memory or insufficient security rights.

After determining that the 1020 program was at fault, I found all copies of the program in \windows and below and renamed them. The idea is that the drivers should work even without the monitor program that craps out on the server.

Next I tried to kill the programs that were running. I received an error from task manager that I couldn't kill the processes as I didn't have security rights to. That meant I'd have to do a reboot.

Windows 2003 comes with a few more options, though, to handle processes. I opened a cmd window: start/run, enter cmd, then click OK. Then I tried tasklist and taskkill:


This kills all running jobs with this image name:
taskkill /f /im zshp1020.exe

However, it told me that the jobs (and PIDs that it found) could not be found to be cancelled. This is a different answer from what task manager said, but it still means I was forced to reboot the server.

It appears that ZSHP1020.exe starts to run on the server each time the user prints or connects (not sure). It can't start and run for some reason, then dies, but keeps its resources allocated. The PID is still active, but can't be cancelled. After awhile, the system runs out of resources (depending on how often the user with that printer is connecting) and no new jobs can start and users can't log on.

So far, renaming zshp1020.exe to zshp1020.old in the 3 places I found it seems to have helped. The user has connected several times (but not printed) and the program isn't starting up. Now the question is whether the printer will print.


I too have found this problem just now - it's not just Terminal Server 2003 which experiences this, plain old Server 2003 gets hit too.

Will be trying your rename method later - just wanted to thank you for sharing this (saved me a lot of worry - thought I'd been hacked for a while!)

I'm having this problem too, it's been driving me mad - the server always times its crashes out of hours when people are trying to use it for remote access. Do you know if renaming the file prevents users from printing? Thanks.

After I renamed the file users were able to print without a problem. The HP program is apparently just one of those annoying monitor programs and aren't required for printing.

If you stop the print spooler, it stops all instances. Then start it again. I haven't found a full solution yet though.

I have the same problem on a WIN2003 SBS server SP1. Does HP already have a solution for this serious problem? I Renamed all the instances for zshp1020.exe to zshp1020.old, but users couldn't print anymore to a 1022nx printer... I stop installing further 102x printers for now.

Does disabling Advanced Print Services in Properties work?

just schedule once a week to restart spooler.
net stop spooler
net start spooler
i did. and forgot about that problem.

Hey fellas. i have run into this before specifically in Terminal server envrionments but also in stand alone server.

if you open regedit and go to HKLM/CurrentControlSet/control/print/environments/windows nt x86/drivers/version-3/ (this if for a windows 2003 server)

under this hive are listed all the printers shared or not on the server. in each printer you will find a key called monitor. delete the contents of any monitor key. make sure not to delete the monitor key itself just anything in it.

You should always do this on your stand alone servers and it is imperative you do it on a terminal server. hope this helps. much better then restarting the spooler everytime :)


I ran across this today. My client's server 2003 receives a "not enough resources error" I found zshp* files in the task manager. I changed the "workstations" printer properties to print directly to the printer instead of spooling them. Now when the workstations print, they do not create the zshp* process.


Removing the registry data, and then re-starting the spooler worked for me. Thanks Rick.

I tried the registry mod on windows XP, and it worked fine. Just have to find the path : HKLM/SYSTEM/CurrentControlSet/Control/Print/Environments/Windows NT x86/Drivers/Version-3

Thanks for the tips.

hello RK,
i have followed your path for the registry, and i found the monitor key,but i didn't know how to delete something inside it. since i open it but there is nothing to delete.
i don't know if you mean that we have to put the value 0.
can you please advice and clarify

thank you very much

I contacted HP as I was having the same issue on Vista Ultimate with a HP 1020 networked to several of computers as a shared printer. They had me use a program called "killbox.exe" where you plug in the path of the file ( in my case in is in the windows system32 direcory) and it kills the file upon reboot. Try this site for the file When you run the program select "delete on reboot" and "all files" then select the red x in the upper right corner. It will then ask you if you wish to reboot at that time.

Hope that may help

You guys are close on this. The problem is that HP is now bundling a bunch of executables with the PCL6 and some of their PCL5 and PCL5e drivers. Your solutions are okay, but they are only band-aids and will cause you issues in the future.

hello guys,
i have 3 sun terminal server with windows 2003 server installed. from 3 years the server every 2 or 3 month wil get crashed for 3 or 4 days, and after that the situation will be back to normal. the situation now is getting worst.
during the crash, the users cannot do anything, the system is stuck totaly, no outlook no excel, nothing.

did you face anything like that before????????

Thank you very much for this useful article and the comments. I love this site as it contains good materials.

Did this help you? You can help me!

Did you find this information helpful? You can help me back by linking to this page, purchasing from my sponsors, or posting a comment!

+One me on Google:

Follow me on twitter:


Affiliation Badges