Spoolsv.exe High CPU: Safe Print Spooler Fix

spoolsv.exe is normally the legitimate Windows Print Spooler process. Sustained high CPU, memory, or disk use usually means it is retrying a stuck job, loading a faulty printer driver, polling a broken network printer or port monitor, or rapidly writing spooler errors. Cancel the queue first, stop the service before touching spool files, and isolate the printer or driver that makes the load return. Treat it as malware only when the path, signature, parent process, or persistence is suspicious.

Fast verdict: do not delete C:\Windows\System32\spoolsv.exe. If printing is stuck, cancel jobs and restart the Print Spooler. If the load returns with an empty queue, test printers and drivers one at a time. A copy outside System32 needs a separate security check.

What Is Spoolsv.exe?

spoolsv.exe runs the Windows Print Spooler service, shown in Task Manager as Spooler SubSystem App. It accepts print jobs from applications, holds them in a queue, and passes them to a local, network, virtual, or shared printer through installed drivers and ports.

The process can appear even when you are not actively printing because Windows and applications may enumerate printers in the background. Brief activity is normal. A process that stays near the top of Task Manager, grows continuously, fills disk space, or stops all printing needs investigation.

Match the Symptom to the Likely Cause

What you see	Most useful next check
High CPU with jobs stuck in the queue	Cancel the jobs. Stop the service before clearing abandoned files from the spool folder.
High CPU returns after the queue is empty	Disconnect or remove printers one at a time, then update or reinstall the driver for the printer that triggers the loop.
Memory or handle count keeps growing	Look for a driver, print processor, or port monitor leak; note which printer was used before growth began.
Disk use is high or free space falls	Check queued spool files. On a Windows print server, also check whether `%systemroot%\System32\spool\spooler.xml` is growing.
No printer is configured, but a copy keeps running	Confirm the file location and Microsoft signature, then inspect its parent process and startup context.

1. Clear the Print Queue Without Deleting the Wrong Files

Open Settings → Bluetooth & devices → Printers & scanners.
Select the printer, open its queue, and cancel every job you no longer need.
Wait a minute and check Task Manager. If CPU drops, the blocked job was probably the trigger.
If jobs will not cancel, press Windows key + R, run services.msc, right-click Print Spooler, and choose Stop.
Open %WINDIR%\System32\spool\PRINTERS. Delete only the abandoned queue files inside that folder, not the folder itself and not spoolsv.exe.
Return to Services and start Print Spooler.

This removes pending jobs. It does not repair a bad driver, network port, print processor, or damaged application. Save the source document before clearing the queue because removed jobs cannot be resumed.

Administrators can perform the same guarded sequence in PowerShell. Review the listed jobs before running the removal line:

Stop-Service -Name Spooler
Get-ChildItem "$env:WINDIR\System32\spool\PRINTERS"
# Run only after confirming every listed job is abandoned
Remove-Item "$env:WINDIR\System32\spool\PRINTERS\*" -Force
Start-Service -Name Spooler

2. Find the Printer, Driver, or Port That Restarts the Loop

If CPU rises again with an empty queue, the spooler may be repeatedly calling a faulty component. Do not uninstall every printer at once; isolate the trigger so you preserve a working configuration.

Disconnect USB printers and temporarily take network printers offline.
Restart Print Spooler and watch CPU for several minutes.
Reconnect one printer at a time. Print a small Windows test page after each change.
When the load returns, remove that printer queue and install its current driver from Windows Update or the printer manufacturer’s support page.
On managed systems, inspect Print Management for old duplicate drivers, print processors, and vendor port monitors associated with that printer.

Do not delete driver files or port-monitor registry keys by hand just because a forum names them. Printer packages share components, and blind deletion can leave the spooler unable to start. If an unknown driver updater installed the package, use the fake driver updater cleanup guide before reinstalling the correct driver.

3. Check Spooler.xml Only on a Windows Print Server

Microsoft documents a separate Windows Server condition where spoolsv.exe consumes CPU while %systemroot%\System32\spool\spooler.xml grows and can exhaust disk space. The CPU load comes from the spooler rapidly writing an error condition to the log. This is not the normal first explanation on a Windows 10 or Windows 11 home PC.

On a print server, record the file size and growth rate, free disk space, recent printer changes, and the queue or driver active when growth started. Microsoft provides the DisableWERLogging workaround under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Print, followed by a spooler restart. Apply that server-side workaround only after a configuration backup and change review: it stops the logging loop but does not identify the driver, port, or queue that entered the error state.

4. Should You Disable Print Spooler?

Stopping the service is a good diagnostic test. Permanently disabling it is appropriate for a server, kiosk, or hardened PC that never prints. On a normal workstation, it prevents applications from sending jobs and can break local, network, virtual, and shared printing. That is a trade-off, not a repair.

If your concern is exploit exposure rather than resource use, the Print Spooler vulnerability guide explains when disabling the service is a security control. A high-CPU loop by itself is not evidence of PrintNightmare or another exploit.

Is Spoolsv.exe a Virus?

The genuine Windows file is C:\Windows\System32\spoolsv.exe and should have a valid Microsoft signature. High CPU alone does not make it malicious. A stuck job or driver loop is much more common.

In Task Manager, right-click Spooler SubSystem App or spoolsv.exe and choose Open file location.
Open Properties → Digital Signatures and verify a valid Microsoft signer. The EXE verification guide explains how path, signature, source, and behavior work together.
Investigate copies in AppData, Temp, Downloads, a user profile, or a program folder. Also check an unexpected parent process, newly created task/service, or a security warning.
Use Microsoft Sysinternals Sigcheck if you need command-line signature and version details; do not download a replacement spoolsv.exe from an EXE library.

If the wrong-path copy already ran, removing only that visible file may leave a scheduled task, service, startup entry, bundled app, or another loader that recreates it. Preserve the path and alert details, disconnect from untrusted networks if there is unexplained traffic, and run a full Gridinsoft Anti-Malware scan to check for related files and persistence. The suspicious startup app checklist can help review entries before deleting them.

Check suspicious process lookalikes and startup sources.

If the process path is wrong, the name imitates a Windows component, or high CPU started after an unknown installer, scan for hidden miners, services, startup entries, and bundled components.

Scan a suspicious spoolsv.exe copy

If High CPU Keeps Returning

Note whether the spike begins at sign-in, when an application opens a print dialog, or only after a specific printer receives a job.
Remove obsolete printer queues and duplicate drivers through supported Windows interfaces.
Update Windows, then install the printer vendor’s current driver and firmware where applicable.
Check Event Viewer for repeated PrintService errors at the same time as the spike.
On a managed print server, collect the queue, driver, port monitor, handle count, and Spooler.xml evidence before restarting the service again.
If WMI Provider Host spikes alongside printer-management software, use the WmiPrvSE.exe high-CPU workflow to identify the caller instead of blaming both Windows processes.

FAQ

Can I end Spooler SubSystem App in Task Manager?

You can stop Print Spooler temporarily, but use Services or PowerShell so the service state is clear. Printing will not work until the service starts again.

Why does spoolsv.exe use CPU when I am not printing?

An application may be checking printers, a queued job may be retrying, or a driver, network port, or monitor may be looping. An empty visible queue does not rule out a driver or port problem.

Is it safe to delete files from the PRINTERS folder?

Only after Print Spooler is stopped and only when the jobs are abandoned. Delete the files inside %WINDIR%\System32\spool\PRINTERS, not the folder, the service executable, or unrelated spool directories.

Does a growing Spooler.xml mean malware?

No. Microsoft documents it as a Windows Server error-logging loop. Investigate the print-server error condition and affected driver or queue; use malware checks only when other path, signature, persistence, or behavior evidence is suspicious.

Should spoolsv.exe access the network?

Network activity can be normal when Windows communicates with a network or shared printer. Investigate traffic when no such printer exists, the executable uses the wrong path or signature, or the destination and parent process do not match printing.

References

Microsoft. “Fix print spooler service not running errors in Windows.” Microsoft Support, accessed August 18, 2026. https://support.microsoft.com/en-us/windows/hardware/printer/fix-print-spooler-service-not-running-errors-in-windows
Microsoft. “Spooler.xml file growth and high CPU in spoolsv.exe process on print server.” Microsoft Learn, updated February 12, 2026, accessed August 18, 2026. https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/spooler-xml-file-grow-spoolsv-exe-high-cpu
Mark Russinovich. “Sigcheck v2.91.” Microsoft Sysinternals, updated February 4, 2026, accessed August 18, 2026. https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck

Spoolsv.exe High CPU: Fix Print Spooler Safely