Monitoring using "WinPrintMon", why are some universal forwarders reporting "ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart."?

[bravon]

I monitor using "WinPrintMon" on several hundred servers - 17 of those servers gives this error-message at each poll:

04-14-2015 12:05:09.990 +0200 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\bin\splunk-winprintmon.exe"" splunk-winPrintMon - monitorHost::ProcessRefresh: Failed ProcessRefresh: error = '0x800706ba'. Restart.

It's always the same 17 servers - any tips?

[WinPrintMon://printer]
type = printer
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://job]
type = job
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://driver]
type = driver
interval = 600
baseline = 1
disabled = 0
index = windows

[WinPrintMon://port]
type = port
interval = 600
baseline = 1
disabled = 0
index = windows

[lmakonnen2]

how did you enable it?

[bravon · Accepted solution]

The solution was painfully simple - the "Print service" was disabled on the servers. Enabled the print service and the errors stopped.

[edoardo_vicendo]

Some additional details why it happens here:

https://community.splunk.com/t5/Getting-Data-In/splunk-winprintmon-exe-splunk-winPrintMon-monitorHos...

[lmakonnen2]

I have same issues and the problem is that I don't hove access to the servers reporting this error. Can you share how you enabled the services.

[robert_miller]

Did you ever figure out the answer to this? I am seeing the same errors appear on our servers.