Windows 11 25H2: How can I restore printing after KB5132043 without leaving security updates uninstalled?

Question

Windows 11 25H2: How can I restore printing after KB5132043 without leaving security updates uninstalled?

Red 0

Intune managed devices lost access to physical and virtual printers after the November 2026 updates. One affected computer was running Windows 11 build 26200.9911 with KB5132043 and KB5135385 installed.

Settings → Bluetooth & devices → Printers & scanners shows all printers as “Not connected,” including Microsoft Print to PDF. Printing is unavailable, and Add Printer reports that the local Print Spooler service is not running.

Diagnostic results:

Get-Printer returns “The spooler service is not reachable,” HRESULT 0x800706BA.

sc.exe queryex spooler reports STOPPED, WIN32_EXIT_CODE 1067, and PID 0.

RPC-related services remain running.

Updating Windows, restarting the computer, and restarting the spooler did not resolve the issue. Uninstalling KB5132043 restored printing on one affected computer. I have not established the underlying cause.

What troubleshooting or supported remediation should I use to restore printing while keeping these computers protected with current security updates?

0 comments

2 answers

Your answer

Answer 1

Hi Red,

Based on your findings, the most significant clue is that the Print Spooler service is terminating with Win32 Exit Code 1067, and uninstalling KB5132043 temporarily restores printing. This suggests that the update may be exposing an existing issue with a print driver, print monitor, printer management software, or spooler dependency rather than the update itself being the sole root cause.

My first recommendation is to review Event Viewer > Windows Logs > Application and System, as well as Applications and Services Logs > Microsoft > Windows > PrintService, looking for spooler crashes, faulting modules, or driver-related events that occur when the spooler starts. Since Microsoft Print to PDF is also reported as unavailable, I would investigate whether the problem affects the entire print subsystem rather than a specific printer driver. It is also worth testing whether the spooler starts successfully after temporarily removing third-party printer drivers and print management utilities from an affected device.

To remain protected with current security updates, I would avoid relying on uninstalling the update as a long-term solution. Instead, compare a healthy updated machine with an affected one and look for differences in installed printer drivers, print processors, language monitors, or endpoint security software. If the spooler crash consistently references the same module or driver, updating or removing that component is often enough to restore printing while keeping the security updates installed.

Additionally, verify the integrity of the print subsystem and confirm that the Print Spooler dependencies and services are configured correctly. If multiple devices are affected, gathering crash details from several systems can help identify a common component responsible for the failures.

I hope the response provided some helpful insight. If you find this answer useful, please hit “accept answer” so I know it addressed your concern.

Jason

Answer 2

Replace the November hotpatch with the latest standard cumulative update on a pilot device; this keeps the device on current security fixes while moving it from build 26200.9911 to the standard November build 26200.9974.

Supported protected remediation

Microsoft explicitly recommends this path when a hotpatch causes an unexpected problem: uninstall the hotpatch, install the latest standard cumulative update (LCU), and restart. Automatic hotpatch rollback is not supported. ^1^

In Intune admin center → Devices → Windows updates → Quality updates, exclude a small affected-device group from the hotpatch-enabled policy or assign it a quality-update policy with hotpatch disabled.
On one pilot device, uninstall KB5132043.
Scan Windows Update and install the November standard LCU, KB5132061.
Restart the device.
Confirm:
```
   Get-ComputerInfo | Select-Object WindowsVersion, OsBuildNumber
   Get-Service Spooler
   Get-Printer
```
The expected OS build for Windows 11 25H2 is 26200.9974, with the spooler running and printers enumerable. KB5132061 applies to all Windows 11 25H2 editions and retains the November security improvements. ^2^
Test physical printing and Microsoft Print to PDF, then deploy through the normal Intune rings.

This differs from leaving KB5132043 uninstalled: the device immediately receives the standard cumulative security update instead.

KB5135385 does not provide a printing remediation. It is a standalone PowerShell security update offered to eligible hotpatch devices after the November hotpatch, and Microsoft currently lists no known issues for it. ^3^

If the spooler still exits with 1067 on build 26200.9974

Because restarting it has already failed, capture the crash event and then reset its queue rather than repeating another ordinary restart.

Check Event Viewer → Windows Logs → Application and Applications and Services Logs → Microsoft → Windows → PrintService → Admin. Record the faulting module, exception code, and any print provider, processor, monitor, or driver named immediately before spoolsv.exe exits. Microsoft recommends checking event logs for errors initializing the local print provider. ^4^

Clear the spool directory. This deletes queued print jobs, so preserve any required jobs first.

   Stop-Service Spooler -Force -ErrorAction SilentlyContinue
   $queue = "$env:windir\System32\spool\PRINTERS"
   Get-ChildItem $queue -Force |
       Remove-Item -Force -Recurse
   Set-Service Spooler -StartupType Automatic
   Start-Service Spooler
   Get-Service Spooler
   Get-Printer

Clearing stale .SPL/.SHD files and starting the service with an Automatic startup type is Microsoft’s documented spooler reset. ^5^

If it crashes again and the event identifies a third-party component, remove or update that specific driver/package. Do not remove every queue first: failure of Microsoft Print to PDF is consistent with a spooler-wide failure, not proof that each printer connection is defective.
Where the vendor driver supports it, configure it as Shared or Isolated in Print Management → Print Servers → local computer → Drivers → driver properties → Driver Isolation. Isolation prevents a faulting driver component from halting the spooler itself. ^6^
If no vendor feature is required, pilot Microsoft’s IPP inbox class driver/modern print platform instead of the vendor driver. Microsoft identifies that platform as preferred on Windows 10 and 11. ^6^

Enterprise escalation

There is currently no documented KB5132043 spooler/1067 known issue: its release notes state that Microsoft is not aware of issues with the update. ^7^

Do not deploy an unrelated Known Issue Rollback. KIR normally rolls back specific nonsecurity changes and requires Microsoft to publish a matching policy definition; no matching printing KIR is documented here. ^8^

If the standard LCU does not resolve the crash, reproduce it on one device and collect Microsoft’s printing trace before opening a support case:

.\TSS.ps1 -start -UEX_Print -Procmon -netsh

The printing scenario gathers spooler, process-monitor, and network evidence suitable for support analysis. ^9^

Include the .zip, affected/unaffected build numbers, installed printer-driver inventory, Application and PrintService events, and the result showing that uninstalling KB5132043 changed the behavior.

References