KNOWN ISSUE: Spoolsv.exe process deletes the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" key

Article:TECH164511  |  Created: 2011-07-13  |  Updated: 2011-07-13  |  Article URL http://www.symantec.com/docs/TECH164511
NOTE: If you are experiencing this particular known issue, we recommend that you Subscribe to receive email notification each time this article is updated. Subscribers will be the first to learn about any releases, status changes, workarounds or decisions made.
Article Type
Technical Solution


Environment

Subject

Issue



After virtualising a PDF Writer application which contains the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" registry key, it was found that after a reboot that registry no longer existed.

After deactivating the layer, its writable section contains this registry key as a delete item, and it no longer exists in its readable section.

Process monitor captured the "spoolsv.exe" process as performing the delete action.

 

The following base behaviour on a vanilla Windows 7 machine was seen:

1. Disabling the spooler service and then rebooting the machine causes this HKLM\SYSTEM key to be deleted.
2. Either enabling the spooler service and rebooting or simply opening the “Devices and Printers” control panel applet causes the HKLM\SYSTEM key to be created again (the HKLM\SYSTEM key items seems to be created from the HKLM\SOFTWARE key items).


Environment



Windows 7 32 bit Service Pack (SP) 1

Symantec Workspace Virtualization (SWV) 6.1.5126 and later.


Cause



This issue is still under investigation; however, it could be related to Windows 7 using symbolic links for certain registry hives.


Solution



Symantec development are still investigating this issue.


Supplemental Materials

SourceETrack
Value2428295 - Spoolsv.exe process deletes the "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Printers" key


Article URL http://www.symantec.com/docs/TECH164511


Terms of use for this information are found in Legal Notices