Remote Downlevel Document shows up in print queue when terminal session is started

[Daniel F]

Hi,
I??m getting this weird problem that is basicly as described in the header. When a connection is made to the terminal server, (this is only done from one machine in the network running win2000 and server is 2000 Small business), a remote downlevel document appears in the print queue for one of the printers (always the same printer). This document is 0 bytes so it blocks the queue and it takes a couple of minutes to get deleted.
While on this subject I??m also getting a remote downlevel document when trying to print from a dos program (Concorde), when a document is printed from an NT system (2000 and XP) a document of 0 bytes appears in the queue before the real document.

Yes, we had the Bugbear virus but it has been removed from the server and these machines, I have already run the Stinger and we have Norton AV corporate edition running.
With thanks in advance,
Daniel F.

[Jon Finley]

Looks like SOMEWHERE you'e still infected.

http://support.microsoft.com/default.aspx?scid=kb;en-us;312015

http://vil.mcafee.com/dispVirus.asp?virus_k=10419

http://vil.mcafee.com/dispVirus.asp?virus_k=99728

Jon

[Daniel F]

thank you for your response, although it did not solve my problem. There are no viruses present and I??m still having this problem
Sorry about my late response too :/.
Best regards,
Daniel

[IanS_1]

Here on our network we are having the exact same problem. We have Trend Virsu Wall running on the gateway and have not seen anything to indicate that we are infected.

[Jon Finley]

Here's a possibility for both of you.

If you share a printer, AND use the NET USE command to redirect LPT1 you will get "Remove Downlevel Document" messages.

Clear out the net use command, and all is well.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q137065

Jon

[Jon Finley]

Hmmm looks like a related problem that affected Win95, but the issue COULD be related to your Virus software.

http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q162447

Jon

[Daniel F]

Nope,
Not using net use on the server for any printers and the problem occurs on machines that have no, and have never had, antivirus software installed.
This is really something, I am upgrading the antivirus software this week though so if this is somekind of fault on the antivirus software on the server that should come clear. I am currently using Symantec antivirus corporate 7.0 and am upgrading to 8.0 but I have found no documentation on an error like this on the symantec website so I don??t suspect it to be the problem.
Best Regards,
Daniel F.

[Jason Rives]

Hey everyone,
I registered my name to HP as soon as I saw this problem when searching for "remote downlevel document." First off, I discovered this problem while connected to the network with a local printer on my computer. Well...this problem has nothing to do with local or remote printer setups, but with users on the network who have the BUGBEAR virus or some other virus on their computer. How did I come about this discovery... I upgraded my computer to windows xp in order to load a new OS and to have a clean system just in case it was my computer with the virus. The print queue then came up with a message that someone was printing, and with windows xp, it listed the user name. Since then, I disconnected his laptop from the network and everything runs fine. I suggest placing a local printer on a computer running XP, removing the paper, and let the document try to print in its random time. Discover who the user is by opening the print queue, make backups of their files, reformat their computer, and reinstall a new OS in that person's computer. Good Luck,
Jason J Rives
Alpharetta, GA

[Jon Finley]

Daniel.. Found a link that may be helpful.

http://support.microsoft.com/default.aspx?scid=kb;en-us;328716

Jon

[Daniel F]

Called Microsoft Denmark,
obtained hotfix,
No luck.

This problem is keeping me from sleeping at night.

I really don??t know what this could be, I have upgraded the virus software on the server and XP clients and I still get this problem, some of the win98 clients havent got updated yet but the definiton files are up to date and there??s no indication of viruses other than all the articles and responses I??ve seen to this problem that point to them.

Stay tuned for another unsolved mystery.....:P
going home for the day....
Cya guys

Daniel F.

[Niki Sparks]

We have a similar problem, & also have the Norton AV corporate edition running. We have a Win 2K network with 5 clients & 2 networked printers[1 HP & 1 Lexmark]. When a certain Laptop client logs on we get this Remote downlevel document job generated & we then get several reams of paper spewed from both printers. Cancelling the job will not stop it but pulling the plug will! I am desperate to save several thousand trees from an unecessary death, so is there anything i can try??

Thanks :o)

[Daniel F]

Finally I have solved this problem, it was a strange one indeed, once I removed one of the computers from the network the problem disappeared, but the strange thing is that this computer did not seem to be infected by a virus.
It had Norton antivirus corporate edition 7.0 with latest definitions but did not find a virus, I ran Stinger, bugbear removal tool, brid tool funlove tool and a couple of others and then installed Norton antivirus corporate edition 8.0 with latest definitions but it never found anything.

I noticed that after I uninstalled Norton 7.0 I accidentally had the computer connected to the network (yes I know better) but then things were still working fine so it seems that this problem had to do something with the virus software on this specific machine.

Best Regards,
Daniel F.

[David DiGiovanni]

I am getting a message box with the file name in it because my printer is printing constantly, the message appears when I run out of paper.

How do I get rid of this?

[Thomas Lawrence]

Quick Fix! Go to the Print Server and stop the print spooler services then restart them. Be careful, this will remove everything from the queue.

[Jon Finley]

Well... I've stopped and started the spooler service on both NT and 2000 and it doesn't appear to clear out the spooled documents. It appears to clear whatever error state it was in at the time though. :-)

Jon

[Jan Burbage]

Hi Daniel F.

You wrote: "Finally I have solved this problem, it was a strange one indeed, once I removed one of the computers from the network the problem disappeared, but the strange thing is that this computer did not seem to be infected by a virus.
It had Norton antivirus corporate edition 7.0 with latest definitions but did not find a virus, I ran Stinger, bugbear removal tool, brid tool funlove tool and a couple of others and then installed Norton antivirus corporate edition 8.0 with latest definitions but it never found anything.

I noticed that after I uninstalled Norton 7.0 I accidentally had the computer connected to the network (yes I know better) but then things were still working fine so it seems that this problem had to do something with the virus software on this specific machine.

Best Regards,
Daniel F. "

which was in regard to "Remote Downlevel Document shows up in print queue when terminal session is started" posting. I am trying to understand if you have a similar problem as we do. I have a Windows 2000 PC setup as a print server (3 printers are attached - HP Laserjet 4050, Okidata Pacemarc, Okidata ML 393). We had a mixture of Windows 95 and Windows 2000 computers which print to these printers. I am not sure if we were seeing "remote downlevel documents" when we had a mixture of OS but now that we have all Windows 2000, I see RDD (remote downlevel document) in the print queue for everything printed through Windows 2000 (Excel, WordPerfect, etc.). Only documents printed through Unix which they telnet into has the name of the file being printed. All users were setup logging into print server as guest (but I have set up a login now for each user - I see their name along with RDD now). I have atleast one additional line that has no size for each print job - along with the print job that has size to it. We would like to see the file name being printed. We, also, are using Norton Antivirus Corporate version 7.60.926 on all computers attached to the network. But as you found out for your stituation this was not the problem - right? What was wrong with the computer you unattached from your network that showed you the problem. Did that computer effect everyone's listing or was it just that computer that was giving you the RDD message in the queue? I am using NET USE for the DOS base programs we still have but I have played with this and it doesn't seem to matter if it's in the mix or not. Just as a side note: I have set up the port to be \\prserver\finhp5 for the HP 4050. I thought when I downloaded the up to date drivers for this printer, I had only one line even though it was a RDD message but have seen lately this is not the case - I can have more than one line per print job - at least one with no size. I have check at Microsoft and the only documents I find are about virus, Loop Continiusly (not happening) and one other but none seem to be the problem I am having. Any help you can give me would be appreciated. Thanks, Jan (jburbage@lex-co.com)

[Ty1]

Hi Daniel,

This is a known issue with Windows 2000 SP3. The fix is to upgrade to SP4.

The hotfix is also applied by security hotfix MS03-070.
Redirected Printing Through a Terminal Services Session May Not Work with Windows 2000 SP3
http://support.microsoft.com/?id=328020

MS02-070: Flaw in SMB Signing May Permit Group Policy to Be Modified
http://support.microsoft.com/default.aspx?scid=kb;EN-US;329170

Hotfix can be downloaded here:-
Q329170_W2K_SP4_X86_EN.exe
http://www.microsoft.com/downloads/details.aspx?FamilyId=52EAC216-A360-4E2D-9C6B-AD4D31C40BA2&displaylang=en

I had a similar issue printing from thin clients, and upgrading to SP4 resolved the issue.

Regards

Ty

[Jan Burbage]

Tyronne,

I am the last person to respond to Daniel's first message. I am trying to see if his solution would apply to my situation. I am not using Terminal Services to print but it sounds like we are getting the same results - the dreaded "remote downlevel document". I am not sure your fix of installing SP4 will fix my problem. Since you seemed to be responding to Daniel's e-mail, can you re-read my e-mail and let me know if your e-mail applies to my situation. I don't seem to see it when I have read your links. Thanks, Jan

[Ty1]

Hi Jan,

The main similarities between my issue and that seen in the origional post was terminal services and spool files of 0 bytes. In our case we had sone office apps printing fine, whereas other Office apps wouldn't print at all. When we examined the event logs, we discovered that the path to the spool file changed for the non working apps. We contacted MS support and were given the above, MS at that time were unable to determine the exact root cause, but were able to fix with SP4. We installed SP4 and it worked correctly.

Anyway to answer your question, I am not sure that we had the same issue as either or the first post, but I felt that there were enough similarities to be worth suggesting.

Sorry if I am not realy offering any clearer help.

Regards

Ty

[Kurt Bilteryst]

Hi,

Within our company we have similar problems with. We have a machine (running on xp) that is connected to the network. The printer we're using is connected to the PC via the com1-port and is not shared. Every time we print, the first job that arrives in the queue is a "local downlevel document". The second job is the actual print job. The first job causes a certain delay of 1-2 sec.

Does anyone have an idea how we can get rid of the first "local downlevel docuemnt" job.

[Steve Caldwell_1]

I've read a thousand posts all across the web trying to figure this one
out. In Win 2000, NT, and 2003, network printers spit out garbled pages
until the printer is out of paper. We are losing hundreds of sheets of
paper a day to this nuisance. The object appears in the spool as
"Remote Downlevel Document" and cannot be deleted without a long delay.
The only way to stop it is to pull the plug on the printer. Although I
have not completely solved the problem, I have a point of view which I
have not yet come across.


It is important to note that this will only work if the user name on
the RDD is "Guest" (This is the only username I've heard of that causes
the problem.)


If you are on the computer that has the RDD in the printer queue, you
will need to change some security settings for the printer. Go into the
printer's properties. Click the security tab (If this isnt visible, log
in as admin.) Click add, type in "Guest" for the user name" Now, deny
the guest of all printing privledges.


This is simply a work around that is only useful if you don't utilize
the guest user name on your domain.


-- I use WIN2003 Standard as a DC and all of my clients are win XP pro.


--This procedure worked for me for a great deal of time, but the
problem persists here and there.


****--For a network printer...If you cant figure out which pc is
causing the problem...try removing the trays or paper from your printer
and then let it attempt to print the garbage. Then go to every terminal
and see which one is acting up. Then try and change the security
settings.

[Greg Gum]

OK, I have finally found a solution to this problem. First let me describe the issue: At random times, multiple (up to 250) documents would get sent to a printer from a user. The user may not be logged on, and in fact, the computer could be off. The printed documents were garbage, consisting of two or three lines. The document started with "MPZ .... This program must be run under Win32" which is evidence of the Bugbear virus. The document name was always "Remote Downlevel Document."

The affected computers were all running antivirus and had uptodate Windows XP as the OS.

The solution lie in the fact that the user whom the print documents were coming from had weak passwords. Once these passwords were changed, the virus could no longer get into the network.

Hopefully my experiance will help others who have run into this same problem. Simply look in the print que for the user who the document seems to be coming from, and change there password to something strong, like "9d;#))2" and see if this doesn't solve the problem for you.

Greg Gum

[JediMaster]

Hey I have yet to find what causes this problem however if you go to %windir%\system32\spool\printers you will find a .tmp file there possible many of them delete it and the problem will stop.