I am experiencing this issue on a Server 2022 Standard VM. Only thing I can find is an event log showing the service being disabled by the local system account SID. The printers are network so no USB to unplug. No files in system32\spooler\printers, no one is using the printers connected to this server yet. Happens daily. Anyone find any other info to this mystery?
<System>
<Provider Name="Service Control Manager" Guid="{555908d1-a6d7-4695-8e1e-26931d2012f4}" EventSourceName="Service Control Manager" />
<EventID Qualifiers="16384">7040</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2023-05-31T10:47:51.0763200Z" />
<EventRecordID>6388</EventRecordID>
<Correlation />
<Execution ProcessID="760" ThreadID="2256" />
<Channel>System</Channel>
<Computer>B093-UTL1.domain.com</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData>
<Data Name="param1">Print Spooler</Data>
<Data Name="param2">auto start</Data>
<Data Name="param3">disabled</Data>
<Data Name="param4">Spooler</Data>
</EventData>
</Event>