Print Spooler¶
The Print Spooler service is on every Windows machine and required on a print server. It has a long history of serious vulnerabilities; the 2021 PrintNightmare bugs let any user install a "printer driver" that ran as SYSTEM.
Not a print server¶
Both benchmarks (Windows 11 5.17, Server 2022 5.1) make disabling the spooler a Level 2 item, and it's the only service the server benchmark names at all. The README says whether printing is a job of this machine.
Disable it.
Set-Service Spooler -StartupType Disabled -Status Stopped
A print server¶
The service stays on (Automatic). Then restrict who can install drivers.
gpedit.msc → Computer Configuration → Administrative Templates → Printers:
| Setting | Value |
|---|---|
| Limits print driver installation to Administrators (18.7.10) | Enabled |
| Point and Print Restrictions (18.7.12, 18.7.13) | Enabled. Users can only point and print to these servers: ticked, with the server's name. When installing drivers for a new connection: Show warning and elevation prompt. When updating drivers for an existing connection: Show warning and elevation prompt. |
| Allow Print Spooler to accept client connections | Enabled (it's a print server) |
Also secpol.msc → Security Options → Devices: Prevent users from installing printer drivers: Enabled.
Then check each shared printer's permissions (Settings → Printers & scanners → the printer → Printer properties → Security). Standard users and Everyone should have Print only; Manage this printer and Manage documents stay with Administrators (STIG WN22-00-000180). A user who can manage the printer can change its driver, which is the PrintNightmare path all over again.
RPC and redirection settings¶
The 2021 and 2022 spooler vulnerabilities were about how the spooler talks over RPC and how it handles redirected files. gpedit.msc → Administrative Templates → Printers:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.7.2 | Configure Redirection Guard | Enabled: Redirection Guard Enabled | The spooler refuses to follow file-system redirections (junctions, symlinks), which several privilege-escalation exploits used |
| 18.7.3 | Configure RPC connection settings: Protocol to use for outgoing RPC connections | Enabled: RPC over TCP | Named pipes are avoided |
| 18.7.4 | Configure RPC connection settings: Use authentication for outgoing RPC connections | Enabled: Default | |
| 18.7.5 | Configure RPC listener settings: Protocols to allow for incoming RPC connections | Enabled: RPC over TCP | |
| 18.7.6 | Configure RPC listener settings: Authentication protocol to use for incoming RPC connections | Enabled: Negotiate (or higher) | |
| 18.7.7 | Configure RPC over TCP port | Enabled: 0 | Dynamic port; no fixed port to target |
| 18.7.8 | Configure RPC packet level privacy setting for incoming connections (under MS Security Guide) | Enabled | Incoming spooler RPC must be encrypted |
| 18.7.11 | Manage processing of Queue-specific files | Enabled: Limit Queue-specific files to Color profiles | Print queues can't be used to deliver arbitrary files |
Level 2: protected print and IPP over TLS¶
Windows protected print replaces third-party printer drivers (the source of PrintNightmare and its relatives) with a Microsoft-signed class driver. Printers must support Mopria or IPP, which most modern ones do.
| CIS | Setting (Printers) | Set to | Why |
|---|---|---|---|
| 18.7.9 | Configure Windows protected print | Enabled | No third-party drivers load into the spooler |
| 18.7.14 | Require IPPS for IPP printers | Enabled | IPP connections use TLS |
| 18.7.15, 18.7.16, 18.7.17, 18.7.18 | Set TLS/SSL security policy for IPP printers | Enabled, all four boxes ticked: disallow invalid CA, non-server certificates, invalid common name, invalid date | The printer's certificate is actually checked |
Check the drivers¶
printmanagement.msc → Print Servers → the server → Drivers. Each driver should belong to a printer the organization has. A driver from an unknown vendor, or for a printer that isn't present, gets removed (right-click → Remove Driver Package).
Driver files live under C:\Windows\System32\spool\drivers\. A file there with a recent date and no matching printer is worth a look.
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v NoWarningNoElevationOnInstall
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v UpdatePromptSettings
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers" /v RedirectionguardPolicy
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled
1, 0, 0, 1, 1.
Example¶
The README says the server hosts the office printers. Get-Service Spooler is Running. Set the three policies, then check drivers: there's a "Generic PostScript" driver dated last week with no printer using it. Remove it.
Try it¶
- Stop and disable the spooler, then try to print to PDF. Start it again.
- Set the Point and Print values and read them back.
Build it¶
A spooler.bat with both modes, disable and harden, chosen by a command-line argument.