Print Spooler¶
The Print Spooler service is on every Windows machine and required on a print server. It has a long history of serious vulnerabilities; the 2021 PrintNightmare bugs let any user install a "printer driver" that ran as SYSTEM.
Not a print server¶
Disable it.
Set-Service Spooler -StartupType Disabled -Status Stopped
A print server¶
The service stays on (Automatic). Then restrict who can install drivers.
gpedit.msc → Computer Configuration → Administrative Templates → Printers:
| Setting | Value |
|---|---|
| Limits print driver installation to Administrators (18.7.10) | Enabled |
| Point and Print Restrictions (18.7.12, 18.7.13) | Enabled. Users can only point and print to these servers: ticked, with the server's name. When installing drivers for a new connection: Show warning and elevation prompt. When updating drivers for an existing connection: Show warning and elevation prompt. |
| Allow Print Spooler to accept client connections | Enabled (it's a print server) |
Also secpol.msc → Security Options → Devices: Prevent users from installing printer drivers: Enabled.
RPC and redirection settings¶
The 2021 and 2022 spooler vulnerabilities were about how the spooler talks over RPC and how it handles redirected files. gpedit.msc → Administrative Templates → Printers:
| CIS | Setting | Set to | Why |
|---|---|---|---|
| 18.7.2 | Configure Redirection Guard | Enabled: Redirection Guard Enabled | The spooler refuses to follow file-system redirections (junctions, symlinks), which several privilege-escalation exploits used |
| 18.7.3 | Configure RPC connection settings: Protocol to use for outgoing RPC connections | Enabled: RPC over TCP | Named pipes are avoided |
| 18.7.4 | Configure RPC connection settings: Use authentication for outgoing RPC connections | Enabled: Default | |
| 18.7.5 | Configure RPC listener settings: Protocols to allow for incoming RPC connections | Enabled: RPC over TCP | |
| 18.7.6 | Configure RPC listener settings: Authentication protocol to use for incoming RPC connections | Enabled: Negotiate (or higher) | |
| 18.7.7 | Configure RPC over TCP port | Enabled: 0 | Dynamic port; no fixed port to target |
| 18.7.8 | Configure RPC packet level privacy setting for incoming connections (under MS Security Guide) | Enabled | Incoming spooler RPC must be encrypted |
| 18.7.11 | Manage processing of Queue-specific files | Enabled: Limit Queue-specific files to Color profiles | Print queues can't be used to deliver arbitrary files |
Level 2: protected print and IPP over TLS¶
Windows protected print replaces third-party printer drivers (the source of PrintNightmare and its relatives) with a Microsoft-signed class driver. Printers must support Mopria or IPP, which most modern ones do.
| CIS | Setting (Printers) | Set to | Why |
|---|---|---|---|
| 18.7.9 | Configure Windows protected print | Enabled | No third-party drivers load into the spooler |
| 18.7.14 | Require IPPS for IPP printers | Enabled | IPP connections use TLS |
| 18.7.15, 18.7.16, 18.7.17, 18.7.18 | Set TLS/SSL security policy for IPP printers | Enabled, all four boxes ticked: disallow invalid CA, non-server certificates, invalid common name, invalid date | The printer's certificate is actually checked |
Check the drivers¶
printmanagement.msc → Print Servers → the server → Drivers. Each driver should belong to a printer the organization has. A driver from an unknown vendor, or for a printer that isn't present, gets removed (right-click → Remove Driver Package).
Driver files live under C:\Windows\System32\spool\drivers\. A file there with a recent date and no matching printer is worth a look.
Verify¶
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v RestrictDriverInstallationToAdministrators
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v NoWarningNoElevationOnInstall
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" /v UpdatePromptSettings
reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers" /v RedirectionguardPolicy
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled
1, 0, 0, 1, 1.
Example¶
The README says the server hosts the office printers. Get-Service Spooler is Running. Set the three policies, then check drivers: there's a "Generic PostScript" driver dated last week with no printer using it. Remove it.