18.7.1 (L1) Ensure 'Allow Print Spooler to accept client connections' is set to 'Disabled'

Information

This policy setting controls whether the Print Spooler service will accept client connections.

The recommended state for this setting is: Disabled

Note: The Print Spooler service must be restarted for changes to this policy to take effect.

Disabling the ability for the Print Spooler service to accept client connections mitigates remote attacks against the PrintNightmare vulnerability (

CVE-2021-34527

) and other remote Print Spooler attacks. However, this recommendation

does not

mitigate against local attacks on the Print Spooler service.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled :

Computer Configuration\Policies\Administrative Templates\Printers\Allow Print Spooler to accept client connections

Note: This Group Policy path is provided by the Group Policy template printing2.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.

Impact:

Provided that the Print Spooler service is not disabled, users will continue to be able to print

from their workstation

. However, the workstation's Print Spooler service will not accept client connections or allow users to share printers. Note that all printers that were already shared will continue to be shared.

See Also

https://workbench.cisecurity.org/benchmarks/16514