InformationThis policy setting allows users to dynamically load a new device driver on a system. An attacker could potentially use this capability to install malicious code that appears to be a device driver. This user right is required for users to add local printers or printer drivers in Windows Vista.
The recommended state for this setting is: Administrators.
Note: This user right is considered a 'sensitive privilege' for the purposes of auditing.
Device drivers run as highly privileged code. A user who has the Load and unload device drivers user right could unintentionally install malicious code that masquerades as a device driver. Administrators should exercise greater care and install only drivers with verified digital signatures.
If you remove the Load and unload device drivers user right from the Print Operators group or other accounts you could limit the abilities of users who are assigned to specific administrative roles in your environment. You should ensure that delegated tasks will not be negatively affected.
SolutionTo establish the recommended configuration via GP, set the following UI path to Administrators:
Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Load and unload device drivers
On Member Servers: Administrators.
On Domain Controllers: Administrators, Print Operators.
Microsoft Windows Server 2019 Security Technical Implementation Guide:
Version 2, Release 1, Benchmark Date: November 13, 2020
Vul ID: V-205762
Rule ID: SV-205762r569188_rule
STIG ID: WN19-UR-000150
Severity: CAT II