Windows Print Spooler Hardening Guide: How to Mitigate PrintNightmare and Eliminate Print Spooler Attack Surface

DCs running the Print Spooler are exposed to PrinterBug coercion and historical spooler RCE vulnerabilities. There is no business reason for a DC to run the print spooler.

Disable via Group Policy (apply to Domain Controllers OU): Computer Configuration > Windows Settings > Security Settings > System Services

• Print Spooler: Disabled

Disable via PowerShell (immediate + persistent):

# Stop and disable immediately
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify
Get-Service -Name Spooler | Select-Object Name, Status, StartType
# Expected: Stopped, Disabled

Discover all machines with the spooler running across the domain:

# Query all domain computers for spooler status (requires WinRM or WMI access)
$computers = Get-ADComputer -Filter * -Properties Name | Select-Object -ExpandProperty Name
foreach ($computer in $computers) {
    try {
        $svc = Get-Service -ComputerName $computer -Name Spooler -ErrorAction Stop
        if ($svc.Status -eq 'Running') {
            Write-Output "$computer - Spooler RUNNING"
        }
    } catch {
        Write-Output "$computer - UNREACHABLE"
    }
}

Machines where the spooler is likely needed:

• Dedicated print servers
• Workstations where users print locally (USB or network printer)
• Jump servers where users print from their sessions

Machines where the spooler can be disabled:

• All domain controllers (no exception)
• All servers that are not print servers
• Servers hosting web applications, databases, or infrastructure services

For machines where the spooler must remain running (print servers, workstations), restrict the driver installation behavior that PrintNightmare exploited:

Group Policy path: Computer Configuration > Administrative Templates > Printers

Setting: Point and Print Restrictions

• Enable this policy
• Users can only point and print to these servers: Enabled
  • Enter the FQDN of your authorized print servers (e.g., printserver.domain.com)
• When installing drivers for a new connection: Show warning and elevation prompt
• When updating drivers for an existing connection: Show warning and elevation prompt

Setting: Limits print driver installation to Administrators

• Enabled (this is the key mitigation for PrintNightmare -- non-admin users cannot install printer drivers)

Verify the registry values this policy sets:

# Check Point and Print configuration
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint' |
    Select-Object Restricted, TrustedServers, ServerList, NoWarningNoElevationOnInstall, UpdatePromptSettings
# NoWarningNoElevationOnInstall should be 0 (require elevation)
# UpdatePromptSettings should be 2 (show warning and elevation prompt)

Critical post-patch check (August 2021 patch behavior change): Microsoft's August 2021 patch for PrintNightmare changed the behavior: even with the Point and Print GPO set, driver installation now requires admin elevation by default. However, if your GPO explicitly sets NoWarningNoElevationOnInstall = 1 ("do not prompt"), it overrides the patch protection. Verify your existing GPO does not have this insecure setting.

Detect PrinterBug coercion attempts (authentication coercion from DCs):

# If you have disabled the spooler on DCs:
# Any application trying to use MS-RPRN on the DC will fail
# Monitor Windows Firewall or network logs for inbound connections to port 445
# originating from DCs going to unexpected destinations -- sign of a coercion attempt
# that triggered before the spooler was disabled

Detect PrintNightmare exploitation (driver installation abuse):

# Event ID 316 in Microsoft-Windows-PrintService/Admin:
# 'The print spooler failed to load a plug-in module [path]'
# This fires when an exploit attempt loads a malicious DLL as a printer driver

# Event ID 808 in Microsoft-Windows-PrintService/Admin:
# 'The print spooler failed to share printer [name] with shared resource name [name]

# Event ID 4656/4663 (Object Access audit) for:
# C:\Windows\System32\spool\drivers\ write access from unexpected accounts

# PowerShell-based detection:
Get-WinEvent -LogName 'Microsoft-Windows-PrintService/Admin' |
    Where-Object { $_.Id -in @(316, 808) } |
    Select-Object TimeCreated, Id, Message

Monitor for new driver installations on print servers:

# Event ID 4657 (Registry value modified) for:
# HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments
# New driver entries here indicate a driver installation event
# Baseline the legitimate drivers and alert on additions