Print Spooler and Point and Print hardening

The Print Spooler service runs as SYSTEM on almost every Windows machine, loads third-party driver code, and accepts remote RPC calls. That combination produced the PrintNightmare vulnerabilities in 2021 (CVE-2021-1675 and CVE-2021-34527), where an ordinary domain user could get code execution as SYSTEM on any machine with a running spooler, domain controllers included. It also enables the "printer bug": an authenticated user asks a machine's spooler, over the MS-RPRN protocol, to connect to a host they control, forcing the machine account to authenticate there, ready for an NTLM relay or an unconstrained delegation abuse.

Security updates closed the specific bugs. The hardening in this guide removes the classes of problem: spoolers that do not need to run, users who can install drivers, and clients that trust any print server through Point and Print. It is part of the legacy protocols area, alongside the relay defences in the pillar guide.

Step 1: decide where the spooler must run

Find where the spooler is reachable remotely before you change anything. From an admin workstation:

Get-ADComputer -Filter 'OperatingSystem -like "*Server*"' | ForEach-Object {
  [pscustomobject]@{ Host = $_.Name; SpoolerPipe = Test-Path "\\$($_.Name)\pipe\spoolss" }
}

A reachable spoolss named pipe means the spooler is running and listening remotely. The reverse is not proof: Windows 11 22H2 and later listen for print RPC over TCP only by default, so a missing pipe on those machines doesn't mean the spooler is off. Check the service state as well.

Step 2: disable the spooler where it is not needed

Use a GPO linked to the Domain Controllers OU and to server OUs: Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Print Spooler = Disabled. Locally or for testing:

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

Some server applications quietly depend on the spooler for rendering or PDF output (reporting tools, some ERP and label printing software). Check with the application owners on each server before you disable it.

Step 3: stop workstations accepting remote print connections

Workstations need the spooler to print, but they rarely need to accept print jobs or RPC calls from other machines. Set Computer Configuration > Policies > Administrative Templates > Printers > Allow Print Spooler to accept client connections = Disabled (registry HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers RegisterSpoolerRemoteRpcEndPoint = 2). Restart the spooler to apply. Local printing and printing to network queues keep working; the machine just stops being a print server. Do not apply this to real print servers.

Newer Windows versions add related controls under the same Printers folder, including Configure RPC connection settings and Configure RPC listener settings to control whether print RPC uses TCP or named pipes and which authentication it accepts. Since Windows 11 22H2 the defaults are RPC over TCP for outgoing connections and a TCP-only listener; named pipes are off unless you re-enable them. Keep those defaults, and where every machine is domain-joined you can additionally set the listener's authentication protocol to Kerberos.

Step 4: restrict printer driver installation to administrators

After the August 2021 security updates, Windows defaults to allowing only administrators to install printer drivers through Point and Print. Make that explicit so no older policy or troubleshooting change can reverse it:

• GPO: Computer Configuration > Policies > Administrative Templates > Printers > Limits print driver installation to Administrators = Enabled (available in current ADMX templates and in the MS Security Guide templates shipped with the Microsoft security baseline).
• Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint RestrictDriverInstallationToAdministrators = 1.

When this value is 1, it overrides the warning and elevation settings in Point and Print Restrictions. Search your GPOs for anyone who set it to 0 in 2021 to make printing work again; that single value reopens the PrintNightmare attack path.

Get-GPOReport -All -ReportType Xml |
  Select-String -Pattern "RestrictDriverInstallationToAdministrators|NoWarningNoElevationOnInstall" -Context 0,2

Step 5: allow only approved print servers

Configure Point and Print Restrictions under Computer Configuration > Policies > Administrative Templates > Printers = Enabled:

• Users can only point and print to these servers: checked, with the fully qualified names of your print servers.
• When installing drivers for a new connection: Show warning and elevation prompt.
• When updating drivers for an existing connection: Show warning and elevation prompt.

Never use "Do not show warning or elevation prompt"; that is the configuration that made PrintNightmare exploitable on patched systems (NoWarningNoElevationOnInstall = 1).

Then move to Package Point and Print, which only installs drivers packaged with a signed catalog and verifies them:

• Only use Package Point and print = Enabled.
• Package Point and print - Approved servers = Enabled, listing the same print servers.

Legacy, non-package-aware drivers stop installing through Point and Print once this is on. Replace them with current vendor drivers or universal print drivers, or pre-install them with your deployment tool.

Finally, Manage processing of Queue-specific files in the same folder, set to limit queue-specific files to color profiles, closes a follow-up issue where print queues could push arbitrary files to clients.

Step 6: harden the print servers themselves

The print servers that remain are now the only machines distributing drivers to the whole fleet, which makes them a valuable target. Treat them accordingly:

• Dedicated servers. Do not co-host print with file shares, applications or, worse, domain controller roles.
• Patch first. Put print servers in the earliest server patch ring; spooler fixes appear regularly in monthly updates.
• Curate drivers. Keep a short list of current, package-aware drivers from vendors or universal drivers, and remove the rest with Remove-PrinterDriver. Every extra driver is code that runs as SYSTEM on clients.
• Restrict administration. Only a small print admin group can add drivers or queues; that group should not include standard helpdesk accounts that log on to workstations everywhere.
• Firewall scope. Clients need to reach the print server; the print server rarely needs to initiate connections to clients.

Step 7: reduce drivers further on Windows 11

• Windows protected print mode (Windows 11 24H2 and later): Printers > Configure Windows protected print. The spooler then uses only the inbox IPP class driver and refuses third-party drivers. It is the strongest option if your printers support Mopria/IPP.
• Universal Print, Microsoft's cloud print service, removes on-premises print servers and driver distribution for many fleets.
• Redirection Guard (Printers > Configure Redirection Guard) prevents the spooler from following file system redirections such as junctions planted by an attacker. Keep it enabled.

What breaks

• Printing from servers that had the spooler silently in use by an application.
• Users adding printers themselves when the driver is not yet installed on their machine, or when the print server has a newer driver version.
• Legacy drivers that are not package-aware, once Package Point and Print is enforced.
• Printers on non-approved servers, such as a department's own print server or a direct IP printer shared from a colleague's PC. That is intentional; move them to the approved server.

Verify it

Get-Service Spooler | Select-Object Status, StartType          # DCs and servers: Stopped, Disabled
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Name RegisterSpoolerRemoteRpcEndPoint
Get-PrinterDriver | Select-Object Name, Manufacturer, MajorVersion

Expect RestrictDriverInstallationToAdministrators = 1, NoWarningNoElevationOnInstall absent or 0, and RegisterSpoolerRemoteRpcEndPoint = 2 on workstations. Rerun the spoolss pipe check from Step 1; only print servers should answer.

For monitoring, enable the Microsoft-Windows-PrintService/Operational log, which is off by default (wevtutil sl Microsoft-Windows-PrintService/Operational /e:true), and collect PrintService/Admin event 808 (the spooler failed to load a plug-in module), a known indicator of exploitation attempts. Driver installations on machines where users do not add printers deserve a look.

Checklist

• Spooler disabled on domain controllers and Tier 0 servers
• Spooler disabled on other servers that do not print or serve printers
• Workstations do not accept remote print connections (RegisterSpoolerRemoteRpcEndPoint = 2)
• RestrictDriverInstallationToAdministrators = 1 enforced by GPO; no GPO sets it to 0
• Point and Print limited to approved servers, with warning and elevation prompts
• Package Point and Print only, with the approved server list
• Queue-specific files limited to color profiles; Redirection Guard on
• Windows protected print mode evaluated for Windows 11 24H2+ fleets
• PrintService logs enabled and event 808 collected

Disabling the spooler on DCs also removes one of the easiest coercion paths into Tier 0. Combine it with SMB signing and NTLM restrictions and firewall rules that block workstation-to-workstation RPC.