Glossary
Point and Print
A Windows printing feature that lets users connect to a shared printer and automatically download its driver from the print server.
Point and Print lets a user connect to a network printer and have Windows download and install the printer driver from the print server automatically, without an administrator. Because printer drivers run with high privileges, this has repeatedly been a path to privilege escalation and remote code execution. The PrintNightmare vulnerabilities in 2021 (CVE-2021-34527 and related) abused the Print Spooler and Point and Print to load attacker-controlled drivers. Microsoft responded by making RestrictDriverInstallationToAdministrators default to 1, so only administrators can install drivers, and by recommending package Point and Print with approved servers.
Keep RestrictDriverInstallationToAdministrators set to 1, and do not set "Point and Print Restrictions" to suppress warnings and elevation prompts, which reopens the hole. Use "Package Point and print - Approved servers" to limit the servers clients trust. Most important, disable the Print Spooler service where printing is not needed, especially on domain controllers, where it also enables coerced authentication attacks.