Printer and Print Server Security Guide: Hardening an Overlooked Attack Surface

Printing is one of the least governed services in most estates, yet the Windows Print Spooler runs as SYSTEM on almost every Windows host and network printers hold credentials, stored documents and a web management console. PrintNightmare in 2021 showed that a default-on service nobody thought about could hand any authenticated user SYSTEM on a domain controller, and later spooler flaws were used by ransomware crews and by a state actor. This guide covers both halves of the problem: the Windows print stack (spooler, Point and Print, print servers, coercion) and the devices themselves (multifunction printers, their management plane and the service accounts behind scan-to-email and scan-to-folder). It is written for Windows and infrastructure engineers, endpoint teams and security architects who own, or have just discovered they own, the print estate.

Key takeaways

• Disable the spooler wherever nobody prints. Domain controllers and most servers do not need it; CISA ordered it stopped and disabled on federal domain controllers in 2021 and Microsoft still recommends the same.
• Point and Print is the driver trust decision. Restrict driver installation to administrators and never leave the "no warning, no elevation" settings in place, or the PrintNightmare fix does not protect you.
• The spooler is also a coercion primitive. Any authenticated user can make a host with the spooler running authenticate to another machine, which exposes its computer account credential to relay and delegation abuse.
• Multifunction printers are networked computers. They run firmware, store images on disk and expose web, SNMP, FTP and SMB services; harden and patch them like servers, not peripherals.
• Scan-to-email and scan-to-folder accounts are non-human identities. They are often shared, never rotated and over-privileged; inventory, scope and rotate them like any other service account.

Why print is an attack surface

Print risk sits in two planes that are usually owned by different teams.

• The Windows print stack: the Print Spooler service (spoolsv.exe) runs as SYSTEM, loads printer drivers and print processors, and listens for remote procedure calls. It is enabled by default on Windows clients and servers, including domain controllers, unless someone disables it.
• Print servers: central Windows servers that share queues and distribute drivers to clients through Point and Print. They need the spooler, so they must be hardened rather than switched off, and they are a natural driver distribution point for an attacker.
• The devices: multifunction printers (MFPs) and network printers with their own operating system, web console, address book, LDAP or SMTP credentials and often a hard disk holding scanned and printed images. The Common Criteria collaborative Protection Profile for Hardcopy Devices lists the threats as unauthorised access to document and job data, unauthorised access to configuration data, unauthorised firmware installation, network attacks such as eavesdropping and replay, and weak cryptography.
• The identities: service accounts for scan-to-folder (SMB), scan-to-email (SMTP), address book lookup (LDAP) and print management software, plus local administrator accounts on each device.

The Windows Print Spooler: what the exploited flaws teach

CISA's Known Exploited Vulnerabilities (KEV) catalog lists several Print Spooler flaws. They share one root cause: a SYSTEM service that loads code or files on behalf of ordinary users.

CERT/CC's note on PrintNightmare (VU#383432) explains the mechanism at a defensive level: the spooler did not restrict who could add printers and drivers, so an authenticated user calling RpcAddPrinterDriverEx() with a driver on a remote share caused spoolsv.exe to load an arbitrary DLL as SYSTEM, remotely or locally. CERT/CC also notes that the CVE-2021-34527 update does not prevent exploitation where the Point and Print value NoWarningNoElevationOnInstall is set to a non-zero value, which Microsoft treats as vulnerable by design. Microsoft's GooseEgg analysis describes a different route: a modified JavaScript constraints file that the spooler loads and runs with SYSTEM permissions.

The practical lessons: treat every spooler CVE as a priority on servers and privileged hosts, verify configuration as well as patch status, and remove the service where there is no business need. See the Zero-Day and Exploited Vulnerabilities Guide and the Patch Management Guide.

Hardening the spooler and Point and Print

Where the spooler should run

Stopping the service is not enough: CISA notes it restarts at reboot unless the startup type is set to Disabled. Use Group Policy (System Services, Print Spooler, Disabled), Intune or configuration management so the state is enforced and reported, not a one-off command.

Point and Print and driver installation settings

The settings below live under Computer Configuration, Administrative Templates, Printers, and the policy registry key HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint.

Restricting driver installation moves driver deployment to administrators. Plan for it: package approved drivers, publish queues through the print server or a print management tool, and deploy drivers with software distribution rather than letting users pull them from shares.

Windows protected print mode

On current Windows 11 builds, Windows protected print mode (WPP) prints only through the inbox Windows Ready Print stack, which Microsoft describes as designed for Mopria certified printers. Enabling it uninstalls printers that use third-party drivers, removes XPS and fax, and blocks installation of non-compatible printers. Where the fleet is Mopria certified, WPP removes the third-party driver loading that most spooler attacks depend on. Pilot it per site: some scanners lose function and specialist printers may have no compatible path. When WPP is enforced by Group Policy, users cannot turn it off.

Authentication coercion and print pruning

Separately from code execution bugs, the spooler's remote notification interface can be abused for forced authentication (MITRE ATT&CK T1187). Microsoft's Defender for Identity assessment "Disable Print spooler service on domain controllers" explains that any authenticated user can connect to a domain controller's spooler, ask for notifications on print jobs and direct the notification to a system of their choice, including one with unconstrained delegation, which exposes the domain controller's computer account credential. The technique is widely known as PrinterBug. Combined with NTLM relay (T1557.001) or unconstrained delegation, it can lead to domain compromise without any spooler CVE.

• Remove the trigger: disable the spooler on DCs and Tier 0 servers; Microsoft notes any server is potentially at risk.
• Remove the payoff: eliminate unconstrained delegation, enforce SMB signing and LDAP signing and channel binding, and reduce NTLM. See the Kerberos Delegation Security Guide and the Active Directory and Entra ID Hardening Guide.
• Handle print pruning: the DC role adds a spooler thread that prunes stale printer objects published in Active Directory. Microsoft describes disabling the spooler on DCs as a trade-off and suggests pruning stale print queue objects periodically instead, for example with a scheduled, reviewed script run from a management server.

Print processors are also a persistence location: ATT&CK T1547.012 (Print Processors) describes adversaries registering a malicious print processor DLL that the spooler loads at start. Monitor the print processor registry locations and the spool drivers directory.

Hardening network printers and multifunction devices

Treat each device as a small server with a management plane. The table lists common services; disable what the site does not use and restrict the rest to print servers and management hosts.

• Change default credentials: device administrator passwords and SNMP community strings, unique per device and stored in a vault. See the Local Administrator Password Solution (LAPS) Guide for the same principle on Windows.
• Patch firmware: subscribe to vendor advisories, apply firmware through change control, and enable verified (signed) firmware update where available; the HCD protection profile treats unauthorised firmware installation as a core threat.
• Protect stored data: turn on storage encryption and image overwrite so spooled, scanned and temporary data is wiped between jobs; require authentication for stored mailboxes and secure release.
• Segment: place printers on a printer VLAN, allow inbound only from print servers and management hosts, and block printer-initiated traffic to the internet except named vendor or cloud print endpoints. See the IoT Security Guide.
• Dispose of disks: sanitise or destroy device storage at end of lease or life (NIST SP 800-53 MP-6), and write this into lease return contracts.
• Buy assured devices: where procurement allows, prefer devices evaluated against the collaborative Protection Profile for Hardcopy Devices, which covers identification and authentication, audit, trusted communications, storage encryption, image overwrite and trusted update.

Where identity fits: printer-bound service accounts and scan credentials

Every MFP integration uses a credential that nobody logs in with, which makes it a non-human identity. These are among the most neglected NHIs in an estate because they are typed into a device web console once and forgotten.

For scan to email in Microsoft 365, Microsoft documents three options: client SMTP submission (smtp.office365.com, port 587, TLS 1.2 or 1.3, a licensed mailbox, with basic authentication scheduled for deprecation and OAuth recommended), SMTP relay through an inbound connector (authenticated by a certificate matching an accepted domain, or a static public IP), and Direct Send (anonymous, to internal recipients only, which Microsoft says most customers do not need). A device credential that can send as any user is a phishing asset; scope it. See the Service Account Security Guide, the Group Managed Service Accounts (gMSA) Guide and the NHI Authentication Guide.

Detection and measurement

The PrintService Operational log is disabled by default on many builds; enable it centrally. See the Windows Event Log Guide.

Metrics that show the programme is working:

• Percentage of domain controllers and Tier 0 servers with the spooler disabled (target 100 per cent, verified by configuration reporting, not policy assignment).
• Percentage of Windows hosts with RestrictDriverInstallationToAdministrators = 1 and no non-zero NoWarningNoElevationOnInstall.
• Median days to deploy spooler security updates to print servers, and to apply MFP firmware updates.
• Percentage of printers with default credentials changed, Telnet and FTP disabled and SNMPv1/v2c write disabled.
• Number of printer service accounts with an owner, an inventory entry and a rotation date inside policy.
• Count of driver installation events (316) outside approved change windows.

Rolling it out

1. Inventory: list hosts with the spooler running by role, print servers, queues, drivers, devices (model, firmware, services enabled) and every credential configured on a device. See the Asset Inventory and CMDB Security Guide.
2. Quick wins first: disable the spooler on domain controllers and Tier 0 servers, with a periodic print pruning task to compensate; patch print servers.
3. Point and Print in a pilot ring: apply RestrictDriverInstallationToAdministrators and inbound client connection blocking to IT, then a business pilot, while pre-deploying approved drivers. Watch help desk tickets and Event ID 316.
4. Servers: disable the spooler on member servers without a named print dependency; record exceptions with an owner.
5. Devices: move printers to a printer VLAN, restrict management to admin hosts, change defaults, turn off unused services and update firmware, one site at a time.
6. Credentials: replace shared scan accounts with scoped ones, move scan to email off basic authentication, vault and rotate.
7. Rollback: every change is a policy or service setting; keep the previous GPO version, re-enable the spooler on a single host through an exception group if a workflow breaks, and log the exception rather than reverting the baseline.

Small versus large organisations: a small office with direct IP printing and no print server can disable inbound spooler connections everywhere, use vendor driverless printing and focus on device defaults and scan credentials. A large enterprise usually needs dedicated print servers or a print management platform, which concentrates risk: those servers then deserve server-tier hardening, fast patching and restricted administration.

Framework mapping

Common failure patterns

• Patched but still vulnerable: the PrintNightmare update installed while NoWarningNoElevationOnInstall stays at 1 from an old convenience GPO, which CERT/CC says leaves the host exploitable.
• Spooler re-enabled by an image or a vendor installer: DCs rebuilt from a template, or an application install that turns the service back on, with nobody alerting on the service state change.
• Disabling the spooler on DCs without pruning: stale printer objects accumulate in AD and someone re-enables the spooler to fix it.
• The all-powerful scan account: a scan-to-folder account in Domain Admins or with write access to every share, its password visible to anyone with device admin access, unchanged for years.
• Printers on the user VLAN with factory settings: default admin password, Telnet, FTP and SNMP write enabled, firmware years old.
• Leased devices returned with disks intact: scanned contracts, HR forms and address books leave with the hardware.

Practitioner checklist

• Stop and disable the Print Spooler on all domain controllers and Tier 0 servers, and schedule print pruning instead.
• Disable the spooler on every server without a documented print requirement, enforced by policy and reported.
• Set RestrictDriverInstallationToAdministrators to 1 and remove any non-zero NoWarningNoElevationOnInstall or UpdatePromptSettings values.
• Disable "Allow Print Spooler to accept client connections" on everything that is not a print server.
• Treat print servers as hardened infrastructure: single role, restricted admins, patched first.
• Remove unconstrained delegation and enforce SMB and LDAP signing to blunt spooler coercion.
• Put printers on a dedicated VLAN; HTTPS, IPPS and SNMPv3 only; Telnet, FTP and LPD off; defaults changed; firmware current.
• Inventory every printer credential, give each an owner, scope it to least privilege, vault it and rotate it.
• Enable the PrintService Operational log and alert on Event IDs 316 and 808 and on spooler child processes.
• Write disk sanitisation into printer lease and disposal processes.

Standards and references

• CISA: Emergency Directive 21-04, Mitigate Windows Print Spooler Service Vulnerability
• CERT/CC: VU#383432 Microsoft Windows Print Spooler allows for RCE via AddPrinterDriverEx()
• Microsoft Learn: Security assessment, Disable Print spooler service on domain controllers
• Microsoft Security: Analyzing Forest Blizzard's custom post-compromise tool for exploiting CVE-2022-38028
• Microsoft Learn: Windows protected print mode
• Microsoft Learn: How to set up a multifunction device or application to send email using Microsoft 365
• Common Criteria: collaborative Protection Profile for Hardcopy Devices
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Windows Endpoint Hardening Guide · Lateral Movement Guide · Service Account Security Guide · Endpoint Security Guide