Printer and Print Spooler Security Guide: Print Spooler, Drivers and Printer Hardening

Most print spooler hardening stops at "disable it on domain controllers and restrict driver installs", while the spooler keeps loading third-party code, following file paths and accepting RPC calls on every host that still prints. Since PrintNightmare, Microsoft has added a series of lesser-known controls: driver signature validation levels, a block on queue-specific files, Redirection Guard, RPC over TCP with Kerberos enforcement, IPPS requirements and Windows protected print mode. Linux and macOS have their own exposure through CUPS and cups-browsed. This guide is the engineering companion to the Printer and Print Server Security Guide, which covers where to disable the spooler, multifunction device hardening and scan credentials; here we go deeper into the print stack itself, the driver supply chain and the settings that lock it down. It is written for Windows and Linux platform engineers, endpoint and Intune administrators and detection engineers.

Key takeaways

• The driver is the attack surface. Almost every spooler compromise ends with the SYSTEM-level spooler loading a DLL, a file or a script it should not have; control which drivers can load and where their files come from.
• RestrictDriverInstallationToAdministrators = 1 is the one setting with no substitute. Microsoft states that no combination of other mitigations is equivalent to it, so treat any host with 0 as vulnerable.
• Windows 11 22H2 and later give you new levers. Driver validation levels, the CopyFiles policy, Redirection Guard and RPC listener settings are off the default radar but close whole classes of spooler bugs.
• Print RPC should be TCP with Kerberos where possible. Named pipes over SMB are disabled by default on current Windows 11 and Microsoft does not recommend them; reverting for compatibility weakens the server.
• CUPS needs the same scrutiny. cups-browsed listening on UDP 631 was the entry point for the 2024 CUPS remote execution chain; disable printer discovery services you do not need on Linux servers and desktops.

How the print stack loads code

Understanding where code enters the spooler explains why the controls below exist. On Windows, the Print Spooler service (spoolsv.exe) runs as SYSTEM and acts for users who submit jobs, add printers or connect to shared queues.

• Printer drivers: render and configuration DLLs copied into the spool drivers directory and loaded by the spooler or by the printing application. With Point and Print, a client downloads them from a print server when a user connects to a shared queue.
• Print processors and port monitors: additional DLLs the spooler loads at start. ATT&CK tracks malicious print processors as T1547.012, a persistence and privilege escalation technique.
• Queue-specific files: vendor installers can attach extra files (colour profiles, plug-ins) to a queue, which the client copies when it connects.
• Configuration and constraint files: data files such as JavaScript constraint files used by some driver models, which the spooler parses with high privilege. CVE-2022-38028, a spooler privilege escalation in the CISA KEV catalog, was exploited through this kind of file.
• Remote procedure calls: clients and servers talk through the MS-RPRN and IRemoteWinspool RPC interfaces. These are the channel for remote driver installation (the PrintNightmare route, CVE-2021-34527) and for forced authentication (T1187) against hosts running the spooler.

On Linux and macOS the equivalent stack is CUPS: the cupsd scheduler, filters and backends that convert and send jobs, PPD files or driverless IPP Everywhere queues, and optionally cups-browsed, which discovers remote printers and creates local queues for them.

Which control blocks which class of spooler attack

The relay half of coercion is covered in the NTLM Relay Guide and the SMB Signing Guide.

Driver trust and installation controls

Restrict driver installation to administrators

Microsoft's KB5005652 sets the default of RestrictDriverInstallationToAdministrators (DWORD under HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint) to 1 for updates released on or after 10 August 2021, and that default applies when the value is absent. The Group Policy equivalent is "Limits print driver installation to Administrators" under Computer Configuration, Administrative Templates, Printers. A value of 1 overrides the Point and Print Restrictions settings. Microsoft warns that 0 makes devices vulnerable, should only be used temporarily, and that no combination of other mitigations is equivalent to 1. The practical risk is not the default but the exception: help desk scripts and old GPOs that set 0 to stop driver prompts. Report the effective value, not the GPO assignment.

Approved print servers

The Point and Print Restrictions policy (PointAndPrintRestrictions in the Printers CSP) limits clients to downloading driver components from an explicit list of servers. List your print servers by fully qualified name so that a user cannot be lured into connecting to an attacker-controlled share that offers a driver.

Driver signature validation level

On Windows 11 22H2 and later, ConfigureDriverValidationLevel controls which signatures a print driver must carry before the spooler accepts it. The default (4) accepts any validly signed driver, which includes drivers signed by any publisher with a code signing certificate.

Queue-specific files

ConfigureCopyFilesPolicy (Windows 11 22H2 and later) governs the extra files a vendor installer can attach to a queue. The default (1) allows only standard colour profiles handled by mscms.dll; 0 allows none; 2 allows all. Keep 1 unless a named printer model fails without its files, and never set 2 fleet-wide.

Windows protected print mode

On Windows 11 24H2 and later, ConfigureWindowsProtectedPrint enables Windows protected print mode, which allows only printers that work with a subset of inbox drivers. Where the printer fleet supports driverless printing, it removes third-party driver loading altogether and makes the validation level largely moot. Pilot it by site, because specialist printers and some scanning features may stop working.

Spooler file and RPC hardening

Redirection Guard

Many spooler escalation bugs abused the service following a junction or symbolic link to write somewhere a user could not. ConfigureRedirectionGuardPolicy (Windows 11 22H2 and later) stops the spooler following file redirections. It is enabled by default (1); 2 is audit mode, which logs what would have been blocked; 0 disables it. If a vendor print solution breaks, use audit mode to identify the cause and fix the solution rather than turning protection off.

RPC transport and authentication

From Windows 11 22H2, print clients connect to servers using RPC over TCP by default, RPC over named pipes is disabled though still available, and the spooler listens for incoming connections on RPC over TCP only, using a dynamic port. Microsoft's settings (registry values under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\RPC):

Microsoft notes that print RPC needs the endpoint mapper (TCP 135) plus either the ephemeral range or the fixed port, and describes named pipes as not recommended. Separately, KB4599464 raised the authentication level of the IRemoteWinspool interface for CVE-2021-1678: RpcAuthnLevelPrivacyEnabled (under HKLM\SYSTEM\CurrentControlSet\Control\Print) defaults to enforcement on updates from 14 September 2021, and Microsoft describes 0 as leaving devices unprotected. Microsoft's named pipe compatibility steps ask for it to be set to 0, which is a further reason to avoid named pipes.

Encrypted printing to devices

Driverless printing uses IPP on TCP 631. The Printers CSP includes RequireIppsPolicy, which allows only printers that support IPPS (IPP over TLS) to be installed, and ConfigureIppTlsCertificatePolicy, which turns on certificate checking for the IPP class driver; by default certificate errors are ignored, so self-signed device certificates are accepted. Both were listed for Windows Insider builds at the time of writing; check availability on your build, and plan device certificates from an internal CA before enforcing validation.

CUPS on Linux and macOS

CUPS is installed on most Linux desktops, many servers and every Mac. In September 2024 OpenPrinting published advisory GHSA-rj88-6mr5-rcw8 for cups-browsed (CVE-2024-47176): the service bound to all interfaces on UDP 631, accepted datagrams from any source, and a chain of input validation flaws in cups-browsed and related libraries let an unauthenticated remote party add a malicious printer whose definition could run commands when a job was printed. The advisory's mitigations were to stop and disable cups-browsed where not needed, turn off legacy browsing, and block inbound UDP 631.

Distribution defaults differ from upstream, so audit the effective file. On servers with no print need, remove CUPS packages entirely rather than tuning them. See the Linux Server Hardening Guide and the macOS Security Guide for Enterprises.

Print architecture choices

The biggest security decision is how much of the Windows driver model you keep.

Small organisations usually do best with driverless printing and no print server. Large organisations often keep print servers for secure release and cost accounting; give them single-role builds, restricted administration, the RPC and driver settings above, and patch them first after every spooler update.

Where identity fits

Print infrastructure runs on non-human identities: print server computer accounts, print management service accounts, cloud print connector registrations and the device credentials used for scanning. Spooler coercion turns a print server's machine account into a relay target, so print servers belong outside unconstrained delegation and inside your tiering model. Give print management services a gMSA where supported, and treat cloud print connector hosts as identity-bearing infrastructure. See the Service Account Security Guide and the Kerberos Delegation Security Guide.

Rolling out the hardening

1. Baseline the estate: report the effective values of every setting in this guide per host, the installed print drivers and their signers, print processors and port monitors, and CUPS services on Linux and macOS.
2. Fix the dangerous exceptions: remove any RestrictDriverInstallationToAdministrators = 0 and named pipe or privacy-level reversions; these are the settings attackers rely on.
3. Audit first: set Redirection Guard to audit mode (2) only where you suspect breakage, and inventory driver signers before lowering the validation level.
4. Pilot ring: apply approved servers, validation level 2 or lower, CopyFiles 1 and RPC over TCP with Kerberos to IT and one business unit; watch help desk tickets and print failures for two weeks.
5. Broad deployment: roll out by site through Group Policy or Intune, with a fixed print RPC port and matching firewall rules on print servers.
6. Linux and macOS: disable cups-browsed and remote browsing, bind cupsd to localhost on non-print hosts, and block inbound UDP 631 at host firewalls.
7. Move towards driverless: pilot Windows protected print mode where printers support it, and retire vendor drivers model by model.

Rollback: every step is a policy setting. Keep the previous GPO or Intune profile version, use an exception group for named hosts or printers, and record each exception with an owner and expiry instead of relaxing the baseline.

Detection and measurement

Configuration-based detection and the PrintService log are covered in the Windows Event Log Guide. Metrics that show the programme is working:

• Percentage of Windows hosts with an effective RestrictDriverInstallationToAdministrators of 1 (target 100 per cent).
• Percentage of hosts at driver validation level 3 or lower, and number of distinct third-party driver signers in the estate (falling).
• Percentage of print servers enforcing RPC over TCP only with Kerberos and a fixed port.
• Percentage of Linux and macOS hosts with cups-browsed disabled or not installed where no print need exists.
• Median days from a spooler security update to deployment on all print servers.
• Number of open print hardening exceptions past their expiry date.

Framework mapping

Common failure patterns

• The convenience GPO that never died: a 2019-era policy that suppresses Point and Print prompts or sets driver installation to 0, still linked high in the domain and silently undoing the PrintNightmare fixes.
• Named pipes switched back on for one old server: a compatibility fix applied fleet-wide, along with RpcAuthnLevelPrivacyEnabled = 0, which re-exposes the IRemoteWinspool weakness everywhere.
• Driver validation left at "any signed": any driver signed with any code signing certificate loads as SYSTEM, which turns a stolen or cheaply obtained certificate into a spooler exploit path.
• Redirection Guard disabled to fix a vendor product: instead of audit mode and a vendor fix, protection is turned off for all hosts.
• CUPS forgotten on servers: Linux server images ship with CUPS and cups-browsed although nothing prints, leaving UDP 631 open on internal or even internet-facing hosts.
• Print servers treated as file servers: multi-role, broadly administered and patched last, while they distribute drivers to every client.

Practitioner checklist

• Report the effective RestrictDriverInstallationToAdministrators value on every Windows host and remove every 0.
• Enable Point and Print Restrictions with an explicit list of approved print servers.
• Lower ConfigureDriverValidationLevel from 4 to the strictest level your driver inventory allows.
• Keep ConfigureCopyFilesPolicy at 1 or 0 and Redirection Guard enabled; use audit mode only to diagnose.
• Use RPC over TCP only on print servers, enforce Kerberos where clients are domain joined, and fix the RPC port for firewalling.
• Keep RpcAuthnLevelPrivacyEnabled at its enforced default and avoid named pipe compatibility settings.
• Plan IPPS and device certificates so IPP certificate validation can be enforced.
• Disable cups-browsed and remote browsing, bind cupsd to localhost and block UDP 631 on Linux and macOS hosts that do not share printers.
• Pilot Windows protected print mode and driverless printing to retire third-party drivers.
• Alert on changes to print policy registry keys and on new drivers, print processors and port monitors.

Standards and references

• Microsoft Support: KB5005652 Manage new Point and Print default driver installation behavior (CVE-2021-34481)
• Microsoft Learn: Printers Policy CSP
• Microsoft Learn: RPC connection updates for print in Windows 11
• Microsoft Support: Managing deployment of printer RPC binding changes for CVE-2021-1678 (KB4599464)
• CISA: Emergency Directive 21-04, Mitigate Windows Print Spooler Service Vulnerability
• OpenPrinting: cups-browsed advisory GHSA-rj88-6mr5-rcw8 (CVE-2024-47176)
• OpenPrinting: cupsd.conf(5) manual
• CISA: Known Exploited Vulnerabilities Catalog

Related NHI Mgmt Group resources: Printer and Print Server Security Guide · Windows Endpoint Hardening Guide · Group Policy Security Guide · NTLM Relay Guide · Patch Management Guide