PrintNightmare: switch off the Print Spooler

Last week a proof-of-concept for a Windows Print Spooler bug was published by mistake, and Microsoft confirmed it as CVE-2021-34527, PrintNightmare. It lets an attacker with a normal account run code as SYSTEM. On a domain controller, that’s the whole domain. Microsoft has started releasing emergency updates.

What to do:

1. Install the out-of-band update as it arrives for your Windows versions.
2. Disable the Print Spooler service on servers that don’t print, starting with domain controllers. Most of them never needed it.
3. Where you must keep it, block inbound remote printing by Group Policy.
4. Check the Point and Print settings Microsoft lists; some configurations stay vulnerable even after updating.

The bigger lesson: Windows runs many services by default. On servers, turn off what the server’s job doesn’t need.