PrintNightmare — patch, then switch the print spooler off
The Print Spooler RCE/priv-esc that turned any domain user into SYSTEM. Patch, then disable the spooler on anything that never prints.
01 The Big PictureFor leadership · no jargon
Okay, so PrintNightmare — the one where the humble print queue briefly became the scariest thing on your network. This guide walks through what it actually was, how to check you're closed, and the tidy-up that should have happened years ago: switching the Print Spooler off on machines that never print.
Every Windows box runs the Print Spooler, a built-in background service that accepts documents and queues them for a printer — think of it as the office mailroom clerk. For convenience, that clerk also accepts new "printer drivers" delivered over the network, and it does its work holding the highest set of keys on the machine. PrintNightmare, disclosed in July 2021, let anyone with an ordinary employee login hand the clerk a booby-trapped package: a fake driver that was really attacker-controlled software. The clerk opened it with the master keys. Yikes.
In business terms, this turned the lowest-privilege account in the company — a phished laptop, a compromised contractor — into complete control of any Windows server. The worst case was the domain controller, the server holding the master list of every account and password in the organisation; it ran this print service by default. An attacker who reached it could steal every credential, lock the whole network with ransomware, and walk out with all of your customer data. This was not theoretical: working exploit code was public within days, ransomware groups adopted it, and the US government took the rare step of ordering federal agencies to patch immediately and shut the service down on domain controllers.
If your systems have received any Windows security update since July 2021, the hole itself is closed — the job now is to confirm that and apply the lasting lesson: the print service should not run on machines that never print. The work is a routine Windows update plus switching off one service on selected servers. Minutes per machine, no data loss, no downtime beyond a normal patch reboot. The only real trade-off is that a server where you disable the service can no longer print, which is why printing gets consolidated onto a small number of dedicated, hardened print servers.
02 Technical BreakdownFor engineers
Right, let's get into the nitty-gritty. The root cause sits in the Windows Print Spooler (spoolsv.exe) and its remote procedure call interface, RpcAddPrinterDriverEx (MS-RPRN/MS-PAR). Any authenticated user could ask the spooler to install a printer driver, and the service — running as SYSTEM — failed to properly validate the driver file path. An attacker could point the call at a malicious DLL on an attacker-controlled SMB share, or stage a payload into the spooler's driver directory; the spooler then obligingly copied and loaded that DLL inside its own process, executing it as SYSTEM.
The bug first surfaced as CVE-2021-1675 in June 2021, but the June 8 patch only closed the local privilege-escalation path. Researchers realised the remote vector was still open, a proof of concept was accidentally published on June 29, 2021 (oops), and Microsoft tracked the distinct remote code execution flaw as CVE-2021-34527, shipping out-of-band updates on July 6, 2021 (folded into the July 13 cumulative updates). Preconditions are minimal: one valid low-privilege domain credential and network reachability to the spooler over RPC/SMB (TCP 445). Domain controllers were the prime target because the spooler is enabled there by default, and SYSTEM on a DC means DCSync rights — the krbtgt hash and every credential in Active Directory. Not a great combination, as combinations go.
The fix works on two levels. The July 2021 updates hardened the driver-installation path so unprivileged users can no longer direct the spooler to load arbitrary driver files, and the August 10, 2021 updates went further: installing a driver via Point and Print now requires administrator elevation by default (enforced by the RestrictDriverInstallationToAdministrators value, CVE-2021-34481). Disabling the spooler removes the attack surface outright, which is the correct end state for any server that does not serve printers — domain controllers first.
03 Affected
Every Windows version supported at the time, with the Print Spooler service running: Windows 7 SP1 and Server 2008 SP2 through Windows 10 21H1 and Server 2022. Exploitation needs only a standard domain user account and network access to the target's spooler — no admin rights, no user interaction.
Domain controllers, certificate authorities, and other Tier-0 servers are the priority: they run the spooler by default and their compromise cascades to the entire domain. Any cumulative update from July 2021 or later remediates the CVE; the exposure that remains today is the spooler still running where it is not needed.
04 Detection
Before we change anything, let's see what we're dealing with. First, is the spooler even running?
Get-Service -Name Spooler | Select-Object Status,StartTypeIs the spooler running on your DCs? Any Tier-0 server showing Running is live exposure.
Get-WinEvent -LogName Microsoft-Windows-PrintService/Admin -MaxEvents 200 | Where-Object Id -eq 808Event 808 is the spooler failing to load a driver DLL — the fingerprint exploitation attempts leave behind.
Get-ChildItem 'C:\Windows\System32\spool\drivers\x64\3' -Recurse -Filter *.dll | Sort-Object LastWriteTime -Descending | Select-Object -First 10 FullName,LastWriteTimeRecently written DLLs in the driver store that you did not deploy are suspect; investigate before you clean.
Get-PrinterDriver | Select-Object Name,Manufacturer,DriverDateInventory installed drivers; an unfamiliar driver on a server that never prints is a red flag.
05 Remediation
01 Install the security update
Any cumulative update from July 2021 onward closes the remote code execution path; on a maintained estate this step is already done (go on, check — I'll wait). On legacy or frozen systems, apply the latest cumulative update through your normal rings.
Install-Module PSWindowsUpdate; Get-WindowsUpdate -Install -AcceptAllOr push via WSUS/SCCM rings.
02 Disable the spooler on DCs
A domain controller has no business printing, and stopping the service kills the attack surface outright — this is exactly what CISA's emergency directive ordered for DCs. Extend the same change to every server that does not serve printers, and consolidate printing onto dedicated, patched print servers.
Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType DisabledDCs should not print.
03 Restrict Point and Print driver installs to admins
The August 2021 updates made administrator elevation the default for driver installation; set it explicitly so a stale baseline or policy drift cannot reopen the door on machines where the spooler must stay on.
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name RestrictDriverInstallationToAdministrators -PropertyType DWORD -Value 1 -ForceForces driver installation to require administrator rights on this machine; takes effect without a restart.
06 Verification
Patched and disabled? Let's prove it rather than assume it.
Get-Service -Name Spooler | Select-Object Status,StartTypeOn DCs expect Status Stopped and StartType Disabled; only designated print servers should show Running.
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5 HotFixID,InstalledOnThe newest cumulative update must be July 2021 or later — anything from that month onward contains the fix.
(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Print').RpcAuthnLevelPrivacyEnabledConfirm RpcAuthnLevelPrivacyEnabled = 1 — the spooler RPC hardening from KB4599464; the value lives under CurrentControlSet\Control\Print, not CurrentVersion.
(Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint').RestrictDriverInstallationToAdministratorsExpect 1 after the Point and Print step above.
07 Rollback
The realistic rollback is re-enabling the spooler where printing was cut too aggressively — a server that turns out to have a real printing role (it happens). Patch first, then re-enable only where printing is genuinely required.
Set-Service -Name Spooler -StartupType Automatic; Start-Service SpoolerRe-enable only on print servers that need it.
Rolling back the security update itself is almost never justified — it reopens a known-exploited RCE. If a cumulative update breaks line-of-business printing, fix forward, or uninstall that specific KB while keeping the spooler disabled on Tier-0 servers.
wusa /uninstall /kb:5004945 /norestartExample: uninstall the July 2021 out-of-band update; substitute the KB you actually deployed.
08 References
- NVD — CVE-2021-34527
- Microsoft Security Update Guide — CVE-2021-34527
- Microsoft KB5005652 — Point and Print default driver installation behavior
- CISA Known Exploited Vulnerabilities catalog
If I've got anything wrong here, or you've hit an edge case I haven't covered, do say — corrections and questions are always welcome :)
Ship the fix. Prove it’s closed.
If this runbook doesn’t fit your stack, send the CVE — an operator writes a verified path, usually within a business day. Or contribute your own and get co-authored credit.