How To Mitigate The Print Spooler Vulnerability – PringNightmare CVE-2021-34527

Initially, Microsoft has set the criticality of the print spooler vulnerability (also known as ‘PrintNightmare’), to ‘low’, later it was upgraded to ‘critical’ this week after the Proof of Concept was published on GitHub. In response to that, Microsoft released a patch in June 2021. Unfortunately, the patch didn’t provide protection against the vulnerability. Attackers could still exploit the vulnerability after installing the patch too. We are going to cover most of the things you need to know about the print spooler vulnerability, including how to mitigate the print spooler vulnerability (PringNightmare CVE-2021-34527) in the article.

What Is Print Spooler Service?

Print spooler is a Microsoft Windows service used to manage and monitor files printing. This service is one of the oldest services, which could be found on pretty much all the versions of Microsoft Windows. This service is enabled by default on all the Microsoft servers and endpoints machines.

What Is Print Spooler Vulnerability Or PrintNightmare Vulnerability?

According to Microsoft, ” This is a remote code execution vulnerability that exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

This vulnerability allows an attacker to connect the print spooler service directly or remotely if he has limited access to the network. The attacker can get access to the operating system through the print spooler service since the Print Spooler has direct access to the kernel of the operating system. By exploiting the PrintNightmare vulnerability, the attackers can run remote code with SYSTEM privileges and ultimately attack the Domain Controller.

The print spooler vulnerability or PrintNightmare vulnerability is tracked under the CVE-2021-34527 ID. 

Summary Of CVE-2021-34527:

How To Mitigate The Print Spooler Vulnerability Or PrintNightmare Vulnerability?

The print spooler vulnerability is considered very important for two main reasons: the vulnerability is considered critical. It affects all versions of Windows, including servers & workstations. It is highly important to mitigate this flaw. Let’s see how to mitigate the print spooler vulnerability in this section.

Install The Patches For Print Spooler Vulnerability Or PrintNightmare Vulnerability:

On July 7th, Microsoft has rolled out a patch for all the client and server operating systems. Microsoft recommends installing the patch on all the machines.

Windows Server 2012 R2
Monthly Rollup
Security Only

Windows Server 2012
Monthly Rollup
Security Only

Windows Server 2016
Monthly Rollup

Windows Server 2019
Monthly Rollup

Windows 10 (Different versions)
Monthly Rollup (Locate the respective version in the link to download and apply)

The best option to mitigate the print spooler vulnerability is to disable the print spooler service on the server and/or workstation on which the service is barely used. You can disable the service in two ways: PowerShell & Services App.

Registry Settings To Mitigate The Print Spooler Vulnerability Or PrintNightmare Vulnerability:

In order to secure your system, you must confirm that the following registry settings are set to 0 (zero) or are not defined (Note: These registry keys do not exist by default, and therefore are already at the secure setting.)

The following registry keys are not present by default. Verify that the keys are not present or change the following registry values to 0 (zero):

Deploy using GPO Preferences to implement registry key additions

Registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
Value: NoWarningNoElevationOnInstall
Data type: REG_DWORD
Data: 0 or not defined (default setting)

Note: Having NoWarningNoElevationOnInstall set to 1 makes your system vulnerable by design.

Registry subkey: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
Value: NoWarningNoElevationOnUpdate
Data type: REG_DWORD
Data: 0 or not defined (default setting)

After installing these and later Windows updates

In addition, optionally configure the RestrictDriverInstallationToAdministrators registry value to prevent non-administrators from installing printer drivers on a print server.

Registry subkey: HKEY_LOCAL_MACHINE \Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint
Value: RestrictDriverInstallationToAdministrators
Data type: REG_DWORD
Data: 0: or leaving the value undefined allows non-administrators to install signed drivers and allows administrators to install signed and unsigned printer drivers to a print server. This is the default value.