GPO policy: "Configure Redirection Guard" under Computer Configuration > Administrative Templates
Printers. Determines whether Redirection Guard is enabled for the print spooler process, which prevents file-redirect attacks against the spooler (e.g. symlink/junction abuse via CopyFiles). Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers:RedirectionguardPolicy (REG_DWORD). Default when policy is unconfigured is Enabled (value 1). Reference: Printer driver security guidance
Values
| Enum Value | Description |
|---|---|
|
|
Redirection Guard disabled (registry value 0). File redirections may be followed by the spooler process. Less secure; not recommended. |
|
|
Redirection Guard enabled (registry value 1, default). Prevents any file redirections from being followed within the spooler process. |
|
|
Audit-only mode (registry value 2). Redirection Guard logs events as though enforced but does not actually block file redirections. Use to assess impact before enforcing. |
Used by
ComputerAdministrativeTemplatestype: Computer-specific Administrative Templates (ADMX) settings on an Endpoint.
Example
Example
"DISABLED"