Windows 11 Printers: 18 Checks

Checks whether the authentication protocol for incoming print-spooler RPC connections is Negotiate or Kerberos.

This rule fails when forceKerberosForRpc is not NEGOTIATE or KERBEROS.

Rationale: Requiring Negotiate (or the stronger Kerberos) for incoming spooler RPC forces authenticated, more secure connections.

Impact: Print configurations still relying on the older named-pipes protocol may cease to function.

Checks whether incoming RPC connections to the print spooler are restricted to the TCP transport rather than named pipes.

This rule fails when rpcProtocols is not RPC_OVER_TCP.

Rationale: Restricting the spooler to TCP instead of named pipes is a more secure communication method for incoming RPC.

Impact: Print configurations still relying on the older named-pipes protocol may cease to function.

Checks whether the IPP TLS/SSL security policy blocks printers presenting a certificate from an unknown certificate authority.

This rule fails when securityFlagsBlockUnknownCA is not true.

Rationale: Validating the certificate authority helps prevent spoofed or unauthorized printers, reducing the risk of credential theft and redirected print jobs.

Impact: The system enforces certificate validation and blocks printing when certificate errors are detected.

Checks whether the IPP TLS/SSL security policy blocks printers presenting a certificate whose common name is invalid.

This rule fails when securityFlagsBlockCertCNInvalid is not true.

Rationale: Validating the certificate common name helps prevent spoofed or unauthorized printers, reducing the risk of credential theft and redirected print jobs.

Impact: The system enforces certificate validation and blocks printing when certificate errors are detected.

Checks whether the IPP TLS/SSL security policy blocks printers presenting a certificate with an invalid (expired or not-yet-valid) date.

This rule fails when securityFlagsBlockCertDateInvalid is not true.

Rationale: Validating the certificate date helps prevent spoofed or unauthorized printers, reducing the risk of credential theft and redirected print jobs.

Impact: The system enforces certificate validation and blocks printing when certificate errors are detected.

Checks whether the IPP TLS/SSL security policy blocks printers presenting a non-server certificate (wrong certificate usage).

This rule fails when securityFlagsBlockCertWrongUsage is not true.

Rationale: Rejecting certificates issued for the wrong usage helps prevent spoofed or unauthorized printers, reducing the risk of credential theft and redirected print jobs.

Impact: The system enforces certificate validation and blocks printing when certificate errors are detected.

Checks whether communication with IPP Class Driver printers must use IPPS (IPP over TLS).

This rule fails when requireIPPs is not true.

Rationale: IPPS uses TLS to encrypt all client-to-printer communication, preventing interception or tampering of print data.

Impact: IPP printers using self-signed or locally issued certificates may not work, and installing non-compliant IPP printers will fail with an Application-log event.

Checks whether outgoing RPC connections to a remote print spooler use the Default authentication behavior.

This rule fails when rpcAuthentication is not DEFAULT.

Rationale: The Default behavior applies appropriate RPC authentication and, together with RPC over TCP, provides more secure spooler communication.

Impact: Print configurations still relying on the older named-pipes protocol may cease to function.

Checks whether outgoing RPC connections to a remote print spooler use TCP rather than named pipes.

This rule fails when rpcUseNamedPipeProtocol is not RPC_OVER_TCP.

Rationale: Forcing TCP instead of named pipes for spooler RPC is a more secure communication method.

Impact: Print configurations still relying on the older named-pipes protocol may cease to function.

Checks whether Point and Print shows a warning and a UAC elevation prompt before installing a driver for a new printer connection.

This rule fails when noWarningNoElevationOnInstall is not WARN_AND_ELEVATE_ON_INSTALL.

Rationale: Requiring UAC elevation for new print-driver installation helps mitigate the PrintNightmare vulnerability (CVE-2021-34527) and other Print Spooler attacks, serving as a backstop if the default behavior is ever reversed.

Impact: None; this is the default behavior.

Checks whether Point and Print shows a warning and a UAC elevation prompt before updating a driver for an existing printer connection.

This rule fails when updatePromptSettings is not WARN_AND_ELEVATE_ON_UPDATE.

Rationale: Requiring UAC elevation for print-driver updates helps mitigate the PrintNightmare vulnerability (CVE-2021-34527) and other Print Spooler attacks, serving as a backstop if the default behavior is ever reversed.

Impact: None; this is the default behavior.

Checks whether only Administrators can install print drivers on the host.

This rule fails when restrictDriverInstallationToAdministrators is not true.

Rationale: Restricting print-driver installation to Administrators mitigates the PrintNightmare vulnerability (CVE-2021-34527) and other Print Spooler attacks.

Impact: None; this is the default behavior.

Checks whether the Print Spooler service is prevented from accepting remote client connections.

This rule fails when registerSpoolerRemoteRpcEndPoint is not false.

Rationale: Blocking remote client connections to the spooler mitigates the PrintNightmare vulnerability (CVE-2021-34527) and other remote Print Spooler attacks.

Impact: Users can still print locally, but the host will not accept client connections or share printers; already-shared printers remain shared.

Checks whether Redirection Guard is enabled for the print spooler so file redirections cannot be followed within the spooler process.

This rule fails when redirectionguardPolicy is not ENABLED.

Rationale: Redirection Guard prevents non-administrators from redirecting files within the spooler process, closing a print-spooler privilege-escalation avenue.

Impact: None; this is the default behavior.

Checks whether print-spooler RPC over TCP uses a dynamic port (value 0) rather than a fixed port.

This rule fails when rpcTcpPort is not 0.

Rationale: Using a dynamic port makes it harder for an attacker to know which port the spooler is listening on and therefore which port to attack.

Impact: Environments configured for a specific TCP print port may need a firewall change to keep printing.

Checks whether queue-specific files downloaded during printer installation are limited to the standard color-profile scheme.

This rule fails when copyFilesPolicy is not ICM_ONLY.

Rationale: Restricting which queue-specific files the spooler processes mitigates a Print Spooler remote code execution vulnerability (CVE-2021-36958).

Impact: None; this is the default behavior.

Checks whether packet-level privacy is enforced for incoming print-spooler RPC connections.

This rule fails when rpcAuthnLevelPrivacyEnabled is not true.

Rationale: Enforcing packet-level privacy raises the server-side authentication level and mitigates the Print Spooler spoofing vulnerability CVE-2021-1678.

Impact: None; this is the default behavior.

Checks whether Windows protected print mode (modern print platform, Mopria-certified drivers only) is enabled.

This rule fails when windowsProtectedPrintGroupPolicyState is not true.

Rationale: Windows protected print hardens the entire print stack and, per Microsoft, mitigates over half of past reported Windows print security issues.

Impact: Printers that do not support Mopria cannot be used, and only Mopria-certified drivers are deployed via Windows Update.