PrintNightmare: Print Spooler Remote Code Execution Vulnerability
Information about the PrintNightmare vulnerability affecting the Windows Print Spooler service, including mitigation options and available updates.
Important: PrintNightmare was a critical Windows Print Spooler vulnerability. This post was originally published on July 2, 2021. The emergency mitigations and update information below reflect the situation at that time. For current guidance, consult Microsoft’s security documentation and verify that all supported systems are fully patched.
Microsoft published information about a remote code execution vulnerability affecting the Windows Print Spooler service and assigned it CVE-2021-34527. The vulnerability became known as PrintNightmare.
The vulnerability existed because the Windows Print Spooler service improperly performed privileged file operations. An attacker who successfully exploited it could execute arbitrary code with SYSTEM privileges.
An attacker could then:
- Install programs.
- View, change, or delete data.
- Create new accounts with full user rights.
At the time of publication, patches were not yet available for all affected Windows versions. Microsoft therefore recommended disabling the Print Spooler service on Domain Controllers and systems that did not require printing.
Check the Print Spooler Service
Run the following PowerShell command with appropriate administrative privileges:
1
Get-Service -Name Spooler
If the Print Spooler service is running, or if its startup type is not set to Disabled, use one of the mitigation options below.
Option 1: Disable the Service
If disabling the Print Spooler service is appropriate for your environment, run:
1
Stop-Service -Name Spooler -Force
1
Set-Service -Name Spooler -StartupType Disabled
Impact: Disabling the Print Spooler service prevents printing both locally and remotely.
This option is particularly important for Domain Controllers and other systems that do not need to provide printing functionality.
Option 2: Restrict the Drivers Directory
If a print server must remain operational, you can apply an ACL restriction to the following directory:
1
C:\Windows\System32\spool\drivers
The following PowerShell script adds a Deny rule that prevents the SYSTEM account from modifying the directory and its subdirectories:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
$Path = "C:\Windows\System32\spool\drivers"
$Acl = (Get-Item $Path).GetAccessControl('Access')
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
"SYSTEM",
"Modify",
"ContainerInherit, ObjectInherit",
"None",
"Deny"
)
$Acl.AddAccessRule($AccessRule)
Set-Acl -Path $Path -AclObject $Acl
This workaround restricts modifications to the drivers directory and its subdirectories, making it more difficult for malicious DLLs to be introduced through the Print Spooler service.
The script was originally published by Fabian from TrueSec.
Warning: This ACL workaround is not a replacement for installing Microsoft’s security updates. Test it carefully because it may interfere with printer-driver installation, updates, or print jobs.
If an administrator needs to make configuration changes that require the Print Spooler service to write to the directory, the deny rule can be temporarily removed and then added again after the change.
Remove the Added ACL Rule
Use the following commands to remove the rule added by the previous script:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
$Path = "C:\Windows\System32\spool\drivers"
$Acl = (Get-Item $Path).GetAccessControl('Access')
$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
"SYSTEM",
"Modify",
"ContainerInherit, ObjectInherit",
"None",
"Deny"
)
$Acl.RemoveAccessRule($AccessRule)
Set-Acl -Path $Path -AclObject $Acl
Before changing permissions, export or document the existing ACL so that you can restore the system accurately if required.
Microsoft Security Updates
Microsoft released emergency updates for the affected Windows versions in stages.
Update Published on 07.07.2021
The following updates were also released for Windows Server 2016, Windows 10 version 1607, and Windows Server 2012:
Initial Update Release
At the time of the initial update release, patches were available for the following systems:
- Windows Server 2012 R2 and Windows 8.1: KB5004958.
- Windows Server 2019 and Windows 10 version 1809: KB5004947.
- Windows 10 version 1909: KB5004946.
- Windows 10 versions 2004, 20H2, and 21H1: KB5004945.
- Windows 10 version 1507: KB5004950.
- Windows Server 2008 R2 and Windows 7: KB5004951.
Always verify the applicable update for the specific operating-system version and servicing model before deployment.
Recommended Actions
For systems affected by PrintNightmare:
- Install the appropriate Microsoft security update.
- Disable the Print Spooler service on Domain Controllers.
- Disable the service on systems that do not require printing.
- If printing is essential, apply a temporary mitigation and test printing thoroughly.
- Monitor Domain Controllers, print servers, and privileged accounts for suspicious activity.
- Reassess and remove temporary mitigations after patching and validation.
Update #2 — 07.07.2021
Updates for Windows 10 version 1607, Windows Server 2016, and Windows Server 2012 were released:
Update #1 — 07.07.2021
Microsoft released patches for the PrintNightmare vulnerability, but updates were not initially available for all Windows versions. At that time, updates were not yet available for Windows 10 version 1607, Windows Server 2016, or Windows Server 2012.
The initially released updates included:
- Windows Server 2012 R2 and Windows 8.1: KB5004958.
- Windows Server 2019 and Windows 10 version 1809: KB5004947.
- Windows 10 version 1909: KB5004946.
- Windows 10 versions 2004, 20H2, and 21H1: KB5004945.
- Windows 10 version 1507: KB5004950.
- Windows Server 2008 R2 and Windows 7: KB5004951.