What is PrintNightmare and what system administrators should do

PrintNightmare (CVE-2021-34527) is a vulnerability in the Windows print service (Print Spooler) that let an attacker run malicious code with administrator rights and take control of workstations and servers, including domain controllers. Microsoft confirmed it in early July 2021 and fixed it through updates released that summer. On updated systems, PrintNightmare is no longer a threat, but its lesson still holds: services that aren’t needed get turned off, and updates get installed on time.

What happened in July 2021?

A new zero-day vulnerability shook the Windows world at the time, and it was aptly named PrintNightmare.

More specifically, the security flaw let hackers use the printing component (print spooler) to run malicious code with administrator rights, and therefore gain full control over workstations in organizations.

The vulnerability was present on all Windows workstations and servers that had the print service (Print Spooler) running.

On July 6, 2021, Microsoft released an emergency security update, available through Windows Update, but it caused other headaches. The patch didn’t fully fix the problem, and it blocked printing on some Zebra printers.

What did we recommend to system administrators at the time?

Because the first update was incomplete, specialists proposed several workarounds until a definitive patch arrived. In July 2021, we recommended one of these three options, depending on your needs and skills:

• The first and simplest recommendation was to disable the print service (Print Spooler) on all workstations that don’t need to print. From a security point of view, it’s best to disable services that aren’t needed for day-to-day work, to limit vulnerabilities. This recommendation still holds today.
• The second option was the free micropatch from 0patch, instead of Microsoft’s July 6 update, with which it wasn’t compatible. It was a stopgap: today, you install Microsoft’s updates.
• The third option was to install Microsoft’s update and set “RestrictDriverInstallationToAdministrators”, which allows only administrators to install printer drivers on print servers.

What changed after July 2021?

On August 10, 2021, Microsoft changed the default behavior of Windows: after that month’s updates, only administrators can install or update printer drivers through Point and Print. In practice, the “RestrictDriverInstallationToAdministrators” setting became the default. The details are in Microsoft article KB5005652. More fixes for the print service followed in the months after.

The bottom line: a Windows computer or server that receives the monthly updates is protected against PrintNightmare. The risk remains on systems that no longer receive updates, such as Windows 10 without the paid ESU program, or Windows Server 2012 and 2012 R2, which went out of support on October 10, 2023.

What should system administrators do in 2026?

1. Install security updates every month on workstations and servers, and make sure no system falls behind.
2. Don’t go back to the old setting. The “RestrictDriverInstallationToAdministrators” value must stay at 1; if a user needs a new driver, an administrator installs it.
3. Turn off the print service wherever it isn’t needed, especially on domain controllers and servers that don’t print.
4. Replace systems that are out of support. They no longer get fixes for newly discovered vulnerabilities. See also our article on the problem with end-of-life (EOL) technologies.
5. On Windows 11, look into Windows protected print mode, which prints without third-party drivers on Mopria-certified printers.

Since all these recommendations require solid IT knowledge, we recommend turning to an IT outsourcing company. RezolvIT is at your service here, with both the expertise and the capacity to secure your infrastructure quickly.

In addition to the recommendations above, here are the general security recommendations once more:

• implement a solid backup policy for all your company’s vital systems;
• use high-performance, centrally managed anti-malware and antivirus solutions;
• implement your company’s security policy in several layers, using both anti-malware solutions and a firewall.

Backup as a Service: tell me more →

The purpose of this article was to make you aware of the PrintNightmare vulnerability and to suggest a set of recommendations. If security matters to your company (and it should), ask for a free IT audit and we’ll check these settings on your company network together.

RezolvIT supports the companies it works with, from IT security to employees working remotely.