Here we go again, a new PoC is in the wild and it’s attacking your print spooler!!
The lastest update from Microsoft does not patch this and even Windows 7 to Windows 2019 is vulnerable.
Mitigation:
Stop the spooler on all devices not needing it, especially DC’s!
Restrict access to print servers with firewall rules.
Run theese commands in your RMM or logon scripts.
Command prompt: net stop spooler && sc config spooler start=disabled
PowerShell prompt: Stop-Service -Name Spooler -Force Set-Service -Name Spooler -StartupType Disabled
Source:
PrintNightmare, Critical Windows Print Spooler Vulnerability | CISA
Related Posts
Reported Zero-day Vulnerabilities in Microsoft Exchange Server 2013, 2016, and 2019- New Windows 10 vulnerability allows anyone to get admin privileges
- PrintNightmare: Clarified Guidance for CVE-2021-34527 Windows Print Spooler Vulnerability
- PrintNightmare: Out-of-band updates ready – patch now!
- PATCH NOW: April 2021 Exchange Server Security Updates
- Exchange exploit: One-Click Microsoft Exchange On-Premises Mitigation Tool