Skip to content

AD-INF-009: Print Spooler running on domain controllers

medium high   Infrastructure   MITRE ATT&CK T1187   Reads: SMB probe, LDAP

The Print Spooler service runs on a domain controller, so any domain user can force the DC to authenticate to a host of their choice (PrinterBug).

Also known as: print-spooler

Why it matters

The print spooler's RPC interface (MS-RPRN) has a call, RpcRemoteFindFirstPrinterChangeNotificationEx, that makes the server connect back to a host named by the caller, and any authenticated user may call it. On a DC this means anyone in the domain can make the domain controller authenticate, as its machine account, to a machine they control.

What the attacker does with that authentication decides the impact:

  • sent to a host with unconstrained delegation, it leaves the DC's TGT there, and with the DC's TGT the attacker can DCSync the domain;
  • relayed to AD CS web enrollment over HTTP (ESC8), it yields a certificate for the DC;
  • relayed to LDAP on another DC without signing or channel binding, it can configure delegation or shadow credentials.

Domain controllers rarely need to print. The same service was also the target of PrintNightmare (CVE-2021-34527), another reason to keep it off on tier-0 servers.

How ad-doctor detects it

After an authenticated SMB session to each DC, ad-doctor connects to the IPC$ share and tries to open the \pipe\spoolss named pipe with read access. If the pipe opens, the spooler is listening and the DC is reported; STATUS_OBJECT_NAME_NOT_FOUND means it is not running. Nothing is sent over the pipe: no RPC call is made, so the probe cannot trigger the coercion itself. Any other error is treated as unknown.

Severity uses the LDAP snapshot: an enabled account other than a DC with TRUSTED_FOR_DELEGATION in userAccountControl makes it high. The probe is skipped with --no-probes. Each object is a DC host name, for example DC01.corp.example.

Attributes and probes read
  • IPC$ named pipe spoolss
  • userAccountControl (TRUSTED_FOR_DELEGATION)

Severity

High when the domain also has an enabled non-DC account trusted for unconstrained delegation (AD-DEL-001): coercing the DC to that host hands over the DC's TGT. Medium otherwise. The pairing is also reported on its own by AD-CHAIN-002, and the pairing with web enrollment over HTTP by AD-CHAIN-003; a confirmed spooler raises both to high, and they stay at medium without it. AD-CHAIN-003 stays medium either way when GPOs deny outgoing NTLM on every DC.

False positives and limits

  • A DC that really is a print server. Move the printers to a member server: there is no safe way to keep the spooler reachable on a DC.
  • Printer pruning. A DC uses its spooler to remove stale printers published in Active Directory. If you publish printers, stopping the spooler on every DC stops that cleanup; remove stale print queue objects with a script instead of keeping the spooler on.
  • Coercion through other interfaces (MS-EFSR, MS-DFSNM) is not covered by this check; stopping the spooler removes one coercion method, not all of them.

Fix

  1. Check the service on each DC.

    Invoke-Command -ComputerName (Get-ADDomainController -Filter *).HostName {
    Get-Service Spooler | Select-Object Status, StartType
}

  2. Stop and disable it on every DC:

    Stop-Service Spooler -WhatIf
Set-Service Spooler -StartupType Disabled -WhatIf

  3. Keep it disabled with Group Policy: in the Default Domain Controllers Policy set Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Print Spooler to Disabled.

  4. Remove unconstrained delegation from non-DC hosts (AD-DEL-001) so that a coerced authentication has nowhere useful to go.

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-INF-009

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-INF-009"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Research

Tools

MITRE ATT&CK

Available since 0.1.0.