Security Brief - PrintNightmare

Detecting and Responding to PrintNightmare

ORDR Security Brief — CVE-2021-34527 (Windows Print Spooler Remote Code Execution)

Identify PrintNightmare-Vulnerable Systems

Step 1 — Navigate to the Security Tab. From Device Inventory in the ORDR console, open the Security tab to view organization-wide device risk and vulnerability data.

Step 2 — Locate Vulnerable Assets. The Incident Summary panel surfaces a dedicated "PrintNightmare Vuln" counter alongside other vulnerability and advisory categories, and separately tracks Device Risk Summary counts.

Step 3 — Uncover All Assets with a Running Vulnerable Print Spooler. Drilling into the PrintNightmare Vuln incident lists every affected device so the list can be exported and remediated per Microsoft’s guidance.

Microsoft's Recommended Remediation Steps

Microsoft recommends that customers follow these steps immediately:

• In ALL cases, apply the CVE-2021-34527 security update. The update will not change existing registry settings.
• After applying the security update, review the registry settings documented in the CVE-2021-34527 advisory.
• If the registry keys documented do not exist, no further action is required.
• If the registry keys documented exist, in order to secure your system, you must confirm that the following registry keys are set to 0 (zero) or are not present:
• • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
  • NoWarningNoElevationOnInstall = 0 (DWORD) or not defined (default setting)
  • UpdatePromptSettings = 0 (DWORD) or not defined (default setting)
• For more in-depth guidance, see Microsoft’s advisories "KB5005010: Restricting installation of new printer drivers after applying the July 6, 2021 updates" and "CVE-2021-34527."
• If Microsoft’s investigation identifies additional issues, it will take action as needed to help protect customers.

Microsoft-Documented Workarounds (If a Patch Is Not Available)

Find Systems With Print Spoolers

1. Users are urged to disable the "Print Spooler" service on servers that do not require it. Microsoft has provided a series of workarounds to be applied. Determine if the Print Spooler service is running (run as a Domain Admin).
2. Run the following as a Domain Admin: Get-Service -Name Spooler
3. If the Print Spooler is running or if the service is not set to disabled, select one of the following options to either disable the Print Spooler service, or to disable inbound remote printing through Group Policy.

Option 1: Disable Print Spooler

If disabling the Print Spooler service is appropriate for your enterprise, use the following PowerShell commands:

Impact of workaround: Disabling the Print Spooler service disables the ability to print both locally and remotely.

Option 2: Disable Remote Printing

You can also configure the settings via Group Policy as follows: Computer Configuration / Administrative Templates / Printers

Disable the "Allow Print Spooler to accept client connections" policy to block remote attacks.

Impact of workaround: This policy will block the remote attack vector by preventing inbound remote printing operations. The system will no longer function as a print server, but local printing to a directly attached device will still be possible.

Detecting an Active PrintNightmare Attack

Beyond flagging vulnerable systems, ORDR distinguishes exposure from active exploitation. The Incident Summary panel separately tracks a "PrintNightmare Attack" counter alongside the "PrintNightmare Vuln" counter described above, giving teams an immediate signal when an exploit attempt is under way.

Identify the Offending Systems. Drilling into the PrintNightmare Attack incident reveals the specific devices involved:

Mitigate the Threat. Selecting the offending hosts exposes one-click remediation actions directly from the device list, including:

• Add to Blocklist / Blocklist & Port Shut
• Remove Blocklist / Remove Blocklist & Enable Ports
• Generate Blocklist CLI
• Fetch Installed Software Info
• Change VLAN (enforce)
• Initiate Scan
• Delete Devices
• Change Attributes
• Analyze App Usage

Deploy the Generated Configuration. Generate Blocklist CLI produces switch-ready configuration that can be copied directly into network infrastructure, for example:

Number of devices for which Config CLI could not be generated: 17