Sous-systeme d'impression et le registre¶

# List all printers with their registry-stored properties
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\*" |
    Select-Object Name, Port, "Printer Driver", Status, Attributes |
    Format-Table -AutoSize

# Check the current state of the Spooler service
Get-Service -Name Spooler | Select-Object Name, Status, StartType

# Enumerate all subtrees under the Print key
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Print" |
    Select-Object PSChildName |
    Format-Table -AutoSize

# Display all registry values for a specific printer
$printerName = (Get-Printer | Select-Object -First 1).Name
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\$printerName"

# Read default DEVMODE as raw bytes (first 100 bytes for inspection)
$printerName = (Get-Printer | Select-Object -First 1).Name
$devmode = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\$printerName")."Default DevMode"
if ($devmode) {
    # Show the first 96 bytes in hex (covers the fixed portion of DEVMODE)
    ($devmode[0..95] | ForEach-Object { '{0:X2}' -f $_ }) -join ' '
}

# Decode the Attributes bitmask for all installed printers
$flags = @{
    0x00000001 = "QUEUED"
    0x00000002 = "DIRECT"
    0x00000004 = "DEFAULT"
    0x00000008 = "SHARED"
    0x00000010 = "NETWORK"
    0x00000020 = "HIDDEN"
    0x00000040 = "LOCAL"
    0x00000800 = "ENABLE_DEVQ"
    0x00002000 = "KEEP_PRINTED_JOBS"
    0x00004000 = "DO_COMPLETE_FIRST"
    0x00008000 = "WORK_OFFLINE"
    0x00400000 = "PUBLISHED"
    0x08000000 = "PER_MACHINE_CONNECTION"
}

Get-Printer | ForEach-Object {
    $attr = $_.Attributes
    $decoded = $flags.GetEnumerator() | Where-Object { $attr -band $_.Key } |
        ForEach-Object { $_.Value }
    [PSCustomObject]@{
        Printer    = $_.Name
        AttrHex    = '0x{0:X8}' -f [int]$attr
        Flags      = $decoded -join ', '
    }
} | Format-Table -AutoSize

# List all printers with key properties
Get-Printer | Format-Table Name, DriverName, PortName, Shared, PrinterStatus

# Get device-specific properties (paper size, color mode, etc.)
Get-PrinterProperty -PrinterName "HP LaserJet Pro" |
    Format-Table PropertyName, Type, Value

# Compare registry data with cmdlet output
$regData = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\HP LaserJet Pro"
$cmdData = Get-Printer -Name "HP LaserJet Pro"

[PSCustomObject]@{
    RegistryDriver = $regData."Printer Driver"
    CmdletDriver   = $cmdData.DriverName
    RegistryPort   = $regData.Port
    CmdletPort     = $cmdData.PortName
    Match          = ($regData."Printer Driver" -eq $cmdData.DriverName)
}

# List all installed print drivers with their version
Get-PrinterDriver | Select-Object Name, MajorVersion, Manufacturer, PrinterEnvironment |
    Format-Table -AutoSize

# Examine the registry entry for a specific driver
$driverPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3"
Get-ChildItem $driverPath | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath
    [PSCustomObject]@{
        Name     = $_.PSChildName
        Driver   = $props.Driver
        DataFile = $props."Data File"
        Config   = $props."Configuration File"
    }
} | Format-Table -AutoSize

# Install a printer driver from an INF file
# (requires administrative privileges)
pnputil /add-driver "C:\Drivers\printer.inf" /install

# Verify the driver appears in the registry
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-4" |
    Select-Object PSChildName

# Check current Point and Print policy settings
$pnpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
if (Test-Path $pnpPath) {
    Get-ItemProperty $pnpPath | Format-List
} else {
    Write-Output "No Point and Print policy configured (using defaults)"
}

# MITIGATION 1: Restrict driver installation to administrators only
# This is the primary PrintNightmare fix
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" `
    -Name "RestrictDriverInstallationToAdministrators" `
    -Value 1 -PropertyType DWord -Force

# MITIGATION 2: Enable RPC authentication level privacy
# Prevents unauthenticated RPC calls to the spooler
New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Print" `
    -Name "RpcAuthnLevelPrivacyEnabled" `
    -Value 1 -PropertyType DWord -Force

# MITIGATION 3: Disable Point and Print entirely (most restrictive)
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" `
    -Name "NoWarningNoElevationOnInstall" `
    -Value 0 -PropertyType DWord -Force
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" `
    -Name "UpdatePromptSettings" `
    -Value 0 -PropertyType DWord -Force

# NUCLEAR OPTION: Disable the Print Spooler service entirely
# (only for servers that do not need printing)
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify the service is stopped and disabled
Get-Service -Name Spooler | Select-Object Name, Status, StartType

# Audit script: check PrintNightmare mitigations on the local machine
$results = @()

# Check RestrictDriverInstallationToAdministrators
$pnpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
$restrict = (Get-ItemProperty $pnpPath -Name "RestrictDriverInstallationToAdministrators" -ErrorAction SilentlyContinue).RestrictDriverInstallationToAdministrators
$results += [PSCustomObject]@{
    Check  = "RestrictDriverInstallationToAdministrators"
    Value  = $restrict
    Status = if ($restrict -eq 1) { "SECURE" } else { "VULNERABLE" }
}

# Check RpcAuthnLevelPrivacyEnabled
$rpcValue = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print" -Name "RpcAuthnLevelPrivacyEnabled" -ErrorAction SilentlyContinue).RpcAuthnLevelPrivacyEnabled
$results += [PSCustomObject]@{
    Check  = "RpcAuthnLevelPrivacyEnabled"
    Value  = $rpcValue
    Status = if ($rpcValue -eq 1) { "SECURE" } else { "REVIEW" }
}

# Check Spooler service status on domain controllers
$isDC = (Get-WmiObject Win32_ComputerSystem).DomainRole -ge 4
$spooler = Get-Service -Name Spooler
$results += [PSCustomObject]@{
    Check  = "Spooler on DC"
    Value  = "$($spooler.Status) / $($spooler.StartType)"
    Status = if ($isDC -and $spooler.Status -eq 'Running') { "REVIEW" } else { "OK" }
}

$results | Format-Table -AutoSize

# Check which default printer mode is active
$winPath = "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"
$legacy = (Get-ItemProperty $winPath -Name "LegacyDefaultPrinterMode" -ErrorAction SilentlyContinue).LegacyDefaultPrinterMode

if ($legacy -eq 1) {
    $device = (Get-ItemProperty $winPath).Device
    Write-Output "Classic mode: default printer is '$device'"
} else {
    Write-Output "Automatic mode: Windows manages the default printer based on last used"
}

# Force classic default printer mode and set a specific default
Set-ItemProperty "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" `
    -Name "LegacyDefaultPrinterMode" -Value 1 -Type DWord

# Set default printer via cmdlet (preferred method)
Set-Printer -Name "HP LaserJet Pro" -Default

# List all network printer connections for the current user
Get-ChildItem "HKCU:\Printers\Connections" -ErrorAction SilentlyContinue | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath
    [PSCustomObject]@{
        Connection = $_.PSChildName -replace ',', '\'
        Server     = $props.Server
        Provider   = $props.Provider
    }
} | Format-Table -AutoSize

# Check machine-deployed printer connections
$machinePrinters = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Connections"
if (Test-Path $machinePrinters) {
    Get-ChildItem $machinePrinters | ForEach-Object {
        [PSCustomObject]@{
            Type       = "Machine"
            Connection = $_.PSChildName -replace ',', '\'
        }
    }
} else {
    Write-Output "No machine-deployed printer connections found"
}

# Check user-deployed printer connections
$userPrinters = "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Print\Connections"
if (Test-Path $userPrinters) {
    Get-ChildItem $userPrinters | ForEach-Object {
        [PSCustomObject]@{
            Type       = "User"
            Connection = $_.PSChildName -replace ',', '\'
        }
    }
} else {
    Write-Output "No user-deployed printer connections found"
}

# Check if Universal Print is configured
$upPath = "HKLM:\SOFTWARE\Microsoft\UniversalPrint"
if (Test-Path $upPath) {
    Get-ItemProperty $upPath | Select-Object DiscoveryEndpoint, TenantId, Enabled
} else {
    Write-Output "Universal Print is not configured on this machine"
}

# Create a high-priority logical printer for executives
Add-Printer -Name "HP4050-Priority" -DriverName "HP Universal Printing PCL 6" `
    -PortName "IP_10.0.1.50"
Set-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\HP4050-Priority" `
    -Name "Priority" -Value 99 -Type DWord

# The standard printer keeps the default priority (1)
# Jobs from HP4050-Priority will always print before standard jobs

# Check Event Log for Spooler crash events
Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    Id        = 7031, 7034, 7000, 808
    StartTime = (Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match 'Spooler|spoolsv|Print'
} | Select-Object TimeCreated, Id, Message | Format-Table -Wrap

# Step 1: Stop the spooler
Stop-Service -Name Spooler -Force

# Step 2: Identify the problematic driver in the registry
$driverPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Drivers\Version-3"
Get-ChildItem $driverPath | Select-Object PSChildName

# Step 3: Remove the faulty driver key (replace with actual driver name)
# Remove-Item "$driverPath\FaultyDriverName" -Recurse -Force

# Step 4: Remove associated driver files
# $driverDir = "$env:SystemRoot\System32\spool\drivers\x64\3"
# Remove-Item "$driverDir\faulty*" -Force

# Step 5: Restart the spooler
Start-Service -Name Spooler

# Step 1: Stop the spooler
Stop-Service -Name Spooler -Force

# Step 2: List all printer keys in the registry
$printerRegPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers"
$regPrinters = (Get-ChildItem $printerRegPath).PSChildName

# Step 3: Compare with actually installed printers
# (spooler must be running for Get-Printer to work, so we restart temporarily)
Start-Service -Name Spooler
Start-Sleep -Seconds 3
$livePrinters = (Get-Printer).Name
Stop-Service -Name Spooler -Force

# Step 4: Identify ghost printers (in registry but not in live list)
$ghosts = $regPrinters | Where-Object { $_ -notin $livePrinters }

if ($ghosts) {
    Write-Output "Ghost printers found:"
    $ghosts | ForEach-Object { Write-Output "  - $_" }

    # Step 5: Back up and remove ghost entries
    foreach ($ghost in $ghosts) {
        $keyPath = "$printerRegPath\$ghost"
        # Export the key before deletion for safety
        reg export "HKLM\SYSTEM\CurrentControlSet\Control\Print\Printers\$ghost" `
            "$env:TEMP\ghost_printer_$($ghost -replace '[\\/:*?""<>|]','_').reg" /y
        Remove-Item $keyPath -Recurse -Force
        Write-Output "Removed ghost printer: $ghost"
    }
} else {
    Write-Output "No ghost printers detected"
}

# Step 6: Clear the spool folder and restart
Remove-Item "$env:SystemRoot\System32\spool\PRINTERS\*" -Force -ErrorAction SilentlyContinue
Start-Service -Name Spooler

# Full spooler reset procedure
# WARNING: This will clear all pending print jobs

# Step 1: Stop the spooler service
Write-Output "Stopping Print Spooler..."
Stop-Service -Name Spooler -Force -ErrorAction Stop
Start-Sleep -Seconds 2

# Step 2: Clear the spool directory (pending jobs)
$spoolPath = "$env:SystemRoot\System32\spool\PRINTERS"
$files = Get-ChildItem $spoolPath -ErrorAction SilentlyContinue
if ($files) {
    Write-Output "Clearing $($files.Count) files from spool directory..."
    Remove-Item "$spoolPath\*" -Force
} else {
    Write-Output "Spool directory is already clean"
}

# Step 3: Clear any stuck rendering in the shadow directory
$shadowPath = "$env:SystemRoot\System32\spool\drivers\x64\3\Old"
if (Test-Path $shadowPath) {
    Remove-Item "$shadowPath\*" -Force -ErrorAction SilentlyContinue
}

# Step 4: Reset the spooler service failure counter
sc.exe failure Spooler reset= 0

# Step 5: Restart the spooler
Write-Output "Starting Print Spooler..."
Start-Service -Name Spooler
$status = (Get-Service -Name Spooler).Status
Write-Output "Spooler status: $status"

# Step 6: Verify printers are back
Get-Printer | Select-Object Name, PrinterStatus | Format-Table -AutoSize

# Display the security descriptor for a printer in SDDL format
$printerName = "HP LaserJet Pro"
$printer = Get-Printer -Name $printerName -Full
$printer | Select-Object Name, PermissionSDDL

# Grant print permission to a specific group
$printerName = "HP LaserJet Pro"
$printer = Get-Printer -Name $printerName -Full
$currentSDDL = $printer.PermissionSDDL

# Append an ACE granting Print permission to Domain Users
# (A;;0x20008;;;DU) = Allow, Print+ReadPermissions, Domain Users
$newSDDL = $currentSDDL -replace '(?=D:)', ''
Set-Printer -Name $printerName -PermissionSDDL "$currentSDDL(A;;0x20008;;;DU)"

# Enable the operational log for detailed print events
wevtutil set-log "Microsoft-Windows-PrintService/Operational" /enabled:true

# Query recent print events
Get-WinEvent -LogName "Microsoft-Windows-PrintService/Operational" -MaxEvents 20 |
    Select-Object TimeCreated, Id, LevelDisplayName, Message |
    Format-Table -Wrap

# Audit: who printed what in the last 24 hours
Get-WinEvent -FilterHashtable @{
    LogName   = 'Microsoft-Windows-PrintService/Operational'
    Id        = 307
    StartTime = (Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue | ForEach-Object {
    [PSCustomObject]@{
        Time     = $_.TimeCreated
        User     = $_.Properties[2].Value
        Printer  = $_.Properties[4].Value
        Document = $_.Properties[1].Value
        Pages    = $_.Properties[7].Value
        Size     = '{0:N0} KB' -f ($_.Properties[6].Value / 1KB)
    }
} | Format-Table -AutoSize