Print Server¶

# Check the Spooler service status and startup type
Get-Service -Name Spooler | Select-Object Name, Status, StartType

# Move the spool directory to a dedicated disk
$spoolPath = "D:\PrintSpool"
if (-not (Test-Path $spoolPath)) {
    New-Item -Path $spoolPath -ItemType Directory -Force
}
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Print" `
    -Name "DefaultSpoolDirectory" -Value $spoolPath
Restart-Service -Name Spooler -Force

# Configure Spooler recovery: restart on first and second failure, do nothing on third
sc.exe failure Spooler reset= 86400 actions= restart/60000/restart/60000//0

# List all installed print drivers with their version
Get-PrinterDriver | Select-Object Name, MajorVersion, PrinterEnvironment |
    Format-Table -AutoSize

# List all registered port monitors
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Monitors" |
    ForEach-Object {
        [PSCustomObject]@{
            Monitor = $_.PSChildName
            Driver  = (Get-ItemProperty $_.PSPath).Driver
        }
    } | Format-Table -AutoSize

# List all printers with their key properties from the registry
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\*" |
    Select-Object Name, Port, "Printer Driver", Priority |
    Format-Table -AutoSize

# Create a high-priority queue pointing to the same printer port
Add-Printer -Name "LaserJet-Urgents" -DriverName "HP Universal Printing PCL 6" `
    -PortName "IP_10.0.1.50" -Priority 99

# Verify both queues exist with different priorities
Get-Printer -Name "LaserJet*" | Select-Object Name, Priority | Format-Table

# Disable "Let Windows manage my default printer" via registry
Set-ItemProperty -Path "HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" `
    -Name "LegacyDefaultPrinterMode" -Value 1 -Type DWord

# Set a specific default printer
$printer = "HP LaserJet Etage 2"
(New-Object -ComObject WScript.Network).SetDefaultPrinter($printer)

# Restrict a queue to business hours only (08:00 - 18:00)
$startMinutes = 8 * 60    # 480
$endMinutes = 18 * 60     # 1080
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\HP LaserJet Etage 2" `
    -Name "StartTime" -Value $startMinutes -Type DWord
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Printers\HP LaserJet Etage 2" `
    -Name "UntilTime" -Value $endMinutes -Type DWord

# Lock down Point-and-Print to specific trusted servers only
$pnpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
if (-not (Test-Path $pnpPath)) {
    New-Item -Path $pnpPath -Force | Out-Null
}
Set-ItemProperty -Path $pnpPath -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type DWord
Set-ItemProperty -Path $pnpPath -Name "NoWarningNoElevationOnInstall" -Value 0 -Type DWord
Set-ItemProperty -Path $pnpPath -Name "UpdatePromptSettings" -Value 0 -Type DWord
Set-ItemProperty -Path $pnpPath -Name "TrustedServers" -Value 1 -Type DWord
Set-ItemProperty -Path $pnpPath -Name "ServerList" -Value "printserver01.corp.local;printserver02.corp.local" -Type String

# Enforce packaged Point-and-Print only
$pkgPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint"
if (-not (Test-Path $pkgPath)) {
    New-Item -Path $pkgPath -Force | Out-Null
}
Set-ItemProperty -Path $pkgPath -Name "PackagePointAndPrintOnly" -Value 1 -Type DWord
Set-ItemProperty -Path $pkgPath -Name "PackagePointAndPrintServerList" -Value 1 -Type DWord
New-ItemProperty -Path $pkgPath -Name "ListofServers" -Value @("printserver01.corp.local","printserver02.corp.local") `
    -PropertyType MultiString -Force

# Apply all PrintNightmare mitigations in a single script
$printPolicies = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers"
$pnpPolicies = "$printPolicies\PointAndPrint"
$printControl = "HKLM:\SYSTEM\CurrentControlSet\Control\Print"

# Create policy keys if they do not exist
foreach ($path in @($printPolicies, $pnpPolicies)) {
    if (-not (Test-Path $path)) {
        New-Item -Path $path -Force | Out-Null
    }
}

# Restrict driver installation to administrators only
Set-ItemProperty -Path $pnpPolicies -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type DWord

# Require elevation for Point-and-Print install and update
Set-ItemProperty -Path $pnpPolicies -Name "NoWarningNoElevationOnInstall" -Value 0 -Type DWord
Set-ItemProperty -Path $pnpPolicies -Name "UpdatePromptSettings" -Value 0 -Type DWord

# Enable RPC authentication level privacy
Set-ItemProperty -Path $printControl -Name "RpcAuthnLevelPrivacyEnabled" -Value 1 -Type DWord

# On workstations: disable remote spooler RPC endpoint
Set-ItemProperty -Path $printPolicies -Name "RegisterSpoolerRemoteRpcEndPoint" -Value 2 -Type DWord

Write-Output "All PrintNightmare mitigations applied."

# Verify that all PrintNightmare mitigations are in place
$checks = @(
    @{
        Path  = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
        Name  = "RestrictDriverInstallationToAdministrators"
        Expected = 1
    },
    @{
        Path  = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
        Name  = "NoWarningNoElevationOnInstall"
        Expected = 0
    },
    @{
        Path  = "HKLM:\SYSTEM\CurrentControlSet\Control\Print"
        Name  = "RpcAuthnLevelPrivacyEnabled"
        Expected = 1
    }
)

foreach ($check in $checks) {
    $value = Get-ItemProperty -Path $check.Path -Name $check.Name -ErrorAction SilentlyContinue
    $actual = $value.($check.Name)
    $status = if ($actual -eq $check.Expected) { "OK" } else { "NON CONFORME" }
    Write-Output "$($check.Name) = $actual [$status]"
}

# List all per-user printer connections from the registry
Get-ChildItem "HKCU:\Printers\Connections" -ErrorAction SilentlyContinue |
    ForEach-Object {
        Get-ItemProperty $_.PSPath | Select-Object Server, Printer
    } | Format-Table -AutoSize

# Publish all shared printers to Active Directory
$printersPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers"
if (-not (Test-Path $printersPath)) {
    New-Item -Path $printersPath -Force | Out-Null
}
Set-ItemProperty -Path $printersPath -Name "PublishPrinters" -Value 1 -Type DWord
Set-ItemProperty -Path $printersPath -Name "PruneDownlevel" -Value 1 -Type DWord
Set-ItemProperty -Path $printersPath -Name "PruningInterval" -Value 8 -Type DWord

# List all registered print processors
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors" |
    ForEach-Object {
        [PSCustomObject]@{
            Processor = $_.PSChildName
            Driver    = (Get-ItemProperty $_.PSPath).Driver
        }
    } | Format-Table -AutoSize

# List all TCP/IP printer ports with their configuration
$portsPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports"
if (Test-Path $portsPath) {
    Get-ChildItem $portsPath | ForEach-Object {
        $props = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            Port     = $_.PSChildName
            HostName = $props.HostName
            PortNum  = $props.PortNumber
            Protocol = if ($props.Protocol -eq 1) { "RAW" } else { "LPR" }
        }
    } | Format-Table -AutoSize
}

# Create a new TCP/IP printer port
Add-PrinterPort -Name "IP_10.0.1.52" -PrinterHostAddress "10.0.1.52" -PortNumber 9100

# Verify the port in the registry
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print\Monitors\Standard TCP/IP Port\Ports\IP_10.0.1.52" |
    Select-Object HostName, PortNumber, Protocol

# Inventory: list all shared printers, drivers, and ports
Write-Output "=== PRINTERS ==="
Get-Printer | Where-Object { $_.Shared -eq $true } |
    Select-Object Name, DriverName, PortName, Shared |
    Format-Table -AutoSize

Write-Output "=== DRIVERS ==="
Get-PrinterDriver | Select-Object Name, MajorVersion, PrinterEnvironment |
    Format-Table -AutoSize

Write-Output "=== POINT AND PRINT SETTINGS ==="
$pnpPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint"
if (Test-Path $pnpPath) {
    Get-ItemProperty $pnpPath
} else {
    Write-Output "No Point-and-Print policies configured (VULNERABLE)."
}

# Full PrintNightmare hardening script for a print server
$printPolicies = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers"
$pnpPolicies = "$printPolicies\PointAndPrint"
$pkgPolicies = "$printPolicies\PackagePointAndPrint"
$printControl = "HKLM:\SYSTEM\CurrentControlSet\Control\Print"

# Create policy keys
foreach ($path in @($printPolicies, $pnpPolicies, $pkgPolicies)) {
    if (-not (Test-Path $path)) {
        New-Item -Path $path -Force | Out-Null
    }
}

# MITIGATION 1: Restrict driver installation to administrators
Set-ItemProperty -Path $pnpPolicies -Name "RestrictDriverInstallationToAdministrators" -Value 1 -Type DWord

# MITIGATION 2: Always show warning and require elevation
Set-ItemProperty -Path $pnpPolicies -Name "NoWarningNoElevationOnInstall" -Value 0 -Type DWord
Set-ItemProperty -Path $pnpPolicies -Name "UpdatePromptSettings" -Value 0 -Type DWord

# MITIGATION 3: Restrict to trusted servers
Set-ItemProperty -Path $pnpPolicies -Name "TrustedServers" -Value 1 -Type DWord
Set-ItemProperty -Path $pnpPolicies -Name "ServerList" -Value "PRINTSVR01.corp.local" -Type String

# MITIGATION 4: Enable RPC authentication privacy
Set-ItemProperty -Path $printControl -Name "RpcAuthnLevelPrivacyEnabled" -Value 1 -Type DWord

# MITIGATION 5: Require packaged Point-and-Print drivers
Set-ItemProperty -Path $pkgPolicies -Name "PackagePointAndPrintOnly" -Value 1 -Type DWord
Set-ItemProperty -Path $pkgPolicies -Name "PackagePointAndPrintServerList" -Value 1 -Type DWord
New-ItemProperty -Path $pkgPolicies -Name "ListofServers" -Value @("PRINTSVR01.corp.local") `
    -PropertyType MultiString -Force | Out-Null

Write-Output "All mitigations applied on PRINTSVR01."

# Remove 32-bit print drivers that are no longer needed
Get-PrinterDriver | Where-Object { $_.PrinterEnvironment -eq "Windows NT x86" } |
    ForEach-Object {
        Write-Output "Removing x86 driver: $($_.Name)"
        Remove-PrinterDriver -Name $_.Name -PrinterEnvironment "Windows NT x86" -ErrorAction SilentlyContinue
    }

# Disable the Print Spooler on non-print servers
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

# Verify
Get-Service -Name Spooler | Select-Object Name, Status, StartType

# Comprehensive post-hardening validation
$results = @()

# Check 1: RestrictDriverInstallationToAdministrators
$val = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" -ErrorAction SilentlyContinue).RestrictDriverInstallationToAdministrators
$results += [PSCustomObject]@{ Check = "RestrictDriverInstallation"; Value = $val; Status = if ($val -eq 1) {"PASS"} else {"FAIL"} }

# Check 2: RpcAuthnLevelPrivacyEnabled
$val = (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Print" -ErrorAction SilentlyContinue).RpcAuthnLevelPrivacyEnabled
$results += [PSCustomObject]@{ Check = "RpcAuthnLevelPrivacy"; Value = $val; Status = if ($val -eq 1) {"PASS"} else {"FAIL"} }

# Check 3: TrustedServers
$val = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" -ErrorAction SilentlyContinue).TrustedServers
$results += [PSCustomObject]@{ Check = "TrustedServers"; Value = $val; Status = if ($val -eq 1) {"PASS"} else {"FAIL"} }

# Check 4: PackagePointAndPrintOnly
$val = (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PackagePointAndPrint" -ErrorAction SilentlyContinue).PackagePointAndPrintOnly
$results += [PSCustomObject]@{ Check = "PackagePointAndPrintOnly"; Value = $val; Status = if ($val -eq 1) {"PASS"} else {"FAIL"} }

# Check 5: No x86 drivers remaining
$x86count = (Get-PrinterDriver | Where-Object { $_.PrinterEnvironment -eq "Windows NT x86" }).Count
$results += [PSCustomObject]@{ Check = "No x86 Drivers"; Value = $x86count; Status = if ($x86count -eq 0) {"PASS"} else {"FAIL"} }

$results | Format-Table -AutoSize