Saint PrintNightmare, Nightmare of the Print Spooler

Patron of domain administrators, print drivers, and those who never turn off the service they thought was harmless.

Life

In 2021 researchers revealed, with a leaked PoC getting ahead of their plans, a flaw in the Windows Print Spooler (CVE-2021-1675 and then CVE-2021-34527). The print service, running everywhere, let an ordinary user have the system load a malicious driver and gain SYSTEM, even remotely on domain controllers. For weeks the mitigation was, simply, to turn the spooler off.

Prayer

O Saint PrintNightmare, who turns the printer into a Trojan horse, let our spoolers accept only the drivers we trust. Amen.

How to celebrate

Celebrated by installing the patches, restricting driver installation to administrators, and disabling the spooler on servers that do not print.

Spooler left on, domain gone.