<p>Microsoft has just confirmed the exploit known as &#8220;PrintNightmare&#8221; that was recently discovered by the <a href="https://us-cert.cisa.gov/ncas/current-activity/2021/06/30/printnightmare-critical-windows-print-spooler-vulnerability" target="_blank" rel="noopener">Cybersecurity &; Infrastructure Security Agency</a>.</p>
<p><img class="alignnone size-full wp-image-3203" src="https://www.wincert.net/wp-content/uploads/2019/07/hacker.jpg" alt="" width="640" height="426" /></p>
<p>This exploit affects the Windows print spooler and has been marked as critical since it can lead to remote code execution. The Windows Print Spooler is a component responsible for the printing process on Windows devices. An attacker who successfully exploits this vulnerability could run arbitrary code with SYSTEM privileges which will allow the attacker to view, change or delete data, install programs and create new accounts with administrative rights.</p>
<p>According to Microsoft, PrintNightmare zero-day is already being exploited!</p>
<blockquote class="twitter-tweet" data-width="500" data-dnt="true">
<p lang="en" dir="ltr">Microsoft 365 Defender customers can also refer to the threat analytics report we published on this vulnerability. The report provides tech details, guidance for mitigating the impact of this threat, and advanced hunting queries, which are published here: <a href="https://t.co/tBunCJgn6W">https://t.co/tBunCJgn6W</a></p>
<p>&mdash; Microsoft Threat Intelligence (@MsftSecIntel) <a href="https://twitter.com/MsftSecIntel/status/1410829641040896005?ref_src=twsrc%5Etfw">July 2, 2021</a></p></blockquote>
<p><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script></p>
<p>Microsoft is still investigating this vulnerability and offers a workaround in order to stay protected from exploitation of this vulnerability. The system admins should use group policy management or manually disable Print Spoolers on Domain Controllers which are not being used for printing.</p>
<p>Print spooler service can also be disabled with the following PowerShell commands:</p>
<p><strong>Stop-Service -Name Spooler -Force</strong><br />
<strong>Set-Service -Name Spooler -StartupType Disabled</strong></p>
<p>Another option is to<strong> Disable inbound remote printing</strong> using <strong>Group Policy </strong>by navigating to the following GPO path:<br />
<strong>Computer Configuration | Administrative Templates | Printers</strong></p>
<p>and disable the following policy:</p>
<p><strong>Allow Print Spooler to accept client connections</strong></p>
<p>This policy blocks the remote attack vector by preventing inbound remote printing operations.</p>