Windows Print Spooler 'PrintNightmare' CVE-2021-34527 (remote code execution as SYSTEM, CISA KEV): which updates fix it and which registry or policy settings leave a patched server vulnerable?

What it is: CVE-2021-34527 (PrintNightmare) is a flaw in how the Windows Print Spooler service handles privileged file operations, letting an attacker run code as SYSTEM (remotely, or locally to gain privileges). It was disclosed in late June 2021, Microsoft shipped an out-of-band fix on July 6, 2021 (with later updates for older versions), and it is in CISA's KEV catalog, with ransomware use noted. It is dangerous on domain controllers and servers that hold the Spooler service. Am I affected: - Essentially every supported Windows client and server version before the July 2021 updates, including Windows 10, Windows 11 and Server 2022 builds listed in NVD. - Even a patched system is vulnerable by design if the Point and Print policy values NoWarningNoElevationOnInstall or UpdatePromptSettings (under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint) are set to anything other than 0 or are undefined. - Check update status with Get-HotFix or Windows Update history and the Spooler service with Get-Service Spooler. Fix: 1. Install the current cumulative Windows update; the July 6, 2021 and later updates include the protection (the NVD lists the first fixed build per release). 2. Confirm NoWarningNoElevationOnInstall and UpdatePromptSettings are 0 or not defined. In Group Policy set Point and Print Restrictions to Enabled with "Show warning and elevation prompt" for both new connections and driver updates. 3. Set RestrictDriverInstallationToAdministrators to 1 (it defaults to 1 from the August 10, 2021 updates), so only administrators can install print drivers on a print server. 4. Disable the Print Spooler service on servers that don't print, especially domain controllers. 5. If a spooler-exposed server was unpatched and reachable, check for unexpected drivers in the print driver store, new services and accounts, then rebuild if suspicious and rotate credentials that were on it. Verify: Get-HotFix shows a post-July-2021 update, the registry values above are 0 or absent, and Get-Service Spooler shows Disabled where printing isn't needed. Sources: https://nvd.nist.gov/vuln/detail/CVE-2021-34527 https://support.microsoft.com/en-us/topic/kb5005010-restricting-installation-of-new-printer-drivers-after-applying-the-july-6-2021-updates-31b91c02-05bc-4ada-a7ea-183b129578a7 https://www.cisa.gov/news-events/alerts/2021/07/06/microsoft-releases-out-band-security-updates-printnightmare https://www.cisa.gov/known-exploited-vulnerabilities-catalog