3.7.2 (L1) Ensure 'Point and Print Restrictions: When installing drivers for a new connection' is set to 'Enabled: Show warning and elevation prompt'

Information

This policy setting controls whether computers will show a warning and a security elevation prompt when users create a new printer connection using Point and Print.

The recommended state for this setting is: Enabled: Show warning and elevation prompt

Note: On August 10, 2021, Microsoft announced a

Point and Print Default Behavior Change

which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in

KB5005652-Manage new Point and Print default driver installation behavior (CVE-2021-34481)

. This change overrides all Point and Print Group Policy settings and ensures that only Administrators can install printer drivers from a print server using Point and Print.

Enabling Windows User Account Control (UAC) for the installation of new print drivers can help mitigate the PrintNightmare vulnerability (

CVE-2021-34527

) and other Print Spooler attacks.

Although the Point and Print default driver installation behavior overrides this setting, it is important to configure this as a backstop in the event that behavior is reversed.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled: Show warning and elevation prompt

Administrative Templates\Printers\Point and Print Restrictions: When installing drivers for a new connection

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/16852

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(8)

Plugin: Windows

Control ID: 58eedaed0b8fdd15b9058a18dfbd42f43095739470b13f66c8fd06cc1c7a51ec