Print Spooler on domain controllers: closing a door nobody uses
On most domain controllers the Print Spooler service is still running, although no printer has ever been attached to them. This useless service widens the attack surface of the heart of the directory. Disabling it takes minutes; pairing it with protections against authentication relay makes a real difference.
A default service with no purpose on a DC
The Print Spooler is enabled by default on Windows Server, domain controllers included. Yet a domain controller has no reason to manage print queues. The service has been hit by several serious vulnerabilities in recent years, and some of its functions can be misused to make the machine authenticate to another system.
The real issue: forced authentication
Several Windows protocols — the spooler, but also other RPC interfaces — can be invoked so that a server authenticates to a designated machine. On its own, that behaviour is of limited danger. It becomes dangerous when combined with a service that accepts relayed authentication without checking it: a server with unconstrained delegation, an LDAP service without signing, or certificate authority web enrollment without extended protection. That combination is what must be broken.
Defensive principle. Removing unnecessary services reduces the possible triggers; requiring signing and extended protection removes what makes those triggers exploitable. The two measures complement each other; neither is enough on its own.
Disable the spooler on domain controllers
The simplest measure: stop and disable the service on every domain controller, through a GPO linked to the Domain Controllers OU. Just check beforehand that no real use exists — which is almost always the case.
Get-Service -Name Spooler -ComputerName DC01 | Select-Object Status, StartType # Via GPO: Computer Configuration > Policies > Windows Settings > # Security Settings > System Services > Print Spooler: Disabled
The same logic applies to other Tier 0 servers: certificate authority, Entra Connect server, ADFS servers.
Complementary protections
- LDAP signing and channel binding on domain controllers, so that authentication relayed to LDAP is rejected.
- SMB signing required on servers, domain controllers first.
- Extended Protection for Authentication (EPA) and HTTPS on AD CS web enrollment, or removal of that role if unused.
- Removal of unconstrained delegation from everything that is not a domain controller.
- NTLM reduction, since NTLM remains the protocol most exposed to relay.
What an audit checks
- The Print Spooler state on each domain controller and Tier 0 server.
- Whether LDAP signing and channel binding are required.
- Whether SMB signing is required on domain controllers.
- The configuration of the certificate authority's web enrollment.
- Accounts and computers with unconstrained delegation.