Printnightmare and Normal Users

Ronc · 03 Jul 2021

There's a lot of talk lately about this new unpatched vulnerability. It seems that everyone is being implored to disable the print spooler service or file and printer sharing in the Windows Firewall. Does this apply to normal users? Normal users are those with an internet connected nat router, networking together other devices on the LAN, like PC's, phones, network printers, webcams, and more recently, smart home devices. The local Windows computers print to network printers which do not run Windows. The local computers are not print servers, but they all have file and printer sharing enabled, so if someone were to connect a usb printer to one of the Windows computers, file and printer sharing would let other users on the network use that local printer. All of this equipment should be separate from the global internet, thanks to the nat router. Is this normal setup not safe from Printnightmare?

Build: 19043.1081 (21H1)

Try3 · 05 Jul 2021

Ron,

Just my own opinion of course but I think you'd be better off asking your question in
Windows Print Spooler Remote Code Execution Vulnerability - TenForums
because the posters there have pondered the issue.

Best of luck,
Denis

bro67 · 05 Jul 2021

It really only affects Domain Controllers and Windows Server not Workstations. A person would have to gain access to the machine in order to run the exploit or a admin would have to do something stupid to allow a exploit or such to run. All lf these rootkits and attacks happening are because idiot admins are not paying attention to proper security and not allowing end users to do stupid stuff. The last major one was because someone handed out the password that everyone was using and it was forward facing to allow a attacker to gain access.