3 ms·

Having a printing subsystem installed on a directory server just seems nuts to me. The server running my blog doesn't even have CUPs installed.

ocdtrekkie 5y ago
For what it's worth, Server Core installs don't have Print Spooler installed, and that's what Microsoft currently recommends as a domain controller. But since it doesn't have a desktop UI, it's a bit less liked by smaller entities. And of course, not all Windows Server roles support being run that way. It's safe to disable Print Spooler on servers that aren't print servers, so I expect that to be a standing recommendation in the future. The other thing though is this vulnerability works against desktop PCs, which need the Print Spooler to print... However, you can set a group policy to disable remote printing to a desktop PC, which should block the flaw. Desktop PCs probably shouldn't be acting as print servers, so this is mostly a good idea to implement too. So the available mitigations/attack surface reductions available here are plentiful... and honestly probably should just be best practice now.
mysterydip 5y ago
I used to do consulting work, and there's many small businesses that have "the server" that does everything for them. Microsoft used to even sell "small business server" for this role. I think nowadays they're pushing those customers to the cloud instead, but it takes some companies a long time to upgrade.
Someone1234 5y ago
I'd be cautious blaming users. Microsoft literally sells an entire line of Server products ("Server Essentials") that are designed to be a combined AD/Printer/File Share/DNS/DHCP/etc server. Selling a product to a small business them jumping all over that small business for using it that way seems pretty wrong to me. Larger businesses can and likely should do better (e.g. isolate printers on their own VLAN?). Ultimately blaming end users is rarely constructive. Frankly the Windows Printer Spooler is using 1990s security thinking in 2021, and that's on Microsoft.
- kayodelycaon 5y ago
  I happen to agree the small business argument. I was considering larger installs where are resources for a dedicated controller.
- Woodi 5y ago
  > Microsoft literally sells an entire line of Server products ("Server Essentials") that are designed to be a combined AD/Printer/File Share/DNS/DHCP/etc server. WOW... Since when small business needs AD ?? :) DHCP, yes but DNS ? "Small business" so no DNS internaly needed so obviously Internet facing... And that do as file share and printer server ?? "Only in Microsoft" :> Becouse MS OSes do not have real ability to install/uninstall basic system components like eg. printer spooler... And how many times now MS spooler was RCE or admin rights source ??

ocdtrekkie 5y ago

For what it's worth, Server Core installs don't have Print Spooler installed, and that's what Microsoft currently recommends as a domain controller. But since it doesn't have a desktop UI, it's a bit less liked by smaller entities. And of course, not all Windows Server roles support being run that way. It's safe to disable Print Spooler on servers that aren't print servers, so I expect that to be a standing recommendation in the future. The other thing though is this vulnerability works against desktop PCs, which need the Print Spooler to print... However, you can set a group policy to disable remote printing to a desktop PC, which should block the flaw. Desktop PCs probably shouldn't be acting as print servers, so this is mostly a good idea to implement too. So the available mitigations/attack surface reductions available here are plentiful... and honestly probably should just be best practice now.

mysterydip 5y ago

I used to do consulting work, and there's many small businesses that have "the server" that does everything for them. Microsoft used to even sell "small business server" for this role. I think nowadays they're pushing those customers to the cloud instead, but it takes some companies a long time to upgrade.

Someone1234 5y ago

I'd be cautious blaming users. Microsoft literally sells an entire line of Server products ("Server Essentials") that are designed to be a combined AD/Printer/File Share/DNS/DHCP/etc server. Selling a product to a small business them jumping all over that small business for using it that way seems pretty wrong to me. Larger businesses can and likely should do better (e.g. isolate printers on their own VLAN?). Ultimately blaming end users is rarely constructive. Frankly the Windows Printer Spooler is using 1990s security thinking in 2021, and that's on Microsoft.

kayodelycaon 5y ago
I happen to agree the small business argument. I was considering larger installs where are resources for a dedicated controller.
Woodi 5y ago
> Microsoft literally sells an entire line of Server products ("Server Essentials") that are designed to be a combined AD/Printer/File Share/DNS/DHCP/etc server. WOW... Since when small business needs AD ?? :) DHCP, yes but DNS ? "Small business" so no DNS internaly needed so obviously Internet facing... And that do as file share and printer server ?? "Only in Microsoft" :> Becouse MS OSes do not have real ability to install/uninstall basic system components like eg. printer spooler... And how many times now MS spooler was RCE or admin rights source ??