PrintNightmare was a critical remote code execution vulnerability in the Windows Print Spooler service. CISA's alert advised disabling the service on domain controllers and on systems that do not print, preferably through Group Policy. The broader lesson is to turn off services you do not need, since an unused service still carries risk.
What CISA's alert says
CISA first posted the alert on 30 June 2021 and last revised it on 2 July 2021. It describes PrintNightmare as a critical remote code execution vulnerability in the Windows Print Spooler service, with an attacker able to take control of an affected system. It notes that Microsoft's earlier update for CVE-2021-1675 did not address the public exploits sharing the PrintNightmare name. The alert links to Microsoft's guidance for CVE-2021-34527 and later updates pointed to newer guidance with further mitigations.
Why a print service ends up on a domain controller
A service that is installed and running on a server role that never prints is attack surface nobody chose. Windows servers often carry features that the role does not need, and nobody revisits them. This is how a flaw in a print service becomes a problem for identity infrastructure.
CISA's alert says Microsoft recommends disabling it on domain controllers and Active Directory admin systems, preferably through Group Policy so the setting is applied consistently.
The decision rule
For each server role, ask one question: does this machine need to print?
- Domain controllers. Almost never. Disable.
- Application and database servers. Usually not. Disable.
- Print servers. Yes, so they need patching and network restrictions instead.
- Admin workstations. Check; disable if no one prints from them.
How to apply it
- Inventory which systems run the service. A simple query across servers will list them.
- Group by role and decide which can have it disabled.
- Apply the change through Group Policy, not by hand, so new machines inherit it.
- Keep an exception list with owners and reasons.
- Re-check periodically, because reinstalls and role changes can bring the default back.
Why CISA treats this as a workaround
The alert points to Microsoft's updates and guidance as the fix, and workarounds as a way to reduce risk until they are in place. Disabling a service can break legitimate printing, so test before broad rollout.
The pattern to copy
This is a standard hardening move that applies far beyond printing: remove what you do not use. File sharing protocols, remote management features and old listeners all follow the same rule. The same instinct helped with SMBv1 in the WannaCry story. See WannaCry and the two month gap and why the first fix is sometimes incomplete.
Safeguard's asset discovery and policies can help you see what runs where and enforce a baseline, though operating system service settings remain under your Windows management tools. For existing coverage of the bug itself, read PrintNightmare CVE-2021-34527 explained.
Quick check
Where did CISA say to disable Print Spooler?
On domain controllers and on systems that do not print, preferably via Group Policy.
Is disabling the service a permanent fix?
CISA treats it as a mitigation. Apply Microsoft's updates and follow its current guidance.
Sources
Last reviewed: 19 October 2026.
