Disable the Print Spooler Service on Domain Controllers

The Print Spooler service has been the source of multiple critical remote code execution and privilege escalation vulnerabilities (commonly referred to as PrintNightmare and related CVEs). Because domain controllers rarely need to print directly, disabling this service on DCs removes a high-value attack surface without impacting normal domain operations.

Steps to implement

• Confirm no domain controllers are being used as print servers or rely on the spooler for legitimate business functions.
• Disable the Print Spooler service locally as a quick validation step: Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled
• Create a Group Policy Object (GPO) targeting the Domain Controllers OU to disable the Print Spooler service consistently across all DCs.
• Configure the GPO under Computer Configuration > Preferences > Control Panel Settings > Services, setting the Spooler service to Disabled.
• Link and enforce the GPO, then run gpupdate /force on domain controllers to apply the change.
• Verify service status across all DCs and monitor for any application or workflow errors related to printing dependencies.
• Document the change and include Print Spooler status checks in future DC build and hardening checklists.