Non-administrative user accounts or groups will only have print permissions of Printer Shares.

From Windows Server 2008 R2 Domain Controller Security Technical Implementation Guide

Associated with: CCI-000213

SV-32257r1_rule Non-administrative user accounts or groups will only have print permissions of Printer Shares.

Vulnerability discussion

Improperly configured share permissions on printers can permit the addition of unauthorized print devices on the network. Windows shares are a means by which files, folders, printers, and other resources can be published for network users to remotely access. Regular users cannot create shares on their local machines; only Administrators and Power Users have that ability.

Check content

Open “Devices and Printers” in Control Panel. If there are no locally-attached printers, then mark this as “Not Applicable.” Perform this check for each locally-attached printer: Right click on a locally-attached printer. Select “Printer Properties”. Select the “Sharing” tab. View whether “Share this printer” is checked. For any printers with “Share this printer” selected: Select the Security tab. If any non-administrative user accounts or groups have greater permissions than “Print”, then this is a finding.

Fix text

Configure the permissions on locally-shared printers to meet the minimum requirements.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.