ASD ISM 1828 Disable print spooler on AD DS domain controllers
What it says
The Print Spooler service is disabled on Microsoft AD DS domain controllers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure the Print Spooler is turned off on AD DS domain controllers for security.
Disabling the Print Spooler service on your Microsoft Active Directory Domain Services (AD DS) domain controllers is like locking a door that doesn't need to be opened. It prevents unnecessary risk because hackers can exploit this service to access sensitive data or disrupt your network. By turning it off, you're simply reducing an avenue for cyber attacks on your important systems.
Free. Save your status, tasks and notes.
Why it matters
If Print Spooler runs on AD DS domain controllers, spooler flaws (e.g. PrintNightmare) can enable domain-level privilege escalation or credential theft.
How to implement
IT team should disable the Print Spooler service on all domain controllers.
To do this, they must access each server, locate the Print Spooler in the services list, and set it to 'Disabled'. This ensures it won't start even after a reboot.
System administrators should update their server management procedures to reflect this change.
They should document the steps taken to disable the service and inform other staff involved in system management about the changes to avoid confusion.
The IT manager should ensure that staff are aware that printers should be handled through other servers or services, not domain controllers.
This involves coordinating with office managers to discuss alternative options for managing printers.
Compliance officers should update any internal control documents and security policies.
They should include this specific practice of disabling the Print Spooler to ensure it aligns with organisational security protocols and the Essential Eight strategies.
Audit teams should schedule regular checks to confirm the Print Spooler service remains disabled on domain controllers.
They can create a checklist for IT staff verifying that the service setting hasn't changed.
Keep it running
Use GPO to disable Print Spooler on all domain controllers; regularly audit service state after patches and ensure no admin action re-enables it.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A recent screenshot or report of the services running on a sample of domain controllers.
Look at
The status of the Print Spooler service.
Good evidence
Shows the service is set to 'Disabled'.
- Check 2 of 5What an auditor asks for
Good evidence
Clearly states that the service should be disabled and outlines the steps taken.
- Check 3 of 5What an auditor asks for
Ask for
Training records or meeting notes where IT staff discussed managing printers on the network.
Look at
Evidence that disabling the Print Spooler was part of the agenda.
Good evidence
Includes discussion notes or an action item confirming understanding.
- Check 4 of 5What an auditor asks for
Look at
Any recent attempts to start the Print Spooler service.
Good evidence
Confirms no such activities have occurred.
- Check 5 of 5What an auditor asks for
Ask for
An incident response plan that includes procedures for when unexpected services are found running. Check that it covers identifying and addressing the Print Spooler being enabled.
Good evidence
Details immediate steps to disable it and investigate further.
Mappings
Closest match in ISO/IEC 27001: A.8.9, Configuration management for secure IT systems, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.9.
ISM-1828 requires the Print Spooler service to be disabled specifically on Microsoft AD DS domain controllers to reduce attack surface. This relates to Annex A 8.9 because disabling a high-risk service on a defined system role is a concrete security configuration that should be established, documented, implemented, monitored and reviewed under configuration management. Annex A 8.9 is broader and covers the governance and lifecycle of configurations across all systems, while ISM-1828 is a single prescriptive hardening setting for domain controllers.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.