Script_CVE-2021-34481_fix

Overview

This executable requires administrator privilege for printer-driver installation through Point and Print, reducing the risk that a non-administrator can install or update printer drivers.

Print Spooler Point and Print Hardening

CVE-2021-34481

Executable: Script_CVE-2021-34481_fix.exe

Solution

1. Access the Device

• Log in to the Windows device where the mitigation needs to be applied.
• Ensure that you have the required Administrator privileges.

2. Configure the Registry Setting

The executable configures the following machine policy registry value:

• Registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
• Value: RestrictDriverInstallationToAdministrators
• Data type: REG_DWORD
• Data: 1

3. Apply the Configuration

The executable runs silently and writes the machine policy value that restricts Point and Print driver installation to administrators.

The resulting configuration is:

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint 
RestrictDriverInstallationToAdministrators    REG_DWORD    1

4. Verify the Configuration

Verify that the following registry value is present on the target device:

• Registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint
• Value: RestrictDriverInstallationToAdministrators
• Type: REG_DWORD
• Data: 1

A value of 1 restricts Point and Print printer-driver installation to administrators.

References

Microsoft KB5005652: Point and Print driver installation behavior:
https://support.microsoft.com/en-us/servicing/os/windows/2021/08/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481

Microsoft Security Update Guide: CVE-2021-34481:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481