Critical RiskWindowsLegitimateCommonly Abused
spoolsv.exeWINDOWS SERVICEspoolsv.exe - Print Spooler Security Analysis (PrintNightmare)
spoolsv.exe is the Windows Print Spooler service. It has been exploited by **PrintNightmare (CVE-2021-34527)** and other critical vulnerabilities allowing RCE and privilege escalation. **Disable on systems not requiring printing**.
Risk Summary
CRITICAL priority due to PrintNightmare. Disable Print Spooler on servers and DCs not requiring print. Monitor for unusual DLL loading and child processes.
Overview
What is spoolsv.exe?
spoolsv.exe manages the Windows printing subsystem.
Security Significance
- PrintNightmare: CVE-2021-34527 enabled RCE
- Privilege Escalation: Multiple CVEs
- SYSTEM Privileges: Runs with highest privileges
- Network Exposure: Print server functionality
Normal Behavior
Normal Behavior
| Property | Expected Value |
|---|---|
| Path | C:\Windows\System32\spoolsv.exe |
| Parent | services.exe |
| Instances | ONE |
| User | NT AUTHORITY\SYSTEM |
Common Locations
C:\Windows\System32\spoolsv.exeSuspicious Indicators
Suspicious Indicators
| Indicator | Risk |
|---|---|
| DLLs from user-writable paths | CRITICAL |
| Spawning cmd/PowerShell | CRITICAL |
| Unsigned drivers | HIGH |
| Unexpected network connections | HIGH |
Abuse Techniques
Attack Techniques
PrintNightmare (CVE-2021-34527)
Remote code execution via malicious printer drivers:
python3 printnightmare.py -u user -p pass dc.target.local
Local Privilege Escalation
SharpPrintNightmare.exe C:\temp\evil.dll
Detection Guidance
Detection
spoolsv.exe spawning interpreters → ALERT: CRITICAL
DLL loading from user paths → ALERT: CRITICAL
New print driver installation → ALERT: HIGH
Mitigation
Stop-Service Spooler
Set-Service Spooler -StartupType Disabled
Remediation Steps
- Disable Print Spooler if not needed
- Apply all security patches
- Monitor for driver installations
- Restrict Point-and-Print via GPO
Investigation Checklist
- Check Print Spooler patch status
- Verify if service is needed
- Review installed print drivers
- Check for unusual child processes
- Examine loaded DLLs
MITRE ATT&CK Techniques
Last verified: January 18, 2026