Configure RPC packet level privacy setting for incoming connections
The `RpcAuthnLevelPrivacyEnabled` registry value controls server-side RPC protection for incoming connections to the print service's `IRemoteWinspool` interface.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled
The RpcAuthnLevelPrivacyEnabled registry value controls server-side RPC protection for incoming connections to the print service's IRemoteWinspool interface. Its type is REG_DWORD. A value of 1 enables Enforcement mode: the print service accepts clients on this interface only when they use the increased RPC authentication level with packet-level privacy.
The resulting RPC_C_AUTHN_LEVEL_PKT_PRIVACY protection authenticates the communication and protects the transferred RPC data against undetected modification and disclosure. For remote connections, the arguments of each remote procedure call are encrypted.
This setting applies to the relevant print-service RPC interface. It does not provide general encryption for every printing protocol, print data in transit through other interfaces, or stored print jobs.
Notes
Additional effects
Connections that do not negotiate the required RPC protection level are rejected by the print server. A client therefore cannot use the protected IRemoteWinspool interface with a weaker RPC authentication level.
Security
Enforcement mode is part of the mitigation for CVE-2021-1678, a spoofing and security-bypass vulnerability involving authentication of printer RPC bindings. Requiring the higher protection level makes interception or modification of RPC communication more difficult and prevents connections that use an insufficient RPC authentication level.
The value does not grant additional user rights or change file-system permissions or administrative group membership.
Possible side effects
Clients without the January 12, 2021 Windows security update or a later update might not support the required behavior. Connections from those clients through IRemoteWinspool can fail, preventing them from using shared printers.
Notes
For Windows updates released on or after September 14, 2021, an absent registry value defaults to the behavior represented by 1. On an appropriately updated system, explicitly setting the value to 1 therefore confirms the Enforcement mode that already applies by default.
Microsoft exposes the corresponding ADMX-backed computer policy in Windows 11, version 24H2 and later. The underlying protection and registry value were introduced earlier through the security updates for CVE-2021-1678 on previous Windows and Windows Server versions.
A change to the effective value takes effect after either the device or the Print Spooler service is restarted.
Microsoft documentation
Microsoft Learn: Policy CSP – Printers
Microsoft Support: Managing deployment of Printer RPC binding changes for CVE-2021-1678 (KB4599464)
Microsoft Learn: Authentication-Level Constants