Allow Print Spooler to accept client connections
This registry value belongs to the computer-scoped Windows policy that controls whether the Print Spooler accepts incoming client connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows NT\Printers\RegisterSpoolerRemoteRpcEndPoint
This registry value belongs to the computer-scoped Windows policy that controls whether the Print Spooler accepts incoming client connections.
When the corresponding policy is enabled or not configured, the spooler accepts client connections. When the policy is disabled, the spooler rejects these connections and users cannot create new printer shares on the computer. Printers that are already shared remain configured as shares, but clients cannot reach them through the blocked spooler endpoint for inbound printing.
Notes
Security
Blocking incoming client connections reduces the network-accessible attack surface of the Print Spooler. In particular, it closes the attack path provided by inbound remote printing operations.
This setting does not stop or disable the Print Spooler service, nor does it correct vulnerabilities in the service itself. Local printing remains available in principle. The setting does not protect against local attacks or other attack paths that do not depend on this remote endpoint.
Possible side effects
With incoming client connections blocked, the computer can no longer operate as a print server for other devices. Users cannot create new printer shares, and clients cannot use existing shares hosted by the computer.
Notes
The Print Spooler must be restarted before a change to this setting takes effect.
Microsoft documentation
Microsoft Learn: ADMX_Printing2 Policy CSP – RegisterSpoolerRemoteRpcEndPoint
Microsoft Security Response Center: CVE-2021-34527