Windows Server 2008 R2 Member Server Security Technical Implementation Guide

The Windows Server 2008 R2 Member Server Security Technical Implementation Guide (V1 R33) has 291 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

291STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R33

CurrentPublished Wed Jun 17 2020

The print driver installation privilege will be restricted to administrators.

Windows Server 2008 R2 Member Server Security Technical Implementation Guide

Assessment Title

Rule Text

The print driver installation privilege will be restricted to administrators.

Description

Discussion Text

Allowing users to install drivers can introduce malware or cause the instability of a system. This capability should be restricted to the Administrators and Print Operators groups.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-1151

Rule

SV-32299r1_rule

Severity

low

Rule Version

3.029

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Analyze the system using the Security Configuration and Analysis snap-in.  
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for "Devices: Prevent users from installing printer drivers" is not set to "Enabled", then this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE 
Registry Path: \System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers

Value Name:  AddPrinterDrivers

Value Type:  REG_DWORD
Value:  1

Implementation Procedure

Fix Text

Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Devices: Prevent users from installing printer drivers" to "Enabled".

STIG check 37 of 291 in the Windows Server 2008 R2 Member Server STIG checklist

← Previous · V-1150The built-in Windows password complexity policy must be enabled.Next · V-1152 →Anonymous access to the registry must be restricted.