TMA-MFD-6.1.1
Enable Print Spooler Access Logging
Description
Print spoolers typically contain functionality to log all submitted requests. It is recommended that these facilities be enabled on the print spooler, logging levels be set to ensure adequate details are preserved, and logs be reviewed. When a security event occurs, spooler access logs may provide investigators with information necessary to determine the extent and origin of the event.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify compliance with CIS Multi-Function Device Benchmark v1.0.0 section 6.1.1: Enable Print Spooler Access Logging.
How it is fixed
Fix method: Guidance or infrastructure patch
Follow the remediation procedure in CIS Multi-Function Device Benchmark v1.0.0 section 6.1.1 to configure: Enable Print Spooler Access Logging.
Properties
- Operating systems
- Any
- Tags
- access-controlloggingmfdprinter
- Reference
- CIS Multi-Function Device Benchmark v1.0.0 - 6.1.1 Enable Print Spooler Access Logging