Windows (desktop and server)
TMA-WIN10-18.7.12
Ensure 'Point and Print Restrictions: When updating drivers for an existing connection' is set to 'Enabled: Show warning and elevation prompt'
Description
This policy setting controls whether computers will show a warning and a security elevation prompt when users are updating drivers for an existing connection using Point and Print. The recommended state for this setting is: Enabled: Show warning and elevation prompt. Note: On August 10, 2021, Microsoft announced a Point and Print Default Behavior Change which modifies the default Point and Print driver installation and update behavior to require Administrator privileges. This is documented in KB5005652— Manage new Point and Print default driver installation behavior (CVE-2021-34481). This chan
How it is checked
Audit method: Windows registry
$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -ErrorAction SilentlyContinue).'UpdatePromptSettings'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'UpdatePromptSettings=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }- Expected output
compliant
How it is fixed
Fix method: Shell command
if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint' -Name 'UpdatePromptSettings' -Value 0 -PropertyType DWord -Force | Out-NullProperties
- Operating systems
- windows-10
- Tags
- cis-convertedregistrywindows
- Reference
- CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 18.7.12
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target windows