The Internet Printing Protocol (IPP) must be disabled on the IIS 8.5 web server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-76753	IISW-SV-000149	SV-91449r1_rule		Medium

Description
The use of Internet Printing Protocol (IPP) on an IIS web server allows client’s access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.

STIG	Date
IIS 8.5 Server Security Technical Implementation Guide	2018-01-03

Details

Check Text ( C-76409r1_chk )
If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable. Navigate to the following directory: %windir%\web\printers If this folder exists, this is a finding. Determine whether Internet Printing is enabled: Click “Start”, then click “Administrative Tools”, and then click “Server Manager”. Expand the roles node, then right-click “Print Services”, and then select “Remove Roles Services”. If the Internet Printing option is enabled, this is a finding.

Check Text ( C-76409r1_chk )

If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable.

Navigate to the following directory:

%windir%\web\printers

If this folder exists, this is a finding.

Determine whether Internet Printing is enabled:

Click “Start”, then click “Administrative Tools”, and then click “Server Manager”.

Expand the roles node, then right-click “Print Services”, and then select “Remove Roles Services”.

If the Internet Printing option is enabled, this is a finding.

Fix Text (F-83449r1_fix)
Click “Start”, then click “Administrative Tools”, and then click “Server Manager”. Expand the roles node, then right-click “Print Services”, and then select “Remove Roles Services”. If the Internet Printing option is checked, clear the check box, click “Next”, and then click “Remove” to complete the wizard.