Non-administrative accounts or groups must only have print permissions on printer shares.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-224836	WN16-00-000200	SV-224836r569186_rule		Low

Description
Windows shares are a means by which files, folders, printers, and other resources can be published for network users to access. Improper configuration can permit access to devices and data beyond a user's need.

STIG	Date
Microsoft Windows Server 2016 Security Technical Implementation Guide	2021-03-05

Details

Check Text ( C-26527r465410_chk )
Open "Devices and Printers". If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.) For each printer: Right-click on the printer. Select "Printer Properties". Select the "Sharing" tab. If "Share this printer" is checked, select the "Security" tab. If any standard user accounts or groups have permissions other than "Print", this is a finding. The default is for the "Everyone" group to be given "Print" permission. "All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts.

Check Text ( C-26527r465410_chk )

Open "Devices and Printers".

If there are no printers configured, this is NA. (Exclude Microsoft Print to PDF and Microsoft XPS Document Writer, which do not support sharing.)

For each printer:

Right-click on the printer.

Select "Printer Properties".

Select the "Sharing" tab.

If "Share this printer" is checked, select the "Security" tab.

If any standard user accounts or groups have permissions other than "Print", this is a finding.

The default is for the "Everyone" group to be given "Print" permission.

"All APPLICATION PACKAGES" and "CREATOR OWNER" are not standard user accounts.

Fix Text (F-26515r465411_fix)
Configure the permissions on shared printers to restrict standard users to only have Print permissions.