ADPRIV-007: Print Operators Enumeration
- Platform
- Active Directory
- Category
- AD Privileged Account Security
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The check binds to the Builtin container and reads the Print Operators object by well-known SID (S-1-5-32-550). It enumerates the member attribute (and recursively expands nested group members), then captures for each principal the sAMAccountName, objectClass, lastLogonTimestamp, userAccountControl, and primary group membership. The check also reads the group nTSecurityDescriptor to surface any non-default modify rights that could let an attacker add themselves to the group without already being a Domain Admin. A finding is raised when member count is greater than zero. The check additionally cross-references each member against the Domain Controllers OU and the Tier 0 asset list (if defined), since the privilege only matters on machines where the group has SeLoadDriverPrivilege, which by default is domain controllers. The Default Domain Controllers Policy is parsed for the SeLoadDriverPrivilege and SeShutdownPrivilege user-rights assignments to confirm that Print Operators still holds those rights (the group can be neutered by removing the rights even if membership remains).
Why it matters
Microsoft documents Print Operators as a Tier 0 group because the rights it carries (SeLoadDriverPrivilege on domain controllers, SeShutdownPrivilege, and the right to log on locally to DCs) collectively constitute domain dominance. SeLoadDriverPrivilege allows the holder to call NtLoadDriver and load an arbitrary kernel driver into the running operating system. Once a driver runs in kernel mode the attacker can read or modify LSASS memory, dump the NTDS.dit Active Directory database, register a SSP, or simply execute arbitrary code as SYSTEM on the domain controller. Public proof-of-concept loaders such as Capcom.sys, Dell DBUtil (CVE-2021-21551), Intel NAL (CVE-2021-3437), and many other bring-your-own-vulnerable-driver (BYOVD) primitives turn the privilege into instant kernel code execution. The blast radius is the entire forest. Print Operators is also abused as a stealthy persistence mechanism: defenders frequently audit Domain Admins, Enterprise Admins, and Administrators, but Print Operators is overlooked because it sounds operational rather than privileged. Several incident response engagements have surfaced adversary-added Print Operators members that survived for months. The group should be empty in every modern forest because Microsoft has not recommended hosting print services on domain controllers since Windows Server 2003, and PrintNightmare (CVE-2021-1675, CVE-2021-34527) made running the Print Spooler service on DCs an explicit anti-pattern.
Attack path
Step 1: Reconnaissance. The attacker, holding any authenticated foothold, queries the Builtin container for Print Operators membership: Get-ADGroupMember -Identity "Print Operators" or BloodHound MATCH p=(g:Group {objectid:"S-1-5-32-550"})<-[:MemberOf*1..]-(n) RETURN p. If they find a controllable principal (a user whose password they have, a service account whose ticket they can forge, or a machine account they control), they proceed. Step 2: Local logon to a DC. Print Operators carries the "Allow log on locally" right on domain controllers via the Default Domain Controllers Policy. The attacker uses RDP, console, or PsExec with the member account to land an interactive session on a DC. Network-only access is sufficient when combined with WMI or remote registry, but local logon makes driver loading trivial. Step 3: Driver load. The attacker selects a vulnerable signed driver (BYOVD), copies it to the DC, and calls NtLoadDriver via a small loader. Because SeLoadDriverPrivilege is held, the call succeeds without UAC or admin elevation. Public tooling includes KDMapper, EDRSandBlast loaders, and Stryker. The driver runs at ring 0. Step 4: SYSTEM execution. From kernel mode the attacker spawns a SYSTEM process, dumps LSASS, or reads the NTDS.dit file directly via raw NTFS access bypassing file locks. Credentials for krbtgt, every domain controller machine account, and every cached privileged account are now in attacker hands. Step 5: Golden ticket and persistence. With the krbtgt hash the attacker mints golden tickets, ensuring durable forest access independent of the Print Operators membership. The original Print Operators add is often removed at this point to reduce forensic signal.
How Guerrilla assesses it
Guerrilla resolves the Print Operators group by well-known SID (S-1-5-32-550) to avoid localization issues in non-English forests, then issues an LDAP query (objectClass=group)(objectSid=S-1-5-32-550) against the Builtin container. The member attribute is read with range retrieval to handle groups larger than the MaxValRange limit. For each member DN the check resolves the principal, captures objectClass, sAMAccountName, lastLogonTimestamp, pwdLastSet, and userAccountControl flags (ACCOUNTDISABLE, DONT_EXPIRE_PASSWORD), and recursively expands any nested groups. The check parses the Default Domain Controllers Policy GPO (GptTmpl.inf, Privilege Rights section) for SeLoadDriverPrivilege and SeShutdownPrivilege to confirm Print Operators still carries those rights. The nTSecurityDescriptor of the Print Operators object is parsed for non-default WriteProperty rights on the member attribute, since a delegated WriteMember right is equivalent to membership for attack purposes. Output includes member count, enabled vs. disabled split, last logon recency, and a flag indicating whether the Print Spooler service is also running on any DC (cross-referenced with ADPRIV checks for DC service hygiene).
Recommended value
Empty. Manage printers using dedicated print servers, not domain controllers
Remediation
Enumerate Print Operators membership using Get-ADGroupMember -Identity 'Print Operators'. Remove all members. Deploy print services on dedicated member servers rather than domain controllers. Restrict printer driver installation through Group Policy
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- AC-6(1), CM-7
- ANSSI
- R3
- CIS AD Benchmark
- 4.1.7
- MITRE ATT&CK
- T1547.012, T1078.002