The Nessus finding “Windows PrintNightmare Registry Exposure” means a Windows host has Point and Print policy values that let users install printer drivers with no warning or elevation prompt, which keeps PrintNightmare (CVE-2021-34527) exploitable even after patching. The printnightmare registry fix: install current updates, set NoWarningNoElevationOnInstall and UpdatePromptSettings to 0 (or delete them), and set RestrictDriverInstallationToAdministrators to 1.

What the scanner is actually detecting

The finding appears in Nessus as Windows PrintNightmare Registry Exposure CVE-2021-34527 OOB Security Update RCE (July 2021), plugin ID 151488, in the Windows : Microsoft Bulletins family. It is a local check, so it only runs in a credentialed scan (or through a Nessus Agent). The plugin reads the Point and Print policy key and flags insecure values for:

HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrintNoWarningNoElevationOnInstall
HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrintUpdatePromptSettings

Microsoft’s guidance is that both values must be 0 or not defined. They do not exist on a default install, so if the scanner found them, something wrote them: almost always a Group Policy, a Group Policy Preferences registry item, a login script or a golden image. That is why patching alone does not close this finding. The July 2021 out-of-band update fixed the spooler code, but Microsoft stated that every post-patch exploit it investigated relied on insecure Point and Print settings.

Tenable checks the third value, RestrictDriverInstallationToAdministrators, separately in plugin 158243 (severity Info), whose solution is to set that DWORD to 1. If both findings appear on a host, fix them together.

Real-world risk

CVE-2021-34527 is a Print Spooler remote code execution flaw that lets an authenticated attacker run code as SYSTEM. Microsoft’s Security Update Guide marks it as publicly disclosed and exploited, and it is listed in CISA’s Known Exploited Vulnerabilities catalog (see our guide to the CISA KEV catalog for what that listing means for your patch deadlines).

Stated honestly: an attacker needs valid domain credentials or a foothold on a machine first. With these values set, the patched spooler still lets any authenticated user, local or remote over RPC, install a driver on this host, which gives remote code execution as SYSTEM. It is not only a privilege-escalation step. A standard user who connects to a malicious print server can also get an attacker-supplied driver installed with no prompt. On a fully patched host with the default (undefined) values, the public PrintNightmare exploits do not work. So this is not an internet-facing emergency on its own, but it deserves priority on domain controllers, servers, terminal servers and shared workstations with a running spooler.

How to confirm it on the host

Check the three Point and Print values from an elevated prompt:

reg query "HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint"

Or in PowerShell:

Get-ItemProperty -Path 'HKLM:SOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint' -ErrorAction SilentlyContinue |
  Select-Object NoWarningNoElevationOnInstall, UpdatePromptSettings, RestrictDriverInstallationToAdministrators

Any value other than 0 for the first two, or 0 for the third, is the exposure. On a healthy host the key often does not exist at all, so reg query returns an error and the PowerShell command returns nothing. Missing values are the secure default (for RestrictDriverInstallationToAdministrators, undefined behaves as 1 on systems with the August 2021 or later updates). Next, check whether the spooler is running and how it starts:

Get-Service -Name Spooler | Select-Object Name, Status, StartType

The StartType property depends on .NET Framework 4.6.1 or later (surfaced by default from PowerShell 5). If the column is empty, for example on an unpatched Server 2012 R2 with PowerShell 4.0, use Get-CimInstance Win32_Service instead:

Get-CimInstance Win32_Service -Filter "Name='Spooler'" | Select-Object Name, State, StartMode

Finally, find out who is writing the values. Because the key sits under Policies, a local edit will be overwritten at the next policy refresh if a GPO owns it. From an elevated PowerShell prompt (needed for the computer section), generate a policy report and search it for “Point and Print”:

gpresult /scope computer /h "$env:TEMPgpresult.html" /f

How to fix it

Step 1: install current updates

Install the July 2021 out-of-band security update or any later cumulative update or monthly rollup for the OS. Updates from August 10, 2021 onward also change the default so that only administrators can install printer drivers through Point and Print. On print servers, check client patch levels first; the patch-order note under “What can break” explains why.

Step 2 (domain-joined hosts): fix the GPO

In Group Policy Management, edit the GPO that sets the values and go to Computer Configuration > Policies > Administrative Templates > Printers > Point and Print Restrictions. For point and print restrictions GPO PrintNightmare hardening, set it to Enabled and choose:

When installing drivers for a new connection: Show warning and elevation prompt
When updating drivers for an existing connection: Show warning and elevation prompt

Optionally tick Users can only point and print to these servers and list your print server FQDNs, separated by semicolons. Do not set the policy to Disabled: Microsoft documents that this removes the warnings and elevation prompts entirely. Many pre-2021 print deployments set “Do not show warning or elevation prompt” so users could add printers without admin rights.

In the same folder, on systems with updates from October 12, 2021 or later, enable Limits print driver installation to Administrators. That writes RestrictDriverInstallationToAdministrators = 1. If the setting is missing in GPMC, update the PolicyDefinitions central store with current Windows ADMX templates (the setting lives in Printing.admx). Alternatively, deploy the value through Group Policy Preferences > Registry: key HKLMSoftwarePoliciesMicrosoftWindows NTPrintersPointAndPrint, value RestrictDriverInstallationToAdministrators, REG_DWORD 1. If the values keep coming back after you change the GPO, check for a higher-precedence GPO or an enforced link; our write-up on why a GPO is not applying covers the usual causes.

Step 2 (standalone or non-GPO hosts): set the registry directly

This is the cve-2021-34527 mitigation registry change, run from an elevated command prompt:

reg add "HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint" /v NoWarningNoElevationOnInstall /t REG_DWORD /d 0 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint" /v UpdatePromptSettings /t REG_DWORD /d 0 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint" /v RestrictDriverInstallationToAdministrators /t REG_DWORD /d 1 /f

Deleting the first two values is equally valid, since “not defined” is the secure default:

reg delete "HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint" /v NoWarningNoElevationOnInstall /f
reg delete "HKLMSOFTWAREPoliciesMicrosoftWindows NTPrintersPointAndPrint" /v UpdatePromptSettings /f

Microsoft states that these policy and registry changes need no restart of the device or the spooler, and that no combination of other mitigations is equivalent to setting RestrictDriverInstallationToAdministrators to 1, so treat that value as the core control.

Step 3: disable the spooler where nothing prints

To disable the print spooler on a domain controller or any server that does not print, use the commands from Microsoft’s CVE-2021-34527 advisory:

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

For all domain controllers at once, link a GPO to the Domain Controllers OU and set Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Print Spooler to Disabled. The GPO changes only the startup type; a spooler that is already running keeps running. Also stop the service on each DC, for example remotely, then check it with verification step 3 below:

Invoke-Command -ComputerName DC01, DC02 -ScriptBlock { Stop-Service -Name Spooler -Force }

Microsoft’s Defender for Identity guidance recommends exactly this for domain controllers and Active Directory admin systems. The same step belongs in any baseline such as our Windows Server hardening checklist. Where a server must keep printing locally but should not accept remote print traffic, Microsoft’s alternative is to disable Allow Print Spooler to accept client connections under Computer Configuration > Administrative Templates > Printers and then restart the spooler.

How to verify the fix and rescan

On domain-joined hosts, run gpupdate /force so the corrected GPO is applied before you test.
Re-run the reg query command above and confirm NoWarningNoElevationOnInstall and UpdatePromptSettings are 0 or absent, and RestrictDriverInstallationToAdministrators is 1.
On servers where you disabled the spooler, rerun the Get-Service (or Get-CimInstance) check above and confirm Stopped and Disabled. For DCs, run it remotely: Invoke-Command -ComputerName DC01, DC02 -ScriptBlock { Get-Service Spooler | Select-Object Status, StartType }.
Run a credentialed Nessus scan against the host. For nessus 151488 remediation to show as closed, the scan must authenticate and read the registry; an uncredentialed scan will simply not report the plugin, which proves nothing.

What can break and how to roll back

The main side effect is printer deployment. With RestrictDriverInstallationToAdministrators = 1, a standard user who maps a queue whose driver is not already on the machine will be prompted for administrator credentials, and GPO-deployed printers can fail to install for non-admins. Microsoft documents these options when the value is 1 or undefined:

A standard user supplies administrator credentials when prompted.
The required drivers are pre-installed through the OS image or your software deployment tool, so connecting to a printer does not trigger a driver install.
As a temporary last resort, set RestrictDriverInstallationToAdministrators to 0. Microsoft says this makes devices vulnerable, so treat it only as a stopgap.

Patch order matters too. Before you patch print servers to updates released September 14, 2021 or later, make sure every print client has at least an update released January 12, 2021 or later (KB5005652, Q2). Otherwise those clients will not be able to print.

Rolling back the registry change is the same reg add command with the old values, or reverting the GPO; no restart is needed. Restoring non-zero NoWarningNoElevationOnInstall or UpdatePromptSettings values reopens CVE-2021-34527 and the Nessus finding. Use it only as a short-lived stopgap, and prefer pre-staging drivers or an admin-credential prompt instead. If disabling the spooler breaks something (for example, a server that turns out to print reports), re-enable it with:

Set-Service -Name Spooler -StartupType Automatic
Start-Service -Name Spooler

On domain controllers, the spooler also prunes stale printer objects from Active Directory, so with it disabled, plan to prune them periodically.

Common false positive reasons

The GPO wins the race. You fixed the registry locally, but a GPO or Group Policy Preferences item rewrote it before the scan ran. The finding is accurate; fix the source.
Stale scan data. The host was remediated after the scan that raised the finding. Rescan before escalating.
Spooler disabled but values still present. The plugin description references only the registry values, so disabling the spooler alone may not clear the finding. Set the values as well.
RestrictDriverInstallationToAdministrators is already 1. Microsoft says a value of 1 overrides all Point and Print Restrictions settings, so real exposure is minimal, but plugin 151488 still flags the two values and MSRC still asks for them to be 0 or undefined. Set them to close the finding.

FAQ

Does installing the July 2021 update fix Nessus 151488?

Not by itself. Microsoft says you must also confirm the Point and Print values are 0 or not defined, and the plugin checks exactly those values.

Should I set NoWarningNoElevationOnInstall to 0 or delete it?

Either is secure. Microsoft lists “0 (DWORD) or not defined” as the default, safe state. Setting 0 explicitly through a GPO makes the intent visible to auditors.

Tracking this finding across many hosts

On a large Windows estate the hard part is proving every host stayed fixed after the next GPO change. If you use SITEY, you can upload the .nessus export to track this finding per host, have AI draft a host-specific registry fix that runs only after human approval through its agents on Windows endpoints, and use per-finding Nessus retest to confirm closure.

Discovery and visibility

Scanning and collection

The AI layer

Action and closure

Team and governance

Reporting

PrintNightmare Registry Fix: Remediating Nessus 151488 (Point and Print Exposure)