• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

TweakHound

Computer stuff...

  • Home
  • Windows XP
  • Windows Vista
  • Windows 7
  • Windows 8
  • Windows 10
  • Linux
  • Tweak Guides
  • Site Info
    • About
    • About Me
    • TweakHound’s World
    • Contact
    • My Computers
    • Old Articles
    • Privacy Policy
    • Old Index
    • Advanced Search

Latest Windows Vulnerabilities

July 21, 2021, 10:29(EDT) By Eric (a.k.a. TweakHound)

I don’t get into Windows vulnerability issues much here. I find it boring reading, the severity of these issues is often overblown (like everything else), and I used to get paid to protect systems from this stuff. If you like to keep up with such things I recommend BleepingComputer.
Anyway, below are the latest vulnerabilities. The fixes involve you not being able to print (at least remotely), and deleting System Restore points and Shadow volumes and stopping the ability to create them.

CVE-2021-36934 Windows Elevation of Privilege Vulnerability
Workarounds
This is known as the HiveNightmare Vulnerability.
Restrict access to the contents of %windir%\system32\config
1. Open Command Prompt or Windows PowerShell as an administrator.
2. Run this command: icacls %windir%\system32\config\*.* /inheritance:e
Delete Volume Shadow Copy Service (VSS) shadow copies
1. Delete any System Restore points and Shadow volumes that existed prior to restricting access to %windir%\system32\config.
2. Create a new System Restore point (if desired).
Impact of workaround Deleting shadow copies could impact restore operations, including the ability to restore data with third-party backup applications.
Note You must restrict access and delete shadow copies to prevent exploitation of this vulnerability.

CVE-2021-34527 Windows Print Spooler Remote Code Execution Vulnerability
Workarounds
Determine if the Print Spooler service is running
Run the following in Windows PowerShell:
Get-Service -Name Spooler
If the Print Spooler is running or if the service is not set to disabled, select one of the following options to either disable the Print Spooler service, or to Disable inbound remote printing through Group Policy:
Option 1 – Disable the Print Spooler service
If disabling the Print Spooler service is appropriate for your enterprise, use the following PowerShell commands:
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
Impact of workaround Disabling the Print Spooler service disables the ability to print both locally and remotely.
Option 2 – Disable inbound remote printing through Group Policy
You can also configure the settings via Group Policy as follows:
Computer Configuration / Administrative Templates / Printers
Disable the “Allow Print Spooler to accept client connections:” policy to block remote attacks.
You must restart the Print Spooler service for the group policy to take effect.
Impact of workaround This policy will block the remote attack vector by preventing inbound remote printing operations. The system will no longer function as a print server, but local printing to a directly attached device will still be possible.

Tagged With: Security

Reader Interactions

Comments

  1. Sue Ragan says

    July 22, 2021, 06:46(EDT) at 06:46

    Thanks so much for your tip about “disabling inbound remote through Group Policy”, Option 2, in order to deal with the ‘Windows Print Spooler Remote Execution’ problem. I had already turned off ‘Print Spooler’, but felt I needed more security. Your tip helped to nudge me into finding a way to get Group Policy onto my Windows 7 system, while avoiding downloading a 3rd party piece of software. I found a video instructing how to use files already on my own system and using them to open up Group Policy. And it worked! And so, through your instructions, I got Group Policy, and I disabled remote printing. It was amazing! And thanks again very much.

Primary Sidebar

Popular Posts

Tweaking Windows 10

Software I Use – 2021 Edition

Timer Tweaks Benchmarked

Win10 – Get Auto-Login Back

Recent Posts

  • Wise Disk Cleaner 11.2.4
  • Patch Tuesday
  • Patch Tuesday
  • Monday News
  • BleachBit 5.0.0
  • Saturday News
  • Patch Tuesday
  • Weekend News
  • New Graphics Drivers
  • RIP Woody Leonhard
buywin10th2

Tags

  • Android
  • Backup
  • Beer
  • Computer Hardware
  • Computer News
  • Cool Tools
  • Freeware
  • How-To's
  • Linux
  • Off Topic
  • openSUSE
  • Playlists
  • Privacy
  • Security
  • Software
  • This Site
  • vacation
  • Veterans
  • Windows 10
  • Windows 11
  • Windows 7
  • Windows 8
  • Windows Vista
  • Windows XP

Catagories

  • Android
  • Backup
  • Beer
  • Computer Hardware
  • Computer News
  • Cool Tools
  • Freeware
  • Freeware Machines
  • How-To's
  • Linux
  • News From The Web
  • Off Topic
  • openSUSE
  • Privacy
  • Security
  • Software
  • Tweak Guides
  • Veterans
  • Windows
  • Windows 10
  • Windows 11
  • Windows 7
  • Windows 8
  • Windows Vista
  • Windows XP

TweakHound - Optimize Your Computing Experience! TweakHound - Optimize Your Computing Experience!

Copyright 2002-2025 by Eric Vaughan All material contain here is the property of the materials owner. Windows, Windows XP, Windows Vista, Windows Seven, Windows 8, Windows 10, Windows 11, Microsoft, and all associated logos are trademarks/property of Microsoft. You may not use or copy any material from tweakhound.com without expressed written permission. Hotlinking to any material within this site is forbidden. Privacy Policy