Notification

Icon
Error

Stop Print Spooler Service

Posted: Friday, July 16, 2021 2:43:23 PM(UTC)
Esben.D

Esben.D

Member Administration Original PosterPosts: 2,084
0
Like
Hi everyone, to help with the new Print spooler vulnerability, I created a quick deployment package to stop the Print spooler service and change the start mode. You can use it in combination with the following report:

Code:
Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
tblAssetCustom.Manufacturer,
tblAssetCustom.Model,
tsysOS.OSname As OS,
Case
When tblComputerSystem.Domainrole > 1 Then 'Server'
Else 'Workstation'
End As [Workstation/Server],
tblServicesUni.Caption As [Service Name],
tblServicesUni.Pathname As [Service Path],
tblServiceStartMode.StartMode As [Service Start Mode],
tblServiceState.State As [Service State],
Case
When tblErrors.ErrorText Is Not Null Or
tblErrors.ErrorText != '' Then
'Scanning Error: ' + tsysasseterrortypes.ErrorMsg
Else ''
End As ScanningErrors,
ServiceLastScanned.ServicesLastScanned,
tblAssets.Lastseen,
tblAssets.Lasttried
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Inner Join tblState On tblState.State = tblAssetCustom.State
Inner Join tblComputerSystem On tblComputerSystem.AssetID = tblAssets.AssetID
Inner Join tblServices On tblServices.AssetID = tblAssets.AssetID
Inner Join tblServicesUni On tblServicesUni.ServiceuniqueID =
tblServices.ServiceuniqueID
Inner Join tblServiceStartMode On tblServiceStartMode.StartID =
tblServices.StartID
Inner Join tblServiceState On tblServiceState.StateID = tblServices.StateID
Inner Join tblDomainRoles On tblDomainRoles.Domainrole =
tblComputerSystem.Domainrole
Left Join (Select Distinct Top 1000000 TsysLastscan.AssetID As ID,
TsysLastscan.Lasttime As ServicesLastScanned
From TsysWaittime
Inner Join TsysLastscan On TsysWaittime.CFGCode = TsysLastscan.CFGcode
Where TsysWaittime.CFGname = 'SERVICES') As ServiceLastScanned On
tblAssets.AssetID = ServiceLastScanned.ID
Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID,
Max(tblErrors.Teller) As ErrorID
From tblErrors
Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID =
ScanningError.ID
Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller
Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype =
tblErrors.ErrorType
Where (tblServicesUni.Pathname Like '%spoolsv%' And tblState.Statename = 'Active' and tblServiceState.State = 'Running') or (tblServicesUni.Pathname Like '%spoolsv%' And tblState.Statename = 'Active' and (tblServiceStartMode.StartMode != 'Disabled' and tblServiceStartMode.StartMode != 'Manual'))
Order By tblAssets.Domain,
tblAssets.AssetName
Disable Print Spooler ServiceDownload Package
DescriptionThis package will stop the Print Spooler service and change the statup type to manual.
Final ActionNothing
Max. Duration2 min(s), 0 hour(s)
RescanYes
Steps
1. Stop Print Spooler Service
TypeCommand
Return Codes 0,1641,3010
SuccessGo To Next
FailureGo To Next
Command net stop "spooler"
2. Change Startup type to Manual
TypeCommand
Return Codes 0,1641,3010
SuccessStop (Success)
FailureStop (Failure)
Command sc config spooler start=demand

Active Discussions

Lansweeper Marking/Flagging VIP Customers
by  C Johnson   Go to last post Go to first unread
Last post: Yesterday at 11:43:22 PM(UTC)
Lansweeper Office 2016 key scanning
by  WaldoIT  
Go to last post Go to first unread
Last post: Yesterday at 3:40:41 PM(UTC)
Lansweeper Configuring SSL in IIS Express issue
by  saffo   Go to last post Go to first unread
Last post: Yesterday at 9:57:31 AM(UTC)
Lansweeper MDM Jamf School
by  Eugene  
Go to last post Go to first unread
Last post: 12/3/2021 6:21:44 PM(UTC)
Lansweeper HTTPS not secure
by  Luke Maslany   Go to last post Go to first unread
Last post: 12/3/2021 2:23:28 PM(UTC)
Lansweeper Problem with deploy software
by  Max90  
Go to last post Go to first unread
Last post: 12/3/2021 2:04:12 PM(UTC)
Lansweeper scanning target by range
by  Colombini   Go to last post Go to first unread
Last post: 12/3/2021 12:06:19 PM(UTC)
Lansweeper Log WIFI networks
by  BastiOn  
Go to last post Go to first unread
Last post: 12/3/2021 10:29:38 AM(UTC)