Notification

Icon
Error

Stop Print Spooler Service

Posted: Friday, July 16, 2021 2:43:23 PM(UTC)
Esben.D

Esben.D

Member Administration Original PosterPosts: 2,058
0
Like
Hi everyone, to help with the new Print spooler vulnerability, I created a quick deployment package to stop the Print spooler service and change the start mode. You can use it in combination with the following report:

Code:
Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
tblAssetCustom.Manufacturer,
tblAssetCustom.Model,
tsysOS.OSname As OS,
Case
When tblComputerSystem.Domainrole > 1 Then 'Server'
Else 'Workstation'
End As [Workstation/Server],
tblServicesUni.Caption As [Service Name],
tblServicesUni.Pathname As [Service Path],
tblServiceStartMode.StartMode As [Service Start Mode],
tblServiceState.State As [Service State],
Case
When tblErrors.ErrorText Is Not Null Or
tblErrors.ErrorText != '' Then
'Scanning Error: ' + tsysasseterrortypes.ErrorMsg
Else ''
End As ScanningErrors,
ServiceLastScanned.ServicesLastScanned,
tblAssets.Lastseen,
tblAssets.Lasttried
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
Inner Join tblState On tblState.State = tblAssetCustom.State
Inner Join tblComputerSystem On tblComputerSystem.AssetID = tblAssets.AssetID
Inner Join tblServices On tblServices.AssetID = tblAssets.AssetID
Inner Join tblServicesUni On tblServicesUni.ServiceuniqueID =
tblServices.ServiceuniqueID
Inner Join tblServiceStartMode On tblServiceStartMode.StartID =
tblServices.StartID
Inner Join tblServiceState On tblServiceState.StateID = tblServices.StateID
Inner Join tblDomainRoles On tblDomainRoles.Domainrole =
tblComputerSystem.Domainrole
Left Join (Select Distinct Top 1000000 TsysLastscan.AssetID As ID,
TsysLastscan.Lasttime As ServicesLastScanned
From TsysWaittime
Inner Join TsysLastscan On TsysWaittime.CFGCode = TsysLastscan.CFGcode
Where TsysWaittime.CFGname = 'SERVICES') As ServiceLastScanned On
tblAssets.AssetID = ServiceLastScanned.ID
Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID,
Max(tblErrors.Teller) As ErrorID
From tblErrors
Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID =
ScanningError.ID
Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller
Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype =
tblErrors.ErrorType
Where (tblServicesUni.Pathname Like '%spoolsv%' And tblState.Statename = 'Active' and tblServiceState.State = 'Running') or (tblServicesUni.Pathname Like '%spoolsv%' And tblState.Statename = 'Active' and (tblServiceStartMode.StartMode != 'Disabled' and tblServiceStartMode.StartMode != 'Manual'))
Order By tblAssets.Domain,
tblAssets.AssetName
Disable Print Spooler ServiceDownload Package
DescriptionThis package will stop the Print Spooler service and change the statup type to manual.
Final ActionNothing
Max. Duration2 min(s), 0 hour(s)
RescanYes
Steps
1. Stop Print Spooler Service
TypeCommand
Return Codes 0,1641,3010
SuccessGo To Next
FailureGo To Next
Command net stop "spooler"
2. Change Startup type to Manual
TypeCommand
Return Codes 0,1641,3010
SuccessStop (Success)
FailureStop (Failure)
Command sc config spooler start=demand

Active Discussions

Lansweeper Layer 3 network devices only report
by  dri   Go to last post Go to first unread
Last post: 9/22/2021 6:24:05 PM(UTC)
Lansweeper VMware vCenter Server File Upload Vulnerability
by  Esben.D  
Go to last post Go to first unread
Last post: 9/22/2021 4:18:21 PM(UTC)
Lansweeper Windows Thin PC EOL
by  Esben.D  
Go to last post Go to first unread
Last post: 9/21/2021 1:30:44 PM(UTC)
Lansweeper History of relationship between pc and monitor
by  hfaddy  
Go to last post Go to first unread
Last post: 9/17/2021 1:44:38 PM(UTC)
Lansweeper New Hire Login Request Report
by  Scott Davis   Go to last post Go to first unread
Last post: 9/16/2021 7:16:46 PM(UTC)
Lansweeper SCCM end of life
by  Esben.D  
Go to last post Go to first unread
Last post: 9/16/2021 2:56:23 PM(UTC)