Skip to main content
Version: 2.2.1-preview

AD-PRINT-01 - Printer total count should be retrievable

Michael SouleMerill Fernando
Contributed by Michael Soule with Merill FernandoAll contributors →

Overview​

Published printers in Active Directory provide visibility into your organization's printing infrastructure. While printers themselves may not seem like a security concern, they present several security considerations:

  • Information disclosure: Printer names and locations may reveal organizational structure
  • Access control: Published printers may be accessible to unintended users
  • Driver vulnerabilities: Printer drivers can be a vector for attacks
  • Document security: Print jobs may contain sensitive information
  • Network exposure: Printers may be accessible from unauthorized network segments

Understanding your printer publishing configuration helps:

  • Audit exposure: Identify what printer information is publicly available
  • Access review: Ensure printers are only accessible to appropriate users
  • Documentation: Maintain accurate inventory of printing resources
  • Compliance: Some regulations require tracking of printing infrastructure

Security Recommendation​

Secure your printing infrastructure:

  • Minimize publishing: Only publish printers that need to be discoverable
  • Location data: Review printer location information for sensitive details
  • Access controls: Restrict printer access using security groups
  • Secure printing: Implement pull printing or secure release solutions
  • Regular audits: Periodically review published printers for unauthorized additions

How the Test Works​

This test queries Active Directory for printQueue objects to count published printers and provide details about printer publishing in the domain.

  • Test-MtAdOuEmptyCount - Identify empty OUs that may contain legacy printer objects
  • Test-MtAdGroupDistributionCount - Review groups that may control printer access

Test Metadata​

FieldValue
Test IDAD-PRINT-01
SeverityInfo
SuiteActive Directory
CategoryAD.Printer
PowerShell testTest-MtAdPrinterTotalCount
TagsAD, AD-PRINT-01, AD.Printer

Source​

  • Pester test: tests/ad/printer/Test-MtAdPrinterTotalCount.Tests.ps1
  • PowerShell source: powershell/public/ad/printer/Test-MtAdPrinterTotalCount.ps1