Printer total count should be retrievable
AD-PRINT-01InfoActive DirectoryPrinters
Part of Active Directory · Active Directory · Printers · All checks
Invoke-Maester -TestId AD-PRINT-01Overview
Section titled “Overview”Published printers in Active Directory provide visibility into your organization’s printing infrastructure. While printers themselves may not seem like a security concern, they present several security considerations:
- Information disclosure: Printer names and locations may reveal organizational structure
- Access control: Published printers may be accessible to unintended users
- Driver vulnerabilities: Printer drivers can be a vector for attacks
- Document security: Print jobs may contain sensitive information
- Network exposure: Printers may be accessible from unauthorized network segments
Understanding your printer publishing configuration helps:
- Audit exposure: Identify what printer information is publicly available
- Access review: Ensure printers are only accessible to appropriate users
- Documentation: Maintain accurate inventory of printing resources
- Compliance: Some regulations require tracking of printing infrastructure
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Secure your printing infrastructure:
- Minimize publishing: Only publish printers that need to be discoverable
- Location data: Review printer location information for sensitive details
- Access controls: Restrict printer access using security groups
- Secure printing: Implement pull printing or secure release solutions
- Regular audits: Periodically review published printers for unauthorized additions
How the Test Works
Section titled “How the Test Works”This test queries Active Directory for printQueue objects to count published printers and provide details about printer publishing in the domain.
Related Tests
Section titled “Related Tests”Test-MtAdOuEmptyCount- Identify empty OUs that may contain legacy printer objectsTest-MtAdGroupDistributionCount- Review groups that may control printer access
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-PRINT-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Printers |
| Area | Infrastructure hardening |
| Resource type | Tenant |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdPrinterTotalCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:printQueue:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/printer/Test.AD-PRINT-01.ps1 - Documentation:
tests/ad/printer/Test.AD-PRINT-01.md