Disabling Unnecessary Services (Print Spooler, SMBv1, RDP lockdown)

#The Print Spooler Is Not a Print Service—It's a Kernel Exploit Waiting to Happen#link

Between 2021 and 2023, vulnerabilities in the Windows Print Spooler (CVE-2021-34527, CVE-2022-22718) provided domain admin privileges to attackers on patched systems. The root issue: unnecessary services running by default on servers that never touch a printer. This lesson provides a definitive methodology to identify, disable, and harden Windows services—including SMBv1, RDP, and Windows Search—to eliminate entire classes of attacks.

The Service Disabling Methodology

1. Inventory all running services with Get-Service | Where-Object {$_.Status -eq 'Running'}. 2. Map each service to the server's role: a web server does not need Print Spooler or Server service. 3. Set unnecessary services to Disabled via sc config or Group Policy. 4. Test application functionality thoroughly; some applications have hidden dependencies. 5. Document the disabled services in the baseline image for audit traceability.

# List all running services and export to CSV
Get-Service | Where-Object {$_.Status -eq "Running"} | Select Name, DisplayName, StartType | Export-Csv -Path services.csv -NoTypeInformation
# Disable a service
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

This approach stops the service immediately and prevents it from restarting on next boot. The CSV provides an audit trail.

High-Risk Services to Target First

Print Spooler (Spooler), SMBv1 (disabled via Features or registry), Remote Registry (RemoteRegistry), Windows Search (WSearch), and XPS Services are top candidates for servers. Also consider disabling the Server service (LanmanServer) on a purely client machine—this removes the ability to share folders, closing an entire attack vector. Each disabled service reduces the attack surface and frees up resources.

RDP Lockdown: Not Just a Service Toggle

Disabling the Remote Desktop Services service (TermService) is the ultimate RDP lockout, but if RDP is required, enforce Network Level Authentication (NLA), set an account lockout policy, and use RDP gateways or VPNs instead of directly exposing 3389. Additionally, restrict the 'Remote Desktop Users' group and set interactive logon timeouts.

• ▪Create a role-based service baseline: disable services not needed for each server role.
• ▪Stop and disable SMBv1, Print Spooler, Remote Registry, and Windows Search on all non-essential servers.
• ▪Disable the Server service on client-only machines.
• ▪For servers requiring RDP, enforce NLA and restrict user access.