A city finds Print Spooler-related remote capabilities still enabled on domain controllers contrary to hardening guidance. How should that be framed?
Select an answer to reveal the explanation.
Short Explanation
Domain controllers should travel light — every extra service is another door on the vault. Spooler-style roles on DCs have a history of widening that door. Strip optional services; leave identity work to the DC.
Full Explanation
Domain controllers should run the minimum roles and services required for directory and authentication duties. Print Spooler-related remote capabilities left enabled on city DCs contrary to hardening guidance enlarge attack surface on the identity plane that underpins municipal authentication. Framing should emphasize unnecessary optional services on DCs, not printer convenience.
Print services on DCs do not improve authentication performance in a way that justifies the added risk. Spooler findings are not irrelevant merely because printers are not “identity assets”—the issue is exposing DCs to extra remote attack surface. Remote print features are not required for Group Policy user settings to apply.
Exam caveat: hardening guidance for DCs repeatedly pushes minimizing non-essential roles; map findings to attack-surface reduction rather than a single CVE name unless exploited in-scope. CPTS AD reporting should prefer clear service-minimization recommendations.
Operational check: confirm spooler/remote print related services and known hardening baselines on each DC, disable or constrain per municipal change control, and verify authentication and GPO still function for civic workloads after the change.