ITS Hosted Print Services are now being enabled.

Please review the following as several changes have occurred that may impact you.

In response to the Microsoft Critical Vulnerability CVE-2021-34527 (associated with CVE-2021-1675, also known as “PrintNightmare”) in the Windows Print Spooler, IT Services had disabled printing services hosted by IT Services and on some end users device on Wednesday June 30th. Corrective measures have now been put in place that allow printing services to be re-enabled on devices that have received patches and updates.
Prior to printing, review the following information to ensure that you will have a patched machine and that you are printing to the correct print server.

If your department has a dedicated print server, contact your departmental IT group for an update on printing in your department.

Print Server Change:
Printing has been enabled on the print server qu-print-prd.ad.queensu.ca.
If you are currently printing to a printer hosted on its-print.ad.queensu.ca, your printer will need to be remapped to the print server qu-print-prd.ad.queensu.ca. IT Services will post instructions on the steps to re-map your printer hosted on its-print.ad.queensu.ca in the coming days. If you are familiar with adding a network printer to your device, you can manually re-add the printer from qu-print-prd.ad.queensu.ca
If you are located on campus and need to print urgently, please contact the IT Help Desk and they will assist you in mapping your computer to the print server qu-print-prd.ad.queensu.ca

Patching of your Machine:
Before printing, users need to ensure that their systems are patched as per the recent Microsoft advisory found here. CVE-2021-34527 - Security Update Guide - Microsoft - Windows Print Spooler Remote Code Execution Vulnerability
Updates will be automatically pushed to your computer from Microsoft and/or IT Services, however users are requested to ensure they apply these updates in a timely fashion.
You can manually check for updates by completing the following steps:

1. Click on Windows Start Button located at bottom left of your desktop.


2. Search for and open Windows Update.


3. Once the updates screen appears, click on “Check for Updates” and click on “Check online for Updates from Microsoft Update” if your updates show the message “Some settings are managed by your organization”.


4. Accept and apply Windows updates when prompted.

Steps taken to Address the Vulnerability on End User Devices:
Devices managed by Queen’s and which were reachable, had the print spooler disabled when the vulnerability was first being addressed. IT Services has since pushed an update to re-enable your print spooler. This update may take a few hours to be installed after your computer is joined to the network. In addition to enabling the print spooler, this update includes a setting change that will protect Windows based computers from being vulnerable until a full patch is available from Microsoft. The setting that has been changed is “Allow Print Spooler to accept client connections” and it has been set to disabled. This change will also prevent end user devices from sharing their locally attached printer to others on their immediate network.

Protect your System:
All devices accessing Queen’s services should be enrolled in Intune to ensure the device is protected when vulnerabilities occur. If your device is not registered in Intune, it may still be vulnerable. Please visit this site to learn more and to register your device in Intune. Endpoint Protection | ITS (queensu.ca) AD joined computers are automatically registered in Intune and no steps are required.

Need More Help:
If you are still having trouble printing, please contact the IT Support Centre Help Desk.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Previous Description (July 5, 2021 21:21):

Printing services continue to be disabled for many areas. IT Services will provide regular updates to this notice as printing services are brought back online and/or as workarounds are made available.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Previous Description (June 30, 2021 21:41):

IT Services has temporarily disabled all windows print services on centrally managed servers. Users may be unable to print to campus printers or from terminal services. Print services will continue to be disabled until next week.