AD-PRINT-01: Printer total count should be retrievable
| ID | AD-PRINT-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Printers |
| Security area | Infrastructure hardening |
| Resource type | Tenant |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Published printers in Active Directory provide visibility into your organization’s printing infrastructure. While printers themselves may not seem like a security concern, they present several security considerations:
- Information disclosure: Printer names and locations may reveal organizational structure
- Access control: Published printers may be accessible to unintended users
- Driver vulnerabilities: Printer drivers can be a vector for attacks
- Document security: Print jobs may contain sensitive information
- Network exposure: Printers may be accessible from unauthorized network segments
Understanding your printer publishing configuration helps:
- Audit exposure: Identify what printer information is publicly available
- Access review: Ensure printers are only accessible to appropriate users
- Documentation: Maintain accurate inventory of printing resources
- Compliance: Some regulations require tracking of printing infrastructure
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”Secure your printing infrastructure:
- Minimize publishing: Only publish printers that need to be discoverable
- Location data: Review printer location information for sensitive details
- Access controls: Restrict printer access using security groups
- Secure printing: Implement pull printing or secure release solutions
- Regular audits: Periodically review published printers for unauthorized additions
How the Test Works
Section titled “How the Test Works”This test queries Active Directory for printQueue objects to count published printers and provide details about printer publishing in the domain.
Related Tests
Section titled “Related Tests”Test-MtAdOuEmptyCount- Identify empty OUs that may contain legacy printer objectsTest-MtAdGroupDistributionCount- Review groups that may control printer access
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.