Server 2012 R2 Print Server (spoolsv.exe) tries to connect to clients port 445

Question

Dear all,

i have recently seen some strange rise in connections from our print servers to clients which have respective printers installed from the print server.
Print server tries to connect to the clients port 445, though we currently block incoming to 445 due to security requierements.
I understand the other way round - from the client to the print server, but not from the print server to the client.
We can reproduce the issue when printing - though also see it randomly when not printing at all.

I was checking the print server with process monitor and disovered the following operations when there is an connection attempt to the client:

Operation: Create File
Process Name: spoolsv.exe
Path: \HostFQDN\pipe\spoolss
Desired Access: Generic Read/Write

Any print server Pros out there who can explain this behaviour?

Thanks a lot,

best regards

Answer 1

It attempts to perform a Printer Spooler Remote Protocol (MS-PAR) operation.