Share via

I want to disable Print Spooler service from our Windows AD DC server

Joshi Omkar 0 Reputation points
2026-04-13T05:15:24.7566667+00:00

We are planning to stop the Print Spooler service from our AD DC server can you tell me I can do it using steps below or need different approach?

  1. Sign in on the Domain Controller
  2. Open Group Policy Management
  3. Right-click on the Domain Controllers OU
  4. Select Create a GPO in this domain, and Link it here…
  5. Name the GPO DisablePrintSpoolerService and click OK
  6. Right-click on the GPO and click Edit
  7. Navigate to Computer Configuration > Windows Settings > Security Settings > System Services
  8. Double-click on Print Spooler
  9. Select Define this policy setting
  10. Select Disabled
  11. Click OK
  12. Start Command Prompt on the Domain Controller
  13. Run the command below to apply the changes immediately

To summarize I will create a new GPO and configure it to disable Print Spooler service and assign it to Domain Controller OU.

Windows for business | Windows Server | Directory services | Deploy group policy objects

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Jason Nguyen Tran 19,225 Reputation points Independent Advisor
    2026-04-26T00:42:59.0866667+00:00

    Hi Joshi Omkar,

    I’m following up to check whether the issue has been resolved. Feel free to reply if you need further information. If the information provided was helpful, please click "Accept Answer" to help others in the community. Thank you!

    Was this answer helpful?

    0 comments
  2. Jason Nguyen Tran 19,225 Reputation points Independent Advisor
    2026-04-13T06:02:53.2733333+00:00

    Hi Joshi Omkar,

    The approach you described, creating a dedicated GPO linked to the Domain Controllers OU and configuring the Print Spooler service to be disabled, is indeed the recommended way to enforce this across all domain controllers. Doing it via Group Policy ensures consistency and avoids having to manually stop the service on each DC, which can be error‑prone.

    A couple of points to keep in mind: first, disabling the Print Spooler service on domain controllers is considered a best practice for security, since it reduces the attack surface (especially against vulnerabilities like PrintNightmare). Second, after applying the GPO, you should run gpupdate /force on the domain controllers to make sure the policy takes effect immediately. Third, verify in Services.msc that the Print Spooler is indeed disabled after the policy is applied.

    One caution: if you have any applications or scripts that rely on the Print Spooler service running on a DC, those will stop working. In most environments, domain controllers should not be handling print jobs, so this is usually safe. If you need printing services, they should be hosted on separate member servers, not on DCs.

    In short, your outlined steps are correct, and applying them through Group Policy is the right approach. I hope this gives you confidence to proceed. If you find this answer helpful, please consider clicking Accept Answer so others can benefit too.

    Jason.

    Was this answer helpful?

    0 comments

  3. AI answer

    2026-04-13T05:15:39.0933333+00:00

    The described approach of using a dedicated GPO linked to the Domain Controllers OU to disable the Print Spooler service is valid and aligns with Microsoft security guidance, with a few important considerations.

    Summary of the approach:

    • Create and link a GPO to the Domain Controllers OU.
    • In that GPO, configure the Print Spooler service to be Disabled.
    • Apply the GPO so it takes effect on all DCs in that OU.

    This matches the recommended mitigation that domain controllers and Active Directory admin systems should have the Print Spooler service disabled, preferably via GPO:

    • The security assessment explicitly states that due to exposure risk, domain controllers and AD admin systems need to have the Print Spooler service disabled, and that the recommended way is using a Group Policy Object (GPO).
    • It also notes that any server is potentially at risk and that the Print Spooler service should be disabled on all servers that do not require it.

    Additional points to verify before and after applying the GPO:

    1. Check dependencies and workflows
      The security guidance stresses reviewing Print Spooler settings, configurations, and dependencies before disabling it, to avoid breaking active printing workflows.
    2. Understand impact on AD print pruning
      • On a domain controller, the DC role adds a thread to the spooler service for print pruning (removing stale print queue objects from AD).
      • If the spooler service is not running on at least one DC in each site, AD cannot remove old queues that no longer exist.
      • If print queue publishing/pruning is still used in the environment, ensure at least one DC per site retains Print Spooler enabled, or accept that stale print queue objects will not be automatically pruned.
    3. Confirm no conflicting GPOs
      • Existing GPOs might configure Print Spooler behavior (for example, allowing the spooler to accept client connections or disabling it as part of other security mitigations).
      • Verify that the new GPO’s service setting is not overridden by higher-precedence GPOs.
    4. Apply and verify
      • After creating and linking the GPO, force a policy update on DCs (for example, using gpupdate /force from an elevated Command Prompt on each DC).
      • Confirm on each DC that the Print Spooler service is set to Disabled and is Stopped.

    If the environment does not rely on DCs for printing or AD print queue publishing/pruning, the described GPO-based method is an appropriate and recommended way to disable the Print Spooler service on domain controllers.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.