Short for line printer terminal, LPT is used by IBM compatible computers as an identification for the parallel port, such as LPT1, LPT2, or LPT3. The LPT port is commonly required when installing a printer on an IBM-compatible computer. The majority of all computers utilize LPT1 and do not have an option for another LPT port unless additional ports are added to the computer.
Server hardening can be a painful procedure. If you’re reading this article, you probably already know it. Endless hours, labor and money are invested in this process, which can often result in production breakdown despite the effort to prevent it. CSH by CalCom is automating the entire server hardening process. CHS’s unique ability to ‘learn’ your network abolishes the need to perform lab testing while ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production hassle-free. want to know more? Click here and get the datasheet.
This blog post will cover:
- What is LPT Port Redirection policy
- The potential vulnerability in this setting
- Countermeasures for mitigating this vulnerability
- The potential impact of the configuration change
- The setting’s default value
- CalCom’s recommended value
- How to change the configuration
POLICY DESCRIPTION:
This policy specifies whether to prevent the redirection of data to client LPT ports during a Remote Desktop Services session. You can use this setting to prevent users from mapping local LPT ports and redirecting data from the remote computer to local LPT port peripherals.
POTENTIAL VULNERABILITY:
If a value is configured to Disabled or Not Configured, the attacker can leverage it to map the client's LPT ports. In addition, he can use the port to redirect data from the Terminal Server to the local LTP ports.
COUNTERMEASURES:
Enable this object wherever's possible.
If the status is set to Disabled, Remote Desktop Services always allows LPT port redirection. If the status is set to Not Configured, LPT port redirection is not specified at the Group Policy level. However, an administrator can still disable LPT port redirection using the Remote Desktop Session Host Configuration tool.
POTENTIAL IMPACT:
RDS users won't be able to access a client's LPT port peripherals.
DEFAULT VALUE:
Disabled
CALCOM'S RECOMMENDED VALUE:
Enabled
HOW TO CONFIGURE:
- Press Windows Logo+R, type gpedit.msc, and press Enter.
- Click the arrow next to Computer Configuration under Local Computer Policy to expand it.
- Click the arrow next to Administrative Templates to expand it.
- Click All Settings to show all group policy settings.
- Scroll down to Do not allow LPT port redirection and double-click on it to view the setting.
6. Ensure the policy is Enabled and click OK.
