Short for line printer terminal, LPT is used by IBM compatible computers as an identification for the parallel port, such as LPT1, LPT2, or LPT3. The LPT port is commonly required when installing a printer on an IBM compatible computer. The majority of all computers utilize LPT1 and do not have an option for another LPT port unless additional ports are added to the computer.
This policy specifies whether to prevent the redirection of data to client LPT ports during a Remote Desktop Services session. You can use this setting to prevent users from mapping local LPT ports and redirecting data from the remote computer to local LPT port peripherals.
If a value is configured to Disabled or Not Configured, the attacker can leverage it to map the client’s LPT ports. In addition, he can use the port to redirect data from the Terminal Server to the local LTP ports.
Enable this object wherever’s possible.
If the status is set to Disabled, Remote Desktop Services always allows LPT port redirection. If the status is set to Not Configured, LPT port redirection is not specified at the Group Policy level. However, an administrator can still disable LPT port redirection using the Remote Desktop Session Host Configuration tool.
RDS users won’t be able to access a client’s LPT port peripherals.
CALCOM’S RECOMMENDED VALUE:
HOW TO CONFIGURE:
- Press Windows Logo+R, type gpedit.msc, and press Enter.
- Click the arrow next to Computer Configuration under Local Computer Policy to expand it.
- Click the arrow next to Administrative Templates to expand it.
- Click All Settings to show all group policy settings.
- Scroll down to Do not allow LPT port redirection and double-click on it to view the setting.
6. Ensure the policy is Enabled and click OK.