Configure Redirection Guard
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows NT\Printers\RedirectionGuardPolicy
This setting controls Redirection Guard for the Windows print spooler. The mitigation prevents spooler file operations from being redirected to other paths through untrusted file-system redirections.
The value supports these states:
0: Redirection Guard is disabled, allowing file-system redirections to be used within the spooler process.1: Redirection Guard is enabled, preventing applicable file redirections from being followed.2: Audit mode. Events are logged as if protection were enabled, but file redirections are not blocked.
Notes
Additional effects
Audit mode can identify affected file operations without changing their outcome. It does not itself protect the spooler against exploitation through such redirections.
Security
The print spooler performs some file operations with elevated privileges. Without Redirection Guard, an attacker could attempt to redirect a path used by the spooler—for example, through a directory junction—so that a privileged operation affects a different, protected location.
Enabling the mitigation reduces this attack surface, particularly for path redirections created by non-administrative users. It does not address unrelated print-spooler vulnerabilities and does not replace file permissions or other print-security policies.
Possible side effects
A spooler file operation can fail if a printing component legitimately depends on a file-system redirection that Redirection Guard does not trust. Audit mode does not block the operation and therefore does not cause this loss of functionality.
Notes
Microsoft documents 1 as the default value. Redirection Guard also defaults to enabled when the corresponding Administrative Template policy is disabled or not configured. This differs from explicitly storing 0 in RedirectionGuardPolicy, which turns the mitigation off.
Microsoft documentation
Microsoft Learn: Printers Policy CSP – ConfigureRedirectionGuardPolicy