CrowdStrike blocks PrintIsolationHost — EDR allowlist for spooler
Joe B.
Expert ★★★★★ 27,853 satisfied customers
Specialities: Windows Print Spooler, enterprise EDR (CrowdStrike), Print Driver Isolation, IPP/SMB print, Point-and-Print hardening
CrowdStrike blocking PrintIsolationHost.exe / spoolsv.exe — EDR detection exclusion, prevention policy, hash/path/certificate allowlist
Technician
• What errors do you see — Event ID 7031 (Spooler crash), Event ID 808 (Driver Isolation), or CrowdStrike Prevention/Detection on
PrintIsolationHost.exe / spoolsv.exe?• Is printing via IPP/IPPS, SMB shared queue, or direct TCP 9100?
• Any recent changes: Falcon policy (Prevention/IOA), GPO hardening for Point-and-Print, or a new model driver?
Technician
spoolsv.exe (this is Printer Driver Isolation). CrowdStrike can flag unusual spooler child processes — a great control against spooler-spawned LOLBINs — but we must allow the Microsoft-signed print pipeline while keeping detections for abuse.Plan: 1) Confirm legit binaries/paths and signatures. 2) Create a narrow EDR allowlist (process/certificate/path) for
%SystemRoot%\System32\PrintIsolationHost.exe and %SystemRoot%\System32\spoolsv.exe. 3) Leave IOA rules intact for non-printing children and script shells. 4) Test with IPP/IPPS and SMB queues.
Technician
• In Falcon: Configuration → Exclusions (or inside the affected Prevention Policy) → add a Process exclusion limited to:
ImagePath = C:\Windows\System32\PrintIsolationHost.exeand (optionally)
ParentImage = C:\Windows\System32\spoolsv.exe• Scope to the printing device group (print servers / workstations with local queues), not global.
• Use Certificate condition “Microsoft Windows Publisher” to require signed binaries. Avoid broad folder visibility exclusions that hide telemetry.
• Save & deploy; allow up to one policy cycle for clients to pick it up.
spool\drivers?
Technician
Windows loads print drivers into PrintIsolationHost.exe (isolated/shared mode). Broadly excluding
%SystemRoot%\System32\spool\drivers reduces visibility across all drivers. Better:• Keep the process allow for
PrintIsolationHost.exe + Microsoft signer.• If a specific third-party driver component is blocked, add a hash or publisher certificate exclusion for that vendor only.
• Leave child process detections enabled so if spooler launches
cmd.exe, powershell.exe, rundll32 with odd params, Falcon still prevents it.
Technician
• Ensure the allowlist covers the legit spooler → PrintIsolationHost chain (Parent/Child rule). That’s where IPP rendering occurs.
• Keep network controls (URL filtering/SSL inspection) from breaking IPPS certificates to the CUPS/IPP endpoint.
• After deploying the exclusion, print a test: check Falcon for the event now marked “Excluded” and Windows for 7036/307 print job events completing.
Technician
• One process rule for
PrintIsolationHost.exe (Microsoft-signed) with parent spoolsv.exe.• Optional path rule for
C:\Windows\System32\spoolsv.exe as parent only (not child wildcards).• Do not exclude shells (
cmd.exe, powershell.exe) or script interpreters as children — that’s how exploitation is detected (e.g., PrintNightmare chains).• Scope by host group and tag (e.g., Role:PrintServer), review quarterly.
Technician
• Confirm Printer Driver Isolation mode is Shared/Isolated (not “None”).
• Update vendor drivers/UPDs; remove legacy Type-3 packages that trigger isolation errors.
• Keep Point-and-Print restrictions per Microsoft guidance; the allowlist should only cover the legit printing processes, not relax PnP or script engines.
Need a second set of eyes on your Prevention policy and host groups? Open the chat.
Technician
Quick answer: the accepted fix
Accepted fix when Falcon prevents PrintIsolationHost.exe / Spooler: add a targeted process exclusion for C:\Windows\System32\PrintIsolationHost.exe (parent spoolsv.exe and Microsoft signer). Scope to print hosts only. Do not exclude shells; keep IOAs for suspicious spooler children. Verify jobs complete over IPP/IPPS and SMB.
Why EDR flags PrintIsolationHost (spooler child processes & driver isolation)
The Windows Print Spooler (spoolsv.exe) launches PrintIsolationHost.exe to sandbox drivers (Printer Driver Isolation). EDR tools like CrowdStrike monitor spooler-spawned children because attackers abuse the spooler in PrintNightmare-style chains. A strict policy can block the legitimate print processor/rendering path. The fix is a narrow allowlist for the signed Microsoft printing binaries, not a broad folder exclusion.
How to verify the allowlist works
Print a text PDF and a photo via both IPPS and SMB. In Falcon, the event should show as “Excluded” for PrintIsolationHost.exe with parent spoolsv.exe. In Windows, you should see job completion (Event ID 307) and no recurring 7031 crashes. If jobs still fail, check SSL inspection on IPPS, vendor driver signatures, and that your exclusion scope includes the correct host group.
CrowdStrike vs printing — quick troubleshooting tips
Aim for minimal, auditable exclusions that keep spooler security intact.
Quick path: confirm legit paths (System32\PrintIsolationHost.exe, System32\spoolsv.exe) → add process + parent + certificate exclusion in the Prevention policy → scope to print servers/workstations → leave child-process IOAs active → update/replace legacy Type-3 drivers → retest over IPP/IPPS and SMB.
Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.
Expert will respond in minutes
We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.
Save time & money
No scheduling hassles or expensive consults. Membership can save you significant time and money each month.
FAQ
Why does CrowdStrike block PrintIsolationHost?
Strict IOA rules monitor spooler child processes to stop exploitation. If the policy isn’t tuned, Falcon may terminate the legit PrintIsolationHost.exe used by Printer Driver Isolation. Add a targeted process+parent+certificate exclusion instead of broad folder exclusions.
What is Printer Driver Isolation?
Windows runs printer drivers in PrintIsolationHost.exe separate from spoolsv.exe to prevent driver crashes from taking down the spooler. Keep isolation On (Shared/Isolated) for stability and security.
Is it safe to exclude spool\drivers?
Avoid wide folder exclusions; they reduce visibility. Prefer process and certificate conditions for Microsoft-signed printing binaries and, if needed, a specific vendor’s signed components.
Will this break PrintNightmare protections?
No — if you only allow PrintIsolationHost under spoolsv with Microsoft signature and keep IOAs for unusual children (e.g., cmd.exe, rundll32). Do not whitelist shells or scripting engines.
Sources
- Microsoft Learn — Printer driver isolation (PrintIsolationHost & spoolsv)
- Red Canary — How to create exclusions in CrowdStrike Falcon
- CrowdStrike — Protecting against Microsoft PrintNightmare
Filed under: Print queue & spooler (Windows/macOS)
Related articles
- Printer prints a PDF blank — but the printer isn’t “out of ink”
- My printer ignores my print settings — why is it printing the wrong way?
- My printer pauses every print job — why does it keep stopping?
- My printer queue is stuck and won’t clear — what can I safely check?
- Printer queue is full and nothing prints — what happened?
- Print job stuck on “Processing” — why won’t it start printing?
- Printer stuck on “Sending to printer” — nothing comes out. What do I check first?
- Printer keeps pausing print jobs — why does it pause and how do I stop it?