Removed: the Windows Print spooler service on domain controllers and on systems that do not print.
Outcome: the remote-code-execution flaw had nothing left to run in on those machines, and the mitigation was not a patch.
PrintNightmare was a remote-code-execution flaw in the Windows print spooler, and the officially recommended fix was not a patch: “CISA encourages administrators to disable the Windows Print spooler service in Domain Controllers and systems that do not print.” The same page quotes Microsoft’s guidance — domain controllers “need to have the Print spooler service disabled.”
If the server does not print, the vulnerable component does not need to exist on it.
Source: CISA, PrintNightmare, Critical Windows Print Spooler Vulnerability (2 July 2021)