--PrintNightMare Print Spooler Service Check
SELECT display_name, status, start_type, user_account,
CASE
WHEN status = 'RUNNING' THEN ' Exposed to unpatched vulnerabilities inc. PrintNightmare'
WHEN status ='STOPPED' THEN ' NOT exposed to unpatched vulnerabilities inc. PrintNightmare'
END AS SpoolerCheck,
CASE
WHEN start_type = 'AUTO_START' THEN 'Set Spooler to DISABLED or DEMAND_START'
END AS ServiceCheck
FROM services WHERE path = 'C:\Windows\System32\spoolsv.exe';
