Apply Microsoft's patches immediately - Disable the Print Spooler service on systems that do not require printing, especially domain controllers and other Tier 0 assets - If the Print Spooler must run, restrict driver installation via Group Policy: `Computer Configuration > Administrative Templates