Configuring Windows Protected Print Mode (WPP)

Windows Protected Print Mode (WPP) is a new printing security feature introduced in Windows 11 (version 24H2) and Windows Server 2025. After enabling Windows Protected Print Mode, there’s no need to install model-specific printer drivers from various vendors on Windows. The legacy print stack will be replaced by the Internet Printing Protocol (IPP) with a universal driver. This feature offers two key benefits. First, it offers a universal solution, meaning users no longer need to search for, install, or update printer drivers. Second, it enhances security by eliminating the need to install third-party driver code on the system.

Requirements for using Windows Protected Print Mode include:

• Supported starting with Windows 11 24H2 and Windows Server 2025
• Compatible with Mopria-certified printers only.  The official Mopria project page contains a list of certified printers.  Most modern printers from brands like Canon, HP, Epson, Dell, Brother, Toshiba, and Ricoh support Mopria.
• WPP uses the IPP stack (HTTP-based), so the computer must have the Microsoft IPP Class Driver print driver (installed in Windows by default)
• The IPP Printing and IPPS Printing protocols must be enabled in the printer settings (depending on the vendor)
• The printer must be accessible from the user’s computer via TCP/UDP ports 631.

Protected Print mode is disabled by default in Windows (though Microsoft has announced that it will be enabled by default in future releases).

1. 1. You can enable and disable Windows Protected Mode using the Settings app (Settings -> Bluetooth and Printers -> Printer and Scanners).
   2. Click the Set up button in the Windows protected print mode section.
   3. A message will appear stating that all printers, print queues, and drivers that are incompatible with WPP will be removed from the computer.
      Therefore, we recommend backing up a list of installed print drivers and printers before enabling WPP. Use the following PowerShell command to list printers, drivers, and print ports, and save the results to a CSV file:
      Get-Printer| Export-Csv C:\listprinters.csv
      Use the Export-WindowsDriver cmdlet to export (back up) all installed drivers.
   4. Restart the computer.

When Protected Printing Mode is enabled, incompatible printers and drivers cannot be installed.

Adding a printer driver is not supported right now because Windows protected print is turned on. Turn it off first or contact your system admin if you're using a work or school device.

Operation could not be completed (error 0x000004ec).
This program is blocked by group policy. For more information, contact your system administrator.

WPP also blocks the installation of third-party printers and drivers through the Point and Print policy.

There is now a separate built-in ADMX template option in Windows Group Policies for enabling or disabling protected printing mode.

1. Open the local GPO editor (gpedit.msc)
2. Go to Computer Configuration -> Administrative Templates -> Printers
3. Enable the Configure Windows protected print policy option

You can also enable the Protected Printing Mode through the registry. Several DWORD parameters must be created under the registry key HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\WPP to do this.

• EnabledBy = 2
• WindowsProtectedPrintGroupPolicyState = 1
• WindowsProtectedPrintMode = 1
• WindowsProtectedPrintOobeConfigComplete =1

To disable the Protected Print, change the EnabledBy value to 0. Then, delete the remaining registry options.

If WPP mode is incompatible with some of your legacy printers, you can disable Protected Print mode. After that, you will have to reinstall the drivers manually and recreate the printer.