What Is Windows Protected Print Mode (WPP)?

Windows Protected Print Mode Definition

Windows Protected Print Mode (WPP) is a Microsoft security feature, introduced in Windows 11 version 24H2 (October 2024) and Windows Server 2025, that restricts printing to a driverless, IPP-based model. When WPP is enabled, third-party print drivers are removed from the system and new driver installations are blocked. Only printers using the Microsoft IPP class driver, which communicates with Mopria-certified printers, work natively. The feature is part of Microsoft's broader effort to harden the Windows print stack against vulnerabilities like PrintNightmare.

As of mid-2026, WPP will be off by default on every Windows version that supports it. Users with local administrator rights can turn it on through Windows Settings. IT administrators can enable or block WPP through Group Policy or the Windows Registry. Microsoft has stated WPP will become the default by 2027, though no specific date has been published. The transition is gradual: WPP can be tested today, enabled on specific machines or user groups now, and rolled out broadly before the default-on date arrives.

Why Microsoft Built WPP

Print spooler vulnerabilities have been a recurring problem on Windows for years. PrintNightmare (CVE-2021-34527) was the most publicly known example, but it was one in a long series of spooler-based exploits. The root cause was consistent. Third-party print drivers run with high privilege, and the Windows print spooler had to trust every vendor's driver code to operate.

WPP closes that gap by removing third-party drivers from the print stack entirely. The decision also fits the broader direction of the Windows operating system. Less third-party code with elevated rights, more sandboxing, more verified components. Modern features like Smart App Control and the deprecation of certain legacy drivers point the same direction. WPP is the printing version of that shift.

Requirements for WPP

To use WPP, an environment needs:

• A supported operating system: Windows 11 version 24H2 or later, or Windows Server 2025 or later.
• Mopria-certified printers. The Mopria Alliance maintains a public list of certified devices. Most modern printers from major manufacturers (Canon, HP, Epson, Brother, Lexmark, Ricoh, Toshiba, Xerox) include Mopria certification, though feature support varies. Older printers and many specialty devices (label printers, plotters, industrial printers) are often not Mopria-certified.
• IPP and IPPS enabled on the printer. The setting name varies by manufacturer.
• Network reachability on TCP port 631. Firewall rules must allow IPP traffic between the Windows machine and the printer. If the environment enforces encrypted printing (IPPS), port 443 must also be unblocked.
• The Microsoft IPP class driver. Installed by default with Windows. No additional driver download is required.

For vendor-specific features beyond the standard IPP set, the manufacturer must publish a Print Support App through the Microsoft Store, and the user or organization must install it.

Enabling WPP

WPP can be enabled in three ways.

Via Windows Settings: Settings → Bluetooth and Devices → Printers and scanners → scroll to Printer Preferences → Windows protected print mode → Set up. The user must have local administrator rights.

Via Group Policy: Computer Configuration → Administrative Templates → Printers → Configure Windows protected print → Edit. The Group Policy ADMX template for WPP is included in current Windows 11 and Server 2025 versions.

Via the Registry: Keys live at HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\Printers\\WPP. Set the WindowsProtectedPrintModeDWORD value to 1 to enable.

A system reboot may be needed for the change to take full effect, particularly when removing existing TCP/IP print queues that don't get cleaned up on the first toggle.

Disabling WPP

WPP can be turned off through the same three paths in reverse. Disabling WPP does not undo the changes that happened when it was first enabled.

⚠️ Removed drivers do not reinstall automatically. Removed Windows features (Internet Printing Client, XPS, built-in fax) do not return on their own. Existing print queues that depended on removed drivers must be rebuilt. WPP is straightforward to turn on. Reverting cleanly is a project.