Categories

View All
Announcements
Community Stories
Coworking Tipps
Customer Stories
Events
ezeep Blue vs ezeep Legacy
Press Releases
Print Security
Printing Solutions
Quizzes
Technology, Trends, Tips
Webinars
White Papers
  • ezeep Blue what's new

Everything You Need to Know About Windows Protected Print Mode

Windows Protected Print Mode

The Windows Protected Print Mode (WPP) represents a new system setting in Windows, intended to eliminate security risks related to printing. Here, we illustrate the impact of WPP on your printing environment and provide you with points of reference on whether you should enable it.

IMPORTANT NOTICE: Please inform yourself thoroughly before activating Windows Protected Print Mode. The setting is not reversible. Currently, ezeep supports printing via the Office Plug-in, Print Now, and the Chrome Plug-in; further support is already under development.

What is Windows Protected Print Mode?

After more than two decades, Microsoft is fundamentally revising the Windows printing architecture to better meet modern security requirements and to steer the industry towards IPP-based printing (Internet Printing Protocol).

Security gaps in printing are a serious problem—known cases such as Stuxnet and Print Nightmare highlight the risks. In fact, these vulnerabilities make up about 9% of all Windows issues reported to the Microsoft Security Response Center (MSRC). One of the biggest challenges in securing the printing system is the frequent use of third-party drivers, which makes protection difficult. If you’re already using ezeep, you’ve already addressed these risks.

With WPP, Microsoft wants to establish a “Secure-by-Default” environment as the new standard. However, this also means that third-party drivers—the printer drivers that are still predominantly used today—will be phased out step by step. This is intended to reduce the complexity of the printing architecture and minimize security vulnerabilities such as SYSTEM-level weaknesses.

It is noteworthy here that Microsoft is relying on the Mopria standard, which was originally developed for Android.

Here you can find Microsoft’s official announcement with further background information: A New, Modern, and Secure Printing Experience with Windows

How Does Windows Protected Print Mode Work?

WPP introduces three key changes to increase security and simplify printing:

  • Internet Printing Protocol (IPP): Windows Protected Print Mode (WPP) relies on the Internet Printing Protocol (IPP)—an open standard that stands out for its cloud compatibility and extensive security features. Compared to older protocols like LPD or SMB, IPP offers improved support for advanced print functions and a more flexible handling of modern printing requirements.
  • Mopria: WPP relies on the Mopria standard, originally developed for Android, which eliminates the need for drivers.
  • Privilege Management: Tasks of the print spooler now run with user privileges instead of SYSTEM privileges to minimize the impact of potential security vulnerabilities.

WPP Activation and Effects on Printer Drivers

Once WPP is enabled on a device, all non-IPP drivers and standard TCP/IP ports are permanently removed. Only IPP-compatible ports and drivers remain active. This change is irreversible; if WPP is later deactivated, previous printers and configurations will not be restored. WPP also affects how new printers are added to Windows, as IPP becomes the only available device type and third-party drivers can no longer be installed.

If you activate WPP, you should consider the following impacts:

  • Compatibility Limitations: Advanced features such as finishing options and access controls are mostly supported by IPP but not by all printers. Printers that lack IPP/Mopria compatibility can no longer be used.
  • Administrative Adjustments: Administrators relying on scripts or deployment methods that require traditional drivers will need to adjust their configurations or explore alternative solutions.

How to Activate Windows Protected Print Mode

Activation via Settings

  1. Open Settings: Go to Settings > Bluetooth & Devices > Printers & Scanners > Printer Settings.
  2. Enable WPP: Click on “Set Up,” which will trigger a warning message about the impact of WPP.
  3. Confirm Activation: Follow the instructions until WPP is successfully activated on the device.

Activation via Group Policies

  1. Open the Group Policy Editor: Go to Group Policy Editor > Administrative Templates > Printers.
  2. Enable Settings: Select “Configure Windows Protected Print Mode” and activate it.

Preparation for Windows Protected Print Mode

For organizations considering WPP, here are some critical preparation steps:

  • Test Compatibility: To check if a printer is compatible with WPP, activate WPP on a test device and attempt to print. If the printer does not appear or function, it likely does not support IPP. A test is especially recommended for advanced features such as stapling or tray selection if the device supports these functions.
  • Set Up IPP Queues: Transition to IPP printer queues in advance so that users can access IPP-compatible print options when WPP is activated.
  • Remove Outdated Drivers: Remove or revoke non-IPP drivers from deployment systems before activating WPP.
  • Centralized Location Environments: Ensure that users who move between different locations do not encounter traditional driver installations. Otherwise, recurring error messages like “Printer Configuration Failed” may occur.

How Does the Introduction of Windows Protected Print Mode Affect ezeep Customers?

ezeep supports Windows’ decision to introduce the protected print mode and is planning full support for all ezeep apps.

Already today, ezeep can be used in WPP mode with the following apps:

Print Now via a web browser
Print Now in the ezeep Admin Portal
  • Print Now
  • Office 365 Plug-ins
  • Chrome Extension
  • (API printing via Make, Zapier, Pabbly, or custom web apps)

Additional Links