Windows Protected Print Mode in Windows 11: Features, Compatibility and Setup

Quick Answer

Windows Protected Print Mode (WPP) is a Windows security feature that improves printer security by restricting printing to the Windows Ready Print platform and preventing the installation and use of traditional third-party printer drivers. It is designed primarily for Mopria-certified printers and uses modern printing technologies, including Internet Printing Protocol (IPP).

You can enable it through Settings > Bluetooth & devices > Printers & scanners > Windows protected print mode > Set up. Before enabling it, check whether your printer and scanner are compatible. Existing printers that depend on third-party drivers may be removed during the transition. You can disable the feature from the same Settings page if you need to use an unsupported printer, provided it is not enforced by an administrator policy.

What Is Windows Protected Print Mode?

Windows Protected Print Mode is a security-focused printing environment introduced by Microsoft to modernize printing in Windows and reduce the risks associated with traditional printer drivers.

Historically, Windows relied heavily on manufacturer-specific printer drivers. These drivers allow the operating system to communicate with printers and support manufacturer-specific functionality. However, printer drivers can contain vulnerabilities and may execute with elevated system privileges, creating potential security risks.

WPP addresses this issue by restricting the printing environment to Windows Ready Print, Microsoft's modern driverless printing platform. This reduces dependence on third-party printer drivers and introduces additional security protections for printing operations.

The feature is particularly useful for organizations, businesses, educational institutions and individual users who want a more standardized and secure printing environment.

How Does Windows Protected Print Mode Work?

Windows Protected Print Mode works with Windows Ready Print, which uses modern printing standards instead of relying on traditional manufacturer-specific printer drivers.

Its printing architecture primarily uses the Internet Printing Protocol (IPP). Compatible printers communicate with Windows through supported standard interfaces, reducing the need to install separate driver packages.

1. Windows Ready Print

Windows Ready Print is Microsoft's modern printing platform. It supports standardized communication with compatible printers and reduces the need for traditional third-party drivers.

• Driverless printing for compatible devices.
• Improved compatibility across different Windows PC architectures.
• Reduced dependence on manufacturer-specific printer drivers.
• A more consistent printing experience.
• Modern printing and scanning standards where supported.

2. Internet Printing Protocol (IPP)

IPP is a standardized protocol that allows computers and printers to communicate over a network. It supports printer discovery, configuration and print-job management.

Windows Ready Print uses IPP to communicate with compatible printers. This helps reduce the complexity associated with installing and maintaining individual printer drivers.

3. Mopria Certification

Mopria is an industry alliance that develops standards for printing and scanning interoperability. Mopria-certified printers are designed to work with standardized printing technologies.

Windows Protected Print Mode is designed to work with Mopria-certified printers. However, printer compatibility and scanner compatibility should be checked separately because some devices may support printing without providing all scanning functions.

4. Print Support Applications (PSAs)

One concern with driverless printing is the loss of manufacturer-specific features such as advanced finishing, custom printing preferences and device configuration.

Microsoft supports Print Support Applications (PSAs), which allow manufacturers to provide additional printer functionality without relying on traditional printer drivers.

Depending on the printer model and available application, these features may include:

• Additional printing preferences.
• Device-specific configuration options.
• Manufacturer-provided printing experiences.
• Advanced features supported by the printer.

Benefits of Windows Protected Print Mode

Benefit	Explanation
Improved security	Restricts third-party printer drivers and introduces additional print-system security protections.
Reduced driver dependency	Compatible printers can operate without traditional manufacturer-specific driver packages.
Better compatibility	Standardized printing reduces dependency on drivers designed for particular processor architectures.
Simplified administration	IT administrators can reduce the work involved in managing and updating individual printer drivers.
Consistent printing	Provides a more standardized printing environment across supported devices.
Modern printing architecture	Uses Windows Ready Print and modern printing protocols such as IPP.

System Requirements and Printer Compatibility

Windows Protected Print Mode is a Windows printing feature intended for supported Windows environments. Microsoft documents its management policy for Windows 11, version 24H2 and later.

For ordinary users, the most important compatibility requirement is the printer itself.

Compatible printers

• Mopria-certified printers designed to work with Windows Ready Print.
• Printers supporting compatible IPP-based printing.
• Devices that Windows identifies as compatible with protected print mode.

To check whether an installed printer is compatible:

1. Open Windows Settings.
2. Navigate to Bluetooth & devices > Printers & scanners.
3. Review the installed printer list.
4. Look for the Windows Protected Print compatibility indicator beside supported printers.
5. Check the manufacturer's specifications or Mopria certification information for additional confirmation.

For scanning functionality, verify that the scanner is also supported. A printer being compatible with protected printing does not automatically guarantee that its scanning functionality will work.

Processor architecture compatibility

Windows Ready Print is designed to reduce printer-driver dependencies across different PC architectures. Microsoft confirms that Mopria-certified printers can work with ARM-based PCs as well as other supported Windows PC architectures.

How to Enable Windows Protected Print Mode

Before enabling the feature, confirm that your printers support Windows Protected Print Mode. This is particularly important in offices where multiple users depend on network printers, multifunction devices or older printer models.

Step 1: Open Printer Settings

1. Click the Windows Start button.
2. Open Settings.
3. Select Bluetooth & devices.
4. Click Printers & scanners.

Step 2: Check printer compatibility

Review the installed printers and identify those compatible with Windows Protected Print Mode. Also check whether multifunction printers support scanning under the protected printing environment.

Step 3: Enable Protected Print Mode

1. Scroll down to the Printer Preferences section.
2. Find Windows protected print mode.
3. Click Set up.
4. Review the confirmation messages.
5. Select Yes, continue when prompted.
6. Allow Windows to remove unsupported printer installations and complete the configuration.
7. Reinstall compatible printers if Windows removed them during the transition.

Windows Protected Print Mode should now be enabled. Install or reinstall compatible printers through Windows printer settings and verify that they can print successfully.

How to Disable Windows Protected Print Mode

If an existing printer requires a manufacturer-specific driver, or an essential printing or scanning function is unavailable, you may need to disable Windows Protected Print Mode.

1. Open Settings.
2. Navigate to Bluetooth & devices > Printers & scanners.
3. Scroll down to Printer Preferences.
4. Locate Windows protected print mode.
5. Click Turn Off.
6. Confirm the operation by selecting Yes.
7. Wait for Windows to complete the change.

After disabling the feature, you can install printers that require traditional third-party drivers.

Important: Disabling protected print mode does not automatically reinstall every printer that was previously removed. You may need to add unsupported printers manually and install their appropriate manufacturer-provided drivers.

What Happens to Existing Printers When You Enable Protected Print Mode?

Enabling Windows Protected Print Mode can change the way existing printers are installed and managed.

Windows removes printer installations that depend on unsupported third-party drivers. The corresponding third-party driver is removed from the print driver store and cannot be used while protected print mode is active.

Existing printer configuration	Expected behaviour
Printer installed using a third-party driver and not compatible with protected printing	Printer is removed and cannot be reinstalled while the mode remains enabled.
Mopria-certified printer originally installed using a third-party driver	Original installation is removed, but the printer can be reinstalled using Windows Ready Print.
Printer already installed using Windows Ready Print	Existing installation is not removed simply because protected print mode is enabled.
Non-compatible printer after disabling protected print mode	The printer can be manually installed again using an appropriate driver.

If a Mopria-certified printer is reinstalled using Windows Ready Print, disabling protected print mode later does not automatically restore its previous third-party driver installation. To return to the traditional driver-based configuration, remove the printer and reinstall it with protected print mode disabled.

Common Issues After Enabling Windows Protected Print Mode

1. Printer disappears after enabling protected print mode

Possible reason: The printer was installed using a third-party driver or does not support the printing requirements of Windows Protected Print Mode.

Recommended action:

1. Check whether the printer is Mopria certified.
2. Confirm that its model supports Windows Ready Print.
3. Open Settings > Bluetooth & devices > Printers & scanners.
4. Use Add device to search for compatible printers.
5. If the printer is unsupported, disable protected print mode if permitted and reinstall the manufacturer's driver.

2. Printer works but scanner is missing

Possible reason: Printing and scanning have separate compatibility requirements. Some printers can print in protected mode while their scanning functions are unavailable.

Recommended action:

• Check the exact printer and scanner model against Mopria certification information.
• Check whether the manufacturer provides a compatible Print Support Application or scanning solution.
• Verify that Windows detects the scanning device.
• If scanning is essential and unsupported, consider disabling protected print mode.

3. Manufacturer-specific printer options are missing

Possible reason: Traditional printer drivers often provide advanced manufacturer-specific settings that may not be available through the standard Windows Ready Print interface.

Recommended action: Check whether the printer manufacturer provides a compatible Print Support Application. These applications can provide additional printing functionality without requiring a traditional printer driver.

4. Windows does not allow protected print mode to be disabled

Possible reason: An administrator may have enabled Windows Protected Print Mode through Group Policy or device management.

Recommended action: Contact your organization's IT administrator. A locally managed user may not have permission to override an administrator-enforced configuration.

Enterprise Management: Group Policy and Intune

Organizations can centrally manage Windows Protected Print Mode using Group Policy or Microsoft Intune.

Enable through Group Policy

On supported Windows editions with the Local Group Policy Editor, administrators can configure the feature using the following path:

1. Open the Start menu.
2. Search for Edit group policy.
3. Open the Local Group Policy Editor.
4. Navigate to:

Computer Configuration
  > Administrative Templates
    > Printers

5. Locate Configure Windows protected print.
6. Open the policy.
7. Select Enabled.
8. Click Apply and OK.

The computer will operate in Windows Protected Print Mode according to the configured policy.

Configure through Microsoft Intune

IT administrators can configure this feature using a custom device configuration profile in Microsoft Intune.

Microsoft documents the following Policy CSP configuration:

Setting	Value
OMA-URI	./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint
Data type	String
Enabled value	<enabled/>

This is a device-scoped policy. Administrators should verify the target Windows version, supported edition and existing device-management configuration before deployment.

Microsoft documents this policy for Windows 11 version 24H2 (build 26100) and later, with support for Pro, Enterprise, Education and IoT Enterprise editions.

For managed environments, test the configuration on a limited group of computers before deploying it across the organization. Check network printer compatibility, scanning requirements and business-critical printing workflows.

Special Considerations: OneNote, XPS and Fax

Windows Protected Print Mode can also affect certain software-based printers and document-output features.

OneNote virtual printer

Enabling protected print mode removes unsupported software printers, including the traditional OneNote (Desktop) printer.

Microsoft provides a replacement named OneNote (Desktop) – Protected virtual printer. It is installed by default with OneNote Windows app versions 2410 and later running on Windows 11 version 26100 or higher.

Microsoft XPS Document Writer

Enabling Windows Protected Print Mode removes XPS printing functionality. If you disable protected print mode and need to restore Microsoft XPS Document Writer, follow these steps:

1. Open the Start menu.
2. Search for Turn Windows features on or off.
3. Open the Windows Features dialog.
4. Select Microsoft XPS Document Writer.
5. Click OK and allow Windows to apply the changes.

Windows Fax and Scan

If you need the Windows Fax and Scan feature after disabling protected print mode, check whether it is installed under:

Settings > System > Optional features

Locate Windows Fax and Scan and install it if it is not already present.

Security Considerations

Traditional printer drivers can introduce security risks because they interact with important Windows printing components. A vulnerable or compromised driver may expose the system to privilege-escalation or code-execution risks.

Windows Protected Print Mode introduces several security improvements, including:

• Third-party driver restrictions: Prevents traditional third-party printer drivers from being used in the protected printing environment.
• Module blocking: Restricts potentially unsafe modules within the printing architecture.
• Per-user XPS rendering: Uses a more isolated rendering approach for supported printing operations.
• Reduced privileges: Applies lower privileges to common print spooler tasks.
• Binary mitigations: Uses additional security protections within the protected printing environment.

These changes reduce the attack surface associated with traditional Windows printing. However, protected print mode should be considered one component of an overall security strategy rather than a replacement for operating-system updates, endpoint protection, network security and access controls.

Should You Enable Windows Protected Print Mode?

For computers using compatible modern printers, enabling Windows Protected Print Mode is a useful security improvement.

Environment	Recommendation
Personal computer with a compatible Mopria printer	Recommended if all required printing and scanning features work.
Modern office with compatible network printers	Consider enabling after compatibility testing.
Office using older printers with proprietary drivers	Check compatibility before enabling.
Business relying on specialized printing features	Test manufacturer applications and printing workflows first.
Enterprise-managed Windows devices	Evaluate centralized deployment through Group Policy or Intune.

For businesses, the decision should account for all connected printers, multifunction devices, scanning workflows, print servers and specialized printing applications.

Frequently Asked Questions

Is Windows Protected Print Mode available in Windows 11?

Yes. Microsoft documents Windows Protected Print Mode and its enterprise management policy for supported Windows 11 environments. The documented Policy CSP support starts with Windows 11 version 24H2.

Does Windows Protected Print Mode require a Mopria-certified printer?

The feature is designed for Mopria-certified printers. Check the exact printer model and its compatibility with Windows Ready Print before enabling the feature.

Will my old printer work with Windows Protected Print Mode?

It depends on the printer's capabilities. Older printers that depend on proprietary third-party drivers may not work while protected print mode is enabled. Check Mopria certification and Windows compatibility information.

Can I disable Windows Protected Print Mode?

Yes. You can normally disable it through Settings > Bluetooth & devices > Printers & scanners. However, administrator-enforced Group Policy settings may prevent users from changing it.

Will enabling protected print mode delete my printer drivers?

Third-party print drivers are removed from the print driver store when protected print mode is enabled. Unsupported printers are removed, while compatible printers can be reinstalled using Windows Ready Print.

Does Windows Protected Print Mode support ARM processors?

Microsoft confirms that Mopria-certified printers work with ARM-based Windows PCs. The standardized printing approach reduces dependence on architecture-specific third-party drivers.

Why is my scanner not working after enabling protected print mode?

Not all scanner functions are supported in Windows Protected Print Mode. Check the scanner's Mopria certification and manufacturer documentation. Printer compatibility alone does not guarantee scanner compatibility.

Does Windows Protected Print Mode improve printer security?

Yes. It restricts third-party drivers and introduces additional protections within the Windows printing architecture, reducing security risks associated with traditional driver-based printing.

Sources

• Microsoft Learn – Windows Protected Print Mode
• Microsoft Learn – Windows Protected Print Mode FAQ
• Microsoft Learn – Discover Windows Ready Print
• Microsoft Learn – Windows Protected Print Mode for Enterprises
• Microsoft Learn – Printers Policy CSP
• Microsoft Learn – Technical Information for Enterprises and Developers