Windows Protected Print Mode: What It Means for Your Printers

What Protected Print Mode is, and what it is not

Windows has always printed through drivers: code written by printer manufacturers and loaded into the Print Spooler, the Windows service that manages print jobs. The spooler runs with very high privileges. Microsoft's own documentation says print bugs made up 9% of all cases reported to its Security Response Center over a three-year period, and that old third-party drivers are hard to protect because Microsoft depends on the manufacturer to fix them.

Protected Print Mode takes the drivers out of the picture. When it is on, Windows prints only through Windows Ready Print, which uses the Internet Printing Protocol (IPP) and the Microsoft IPP Class Driver built into Windows. It is designed for Mopria-certified printers. Mopria is the industry alliance that defines the IPP printing and eSCL scanning standards. Microsoft also says the mode moves some spooler work out of the highly privileged SYSTEM account, blocks new modules being loaded and applies extra exploit mitigations. It describes the result as mitigating over half of past reported print security issues. That is Microsoft's figure, not an independent one.

It is a setting, not a patch and not a deadline. The policy applies to Windows 11 version 24H2 and later (Pro, Enterprise, Education and IoT Enterprise editions are listed). Windows Ready Print and Protected Print Mode are related but different, and that difference matters for the rest of this article.

What is happening now and what has only been announced

Confusion in this area usually comes from mixing four separate things. Keeping them apart answers most of the worry about whether printers will suddenly stop working.

Microsoft's published position is that existing drivers can still be installed, and that it has no plans to disable print features tied to the legacy driver platform. The end-of-servicing plan is about who can publish and update drivers, not about switching off the ones you already use.

• Protected Print Mode today: opt-in. Microsoft's policy documentation says it is not enabled by default and that without it there are no restrictions on the drivers that can be installed. Microsoft's FAQ says it will be enabled by default at a future date. We found no Microsoft-published date. Some vendor blogs say 2027, but we could not confirm that from Microsoft.
• Windows Ready Print as the default for new installs: a preview update dated 23 June 2026 (KB5095093, builds 26200.8737 and 26100.8737 for Windows 11 25H2 and 24H2) lists that new printer installations use IPP by default when supported. It can be turned off with the Settings toggle named Default install printers using Windows Ready Print. Microsoft's driver plan dates the change that makes Windows prefer the inbox IPP driver to 1 July 2026. A matching policy, ConfigureWindowsReadyPrintDriverRanking, is on by default and needs that KB or later.
• This concerns new installations. Independent commentary (Tricerat) says existing installed printers are not migrated, and Microsoft's description speaks only of new installs. Test on a spare PC rather than assuming.
• Third-party driver servicing: Microsoft's plan says no new printer drivers are published to Windows Update for Windows 11 and Windows Server 2025 and later from 15 January 2026, apart from case-by-case approvals. From 1 July 2027 third-party driver updates stop except for security fixes. Existing drivers can still be installed from Windows Update or a manufacturer's installer, and Microsoft will keep issuing security fixes for the legacy driver platform while the Windows version is supported.

Which printers and drivers are affected

The test is simple to state: does the printer work properly over IPP as a Mopria-certified device? Microsoft says most new printers and over 120 million already sold are Mopria certified, and that the printer must have IPP enabled. A compatible printer shows a shield icon in Settings, under Bluetooth & devices, then Printers & scanners.

Here is what happens when someone switches the mode on, according to Microsoft:

• Printers installed with a third-party driver are uninstalled, and the driver is removed from the driver store.
• A Mopria-certified printer that was installed with a vendor driver is also removed, but it can be reinstalled and will then use Windows Ready Print.
• A printer already installed through Windows Ready Print is left alone.
• A printer that is not compatible is uninstalled and cannot be reinstalled while the mode is on. If you later turn the mode off, you reinstall it manually and the original driver comes back.
• Software printers that Windows cannot support in this mode are removed. Microsoft names the classic OneNote (Desktop) printer, XPS and fax. OneNote has a replacement called OneNote (Desktop) - Protected virtual printer. If you rely on a third-party PDF or capture printer driver, assume it needs testing.
• Some scanners are unavailable. A multifunction device whose scanner is not Mopria certified keeps printing but loses scanning in this mode.
• Vendor extras such as special finishing options may not appear as they did with a driver. Manufacturers can supply a Print Support App for custom features, but that depends on the manufacturer writing one.

Print servers and shared printers

This is where an estate is most likely to hit trouble, because the dependency is easy to miss. A Windows print server that shares queues using vendor drivers pushes those drivers to clients through Point and Print, the feature that lets users connect to a shared printer and get the driver automatically. Microsoft says Protected Print Mode prevents Point and Print from ever installing third-party drivers. Our reading is that a shared queue which depends on a vendor driver will not work for a protected client. We have not seen Microsoft state that case in so many words.

For IPP, Microsoft describes Point and Print working differently. Client and server connect over RPC, both use their inbox Microsoft IPP driver, the server talks to the printer over IPP, and a Print Support App is installed if one exists. So a server queue built on the Microsoft IPP Class Driver is the shape that fits.

One management point is explicit. A client with the mode enabled cannot use Print Management to manage servers that have it disabled, because those servers may rely on legacy drivers and protocols. Microsoft's advice is to have both clients and servers switched on. We did not find a Microsoft page listing the Windows Server versions that support enabling the mode, so confirm that for your server before planning around it.

Direct TCP/IP printers with a vendor driver are the same story as local ones: no driver allowed. Printers with no IPP support at all are the real dead ends.

Checking your estate without changing anything

The aim is a list of every printer, the driver it uses, how it connects and whether it is a sensible candidate for IPP. These checks only read information. Run the PowerShell on a Windows PC and on each print server. Listing printers on your own PC needs no special rights; listing a server's queues needs access to that server.

1. On one or two representative Windows 11 PCs, open Settings, then Bluetooth & devices, then Printers & scanners. Note which printers show the compatible shield icon. This is Microsoft's own compatibility indicator, so treat it as the first filter.
2. On each PC and print server, list the printers with the driver, port and sharing status. A queue using a driver named Microsoft IPP Class Driver is already on the target model. Anything with a manufacturer's driver name needs a decision.
   powershellCopy

   Get-Printer | Select-Object Name, DriverName, PortName, Shared, Type | Format-Table -AutoSize

3. List the installed drivers as well, because retired queues often leave old drivers behind. This helps you spot legacy drivers you no longer need as well as ones still in use.
   powershellCopy

   Get-PrinterDriver | Select-Object Name, Manufacturer | Sort-Object Manufacturer, Name

4. For every printer with a vendor driver, look the model up in Mopria's certified products list and check on the printer's own settings page that IPP is turned on. Where the model is not on the list, ask the manufacturer whether it supports IPP printing and whether a Print Support App exists.
5. Record what each device does besides printing. Scan-to-folder, scan-to-email, secure release, accounting codes and finishing options often hang off a driver or vendor software, and these are the features most likely to change.
6. List software printers too: PDF creators, capture tools and anything installed by line-of-business software. Mark the ones that need a replacement or a test.

Piloting it and preparing the rest

Do not switch Protected Print Mode on across a fleet to see what happens. It removes printers, and on a managed machine the user cannot turn it back off if it was set by policy. Microsoft says a policy-enforced setting needs an administrator to change it. Start with a pilot group of PCs that print to a mix of your printers.

Setting it up on a single PC needs local administrator rights. In Settings, go to Bluetooth & devices, then Printers & scanners. Under Printer Preferences, select Set up beside Windows protected print mode and answer Yes, continue to the prompts. The Set up dialog identifies printers that need reinstalling. The real impact is that anything not compatible is removed and cannot be re-added until the mode is off.

For managed devices, the Group Policy setting is Configure Windows protected print, found under Computer Configuration, then Administrative Templates, then Printers. For Intune, Microsoft documents a custom setting using the OMA-URI shown in step 3, with a String data type. Apply either only to a pilot group that you can remove the policy from.

1. Choose a pilot group with a real spread of printers, plus at least one user who depends on scanning. Include a PC that connects to a print server queue.
2. Before enabling, write down the printers each pilot PC currently has and which driver each uses. You will need this list for reinstalling and for rollback.
3. Enable the mode on the pilot PCs, either through the Settings Set up route or, for managed devices, by policy. For Intune the custom setting is below.
   textCopy

   OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint
   Data type: String
   Value: <enabled/>

4. Reinstall the printers that Windows lists as compatible. Print a test page from each one and check page size, trays, duplex and colour.
5. Test scanning, scan-to-email and any secure-release or accounting workflow that uses the device.
6. Test the shared print server queues from a pilot PC. Pay particular attention to queues that previously relied on the server pushing a vendor driver.
7. Record every failure with the printer model, what changed and the cause. For each one decide whether to replace the device, move it to a Mopria-compatible configuration or keep those users off the mode until a replacement is budgeted.
8. To roll back, turn the mode off in Settings, or remove or disable the policy if one enforced it. Then reinstall any non-compatible printers by hand. Microsoft says the original driver is reinstalled. Confirm with a test print.

A preparation checklist you can hand to a colleague

This is the short version for a business owner or IT lead who wants to know what to do before the default changes. None of it needs to happen this week. It does need to happen before you are made to do it in a hurry.

• Know your estate: a list of printers, models, connection types, drivers, print servers and shared queues.
• Know which devices are Mopria certified and have IPP enabled, and which are not.
• Find out which ones rely on a vendor driver or vendor software for scanning, secure printing or finishing.
• Decide which old devices will be replaced and put that in the next budget, not an emergency one. For new purchases, make Mopria certification and IPP support a requirement.
• Check your print servers: which queues use vendor drivers and which can move to the Microsoft IPP Class Driver.
• Decide whether you want the new-install behaviour of Windows Ready Print on your PCs. The driver ranking policy gives you a way to control it, so test before leaving it to chance.
• Pilot Protected Print Mode on a few PCs and keep a rollback list.
• Re-read Microsoft's Windows protected print mode FAQ each quarter for a published default date.

What is still uncertain

Microsoft has not given a date for Protected Print Mode becoming the default, and vendor blogs that quote 2027 are not a substitute. We could not confirm from Microsoft's documentation exactly how the July 2026 Windows Ready Print change behaves on printers that are already installed, or whether it has reached every supported 24H2 and 25H2 device through the regular monthly update. Check this on your own build rather than relying on us.

Our judgement is that the direction is clear even if the date is not. Microsoft is moving printing to IPP and away from third-party drivers, and buying a printer now without Mopria and IPP support is buying a future problem. That does not make an older printer a crisis today. A scan-to-folder multifunction device from a decade ago is exactly the sort of thing nobody remembers until it matters, which is the argument for making a list now.