Windows protected print mode for enterprises

Windows protected print mode creates peace of mind for enterprise administrators by adding security benefits and completely removing the need for any driver management. When Windows protected print mode is enabled, printers will "just work".  

• For more information about the basics of the modern print platform and Windows protected print mode, see Discover the Modern Print Platform and Windows protected print mode.

• For more technical information on Windows protected print mode, see More information on Windows protected print mode for enterprises and developers.

Security

Windows protected print mode prevents the installation of third-party drivers and enables additional security features to help make environments more secure. Windows protected print mode would mitigate over half of past reported security issues for Windows print.  

• Module blocking

• Per-user XPS rendering

• Lower privileges for common spooler tasks

• Binary mitigations

Reliability and Compatibility

Windows protected print mode creates a reliable and consistent experience across a fleet of PCs regardless of manufacturer or model.

• Moving to a standard reduces risks of support calls and total cost of ownership and troubleshooting issues is simpler.

• Differentiation and unique features are still available via Print Support Apps (PSA).

• Ensures all printers work with PCs of any architecture.

• Removes the need to keep drivers up to date.  

Experience the best of Windows

As Windows moves away from third-party drivers, new features are catered to the modern print platform and work best when Windows protected print mode is enabled.

Enabling Windows protected print mode as group policy

1. Press Start.

2. Open the Local Group Policy Editor.

3. Navigate to Computer Configuration > Administrative Templates > Printers.

4. Right click on Configure Windows protected print and click Edit.

5. Select the Enabled radio button.

6. Click Apply and click OK.

Windows protected print is now enabled.

Windows protected print mode enabled machines should display the following:

Windows protected print mode Intune configuration

OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint
Data Type: String
Value: <enabled/>

To find more information on customizing settings via Intune, see Add custom settings for Windows 10/11 devices in Microsoft Intune.

Managing Servers with Windows protected print mode

When using a client with Windows protected print mode enabled, you cannot use Print Management to manage servers with Windows protected print mode disabled. Windows protected print mode enforces the use of the modern print stack, which is designed to work with Mopria certified printers. Servers with Windows protected print mode turned off may rely on legacy print drivers and protocols, which are not compatible with the modern print stack. As a result, managing these servers from a client that has Windows protected print mode enabled is not possible. By ensuring that both your client and servers have Windows protected print mode turned on, you can take full advantage of the security and reliability benefits it offers.

FAQ

See FAQs at Windows protected print mode FAQ.

Related articles