Getting started with Windows protected print mode

This week is all about another new feature within Windows 11, version 24H2. Mainly to create awareness. That new feature is Windows protected print mode. Windows protected print mode builds on top of the existing IPP print stack. Main enhancement is that only Mopria certified printers are supported and that it disables the ability to load third-party print drivers. Securing the printing stack has always been, and still remains, challenging. Mainly because it has to deal with compatibility of legacy drivers and high effective permissions of the printer drivers. That’s not all that easy to address. Windows protected print mode, however, is a step into the right direction. That adds some long-awaited improvements to the print security in Windows that should make the impact smaller of challenges within the printing stack, as seen with Stuxnet and Print Nightmare. This post will have a brief look at the reasoning behind Windows protected print mode, followed with the steps for configuring Windows protected print mode. This post will end with a look at the experience with Windows protected print mode.

Note: Windows protected print mode is a new feature of Windows 11, version 24H2.

Introducing Windows protected print mode

Windows protected print mode is the way forward for a more secure print experience on Windows devices. The introduction of Windows protected print mode actually came together with another really important announcement by Microsoft. That announcement is the end of servicing plan for third-party printer drivers on Windows. That end of servicing plan is a multi-year approach to end the servicing of the legacy v3 and v4 Windows printer drivers. Starting with Windows 10 version 21H2, there is inbox support for Morpia certified printers via the Microsoft IPP Class Driver. That should remove the need for printer manufactures to create their own drivers for their printers. The idea is that, if needed, any customizations can be provided via a print support app (PSA) and can be distributed via the Microsoft Store.

That change enables Microsoft to provide a more secure printing solution to Windows devices. No longer the need for providing compatibility with legacy printer drivers that are incompatible with the security mitigations and protections that are implemented over the years. No longer the need for providing the ability to load third-party code that provide full control of the print spooler process. All because the Internet Printing Protocol (IPP) will be supported out-of-the-box. Windows protected print mode builds on that IPP-stack and prevents the ability to load third-party print drivers. Eventually, that will be the standard for printing in Windows. For now, that’s the goal that organizations should work towards to. A better protected and more controlled print experience, and a mitigation for many print vulnerabilities.

Note: Keep in mind that currently not every printer is compatible with Windows protected print mode.

Configuring Windows protected print mode

When looking at configuring Windows protected print mode, it all starts with the Policy CSP. That CSP contains the Printers area. That area contains many ADMX-backed settings that can be used to configure printer related behavior, including a new setting to manage Windows protected print mode. All of the available settings are backed by the Printing.admx. Specifically to the Windows protected print mode it’s the ConfigureWindowsProtectedPrint setting of the CSP that is backed by the ConfigureWindowsProtectedPrint setting in the ADMX and eventually configures the WindowsProtectedPrintGroupPolicyState registry value. At this moment this specific setting is not yet available within the Settings Catalog, which is the reason to fallback to a Custom configuration profile. That enables the configuration of any available CSP setting in Windows. As it’s an ADMX-backed setting, keep in mind that it requires a specific manner to enable such a setting. The following nine steps walk through the configuration of enabling Windows protected print mode for Windows 11, version 24H2 and later.

1. Open the Microsoft Intune admin center navigate to Devices > Windows > Configuration profiles
2. On the Windows | Configuration profiles blade, click Create > New policy to open the Create a profile page
3. On the Create a profile page, provide the following information and click Create

• Platform: Select Windows 10 and later as value
• Profile type: Select Templates as value
• Template name: Select Custom as value

4. On the Basics page, provide a unique Name to distinguish the profile from other custom profiles and click Next
5. On the Configuration settings page, as shown below in Figure 1, click Add to add the following row and click Next

• OMA-URI setting (1) – This setting is used to enable Windows protected print mode
  • Name: Provide a name for the OMA-URI setting to distinguish it from other similar settings
  • Description: (Optional) Provide a description for the OMA-URI setting to further differentiate settings
  • OMA-URI: Specify ./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint
  • Data type: Select String as value
  • Value: Specify <enabled/> as value

6. On the Scope tags page, configure the applicable scopes and click Next
7. On the Assignments page, configure the assignment and click Next
8. On the Applicability rules page, configure at least an applicability rule for Windows 11 version 24H2 and later, to prevent errors in the reporting, and click Next
9. On the Review + create page, verify the configuration and click Create

Note: The setting for Windows protected print mode will come over time to the Settings Catalog.

Experiencing Windows protected print mode

After applying the configuration for Windows protected print mode, it’s pretty straight forward to verify and experience that configuration. To verify the configuration, simply open the Settings app and navigate to Bluetooth & devices > Printers & scanners. Starting with Windows 11, version 24H2, that contains the new setting Windows protected print mode in the Printing preferences. That setting should be grayed out and set to Turn Off, as shown below in Figure 2. After enabling Windows protected print mode, every printer that is not compatible will automatically be removed.

Important: Every printer that is not compatible with Windows protected print mode, will be removed.

More information

For more information regarding Windows protected print mode refer to the following docs.

• Printers Policy CSP | Microsoft Learn
• Windows protected print mode – Windows drivers | Microsoft Learn
• Windows protected print mode for enterprises and developers – Windows drivers | Microsoft Learn
• More information on Windows protected print mode for enterprises – Windows drivers | Microsoft Learn
• A new, modern, and secure print experience from Windows – Microsoft Community Hub