Windows Protected Print (WPP)

What is WPP?

Windows Protected Print (WPP) is a secure printing mode introduced by Microsoft in October 2024. It enhances print security by using the Microsoft IPP Class Driver and is designed to work with Mopria-certified printers. A list of Mopria-certified printers can be found on the Mopria website. WPP modernizes the print infrastructure by eliminating the need for traditional print servers and vendor-specific drivers, offering simplified, secure, and driverless printing experience.

WPP forces the use of the Microsoft IPP Class Driver for secure print queues. When enabled:

  • Legacy and third-party drivers are disabled for print queues.

  • Print jobs are encrypted and sent using IPP to Mopria-certified printers.

Pharos Cloud Support for WPP

  • Pharos’s Print Scout fully supports Windows Protected Print (WPP) for both Secure Release and Direct Print workflows.

  • WPP is available on Windows 11 and works seamlessly across Intel and Arm architectures.

The following table applies only to Secure Release and shows the default print driver selection based on WPP status:

Operating System Default Driver Note
Windows 11 Microsoft IPP Class Driver Starting with 8.1, the default driver is Microsoft IPP Class Driver regardless of the WPP status.
Windows on Arm devices Microsoft IPP Class Driver

On Arm-based PCs, enabling or disabling WPP does not affect Print Scout installation, Microsoft IPP is always used.

For more information on Windows Arm support, refer to the Windows Arm64 Support document.

Windows 10 Pharos IPP Class Driver Defaults to Pharos Class IPP Driver but can be manually configured to use manufacturer driver (e.g. HP Universal Print Driver) via the Print Scout Configuration Tool.

 

Known Issues and Limitations

  • Fresh install: It’s advisable to start with a fresh install of Print Scout on Intel-based WPP enabled Windows 11 machines. Enabling WPP first before installing Print Scout can help avoid issues such as the reappearance of the Pharos Secure Printer queue.

Note: We are partnering with Microsoft to address the issue. Stay tuned for updates.

Enabling or disabling Windows Protected Print (WPP)

WPP can be enabled in three ways:

  • Printers and Scanners in Settings

  • Group Policy

  • Registry Settings

Enable WPP via Settings

  1. Navigate to Settings > Bluetooth & devices > Printers & scanners.

  2. Find the "Printer preferences" section, and select "Set Up" next to Windows Protected Print mode.

  3. Click Yes, Continue to confirm the activation of WPP.

  4. Windows will uninstall any incompatible queues (e.g. IPP queues, third party queues).

  5. Windows Protected Print will be enabled.

Group Policy

Group Policy Path: Computer Configuration > Administrative Templates > Printers > Enable Windows Protected Print

  1. Open Group Policy Management Console.

  2. Go to Computer Configuration > Administrative Templates > Printers.

  3. Find and set Enable Windows Protected Print to Enabled.

  4. Apply the GPO to the target organizational unit (OU).

  5. Run gpupdate /force on client machines or reboot.

Registry Key

Registry Key: HKLM\Software\Policies\Microsoft\Windows NT\Printers\EnableWPP (DWORD: 1 = Enabled, 0 = Disabled)

  1. Open Registry Editor.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers.

  3. Create a new DWORD (32-bit) Value: EnableWPP

  4. Set the value to 1.

  5. Restart the machine to apply changes.

Once WPP is enabled, all existing print queues and print drivers are removed, and printing will only be possible with Mopria certified printers using the Microsoft IPP Class Driver.