How to Enable and Configure Windows Protected Print Mode in Windows 11 for Enhanced Print Spooler Security

For decades, Windows print architecture relied heavily on third-party printer drivers running in elevated system contexts. This model frequently introduced severe privilege escalation vulnerabilities, such as PrintNightmare. Starting with Windows 11 24H2, Microsoft introduced Windows Protected Print Mode (WPP). This feature completely redesigns the print spooler by disabling legacy third-party kernel and user-mode drivers in favour of secure, modern Mopria-certified IPP standards.

What Is Windows Protected Print Mode?

Windows Protected Print Mode locks down the Windows print spooler and enforces modern security practices:

• Eliminates Third-Party Drivers: Blocks third-party driver binaries from executing inside the Print Spooler service context.
• Mopria Standardisation: Restricts all printing devices to native, certified Mopria IPP (Internet Printing Protocol) driver stacks built directly into Windows.
• Spooler Sandboxing: Restricts the print spooler process privileges to prevent arbitrary code execution and unauthorized file system writes.
• Reduced Attack Surface: Disables legacy point-and-print background downloads from remote print servers.

Checking Printer Compatibility Before Enabling WPP

Because WPP completely halts third-party driver execution, verify that your networked or USB printers support the universal Mopria or IPP Everywhere standard:

1. Open Settings and navigate to Bluetooth & devices > Printers & scanners.
2. Select your active printer.
3. Under Printer properties, inspect the driver description. If the device lists Microsoft IPP Class Driver or Mopria certified, it is fully compatible with WPP.
4. Most network printers manufactured after 2018 natively support driverless Mopria IPP printing over Wi-Fi and Ethernet.

Enabling Windows Protected Print Mode via Windows Settings

The fastest way to activate WPP on individual workstations is through the Settings app:

1. Open Settings (press Win + I).
2. Navigate to Bluetooth & devices > Printers & scanners.
3. Scroll down to the Printer preferences section.
4. Locate Windows Protected Print Mode and click Set up.
5. Review the security prompt outlining driver restrictions, then click Yes, continue.
6. Restart your computer to finalise the print spooler isolation.

Enabling WPP via Local Group Policy for Enterprise Deployments

System administrators managing Windows 11 Pro, Enterprise, or Education fleets can enforce WPP centrally using Group Policy:

1. Press Win + R, type gpedit.msc, and press Enter to launch the Local Group Policy Editor.
2. Navigate to the following policy path:
   Computer Configuration > Administrative Templates > Printers
3. In the right-hand panel, double-click the policy named Configure Windows Protected Print.
4. Select Enabled.
5. In the options dropdown, ensure Protected Print Mode is on is selected.
6. Click Apply and then OK.
7. Force an immediate policy update by executing gpupdate /force in an elevated terminal prompt.

Verifying Protected Spooler Status

To verify that Windows Protected Print Mode is actively securing your print subsystem, open PowerShell as an administrator and query the registry:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\ProtectedPrint"

If the policy is active, the value ProtectedPrintMode will return 1, confirming that third-party print drivers are completely blocked from loading into memory.