The complete guide to Windows Protected Print (WPP)

Windows Protected Print Mode (WPP) is a security-enhanced printing platform for Windows that runs with lower privileges and uses Internet Printing Protocol (IPP) to eliminate the need for third-party drivers. Together, these remove significant security risks that can lead to attackers gaining SYSTEM-level access.

Whether you’re an IT manager, security professional, or business owner, understanding the impact and benefits of WPP is essential as it changes the landscape of print infrastructure. This page provides a comprehensive overview of WPP, its timeline, and how your organization can prepare for and benefit from this powerful security feature.

According to Microsoft , 9% of Windows security issues reported to the Microsoft Security Response Center (MSRC) were caused by print stack-related issues. The fact that the spooler runs with system privileges and has to load code over the network makes the entire Operating System vulnerable to malware.

Print Nightmare allowed hackers to exploit this vulnerability to install programs remotely, view and delete data or even create new user accounts with full user rights. Another spooler-related weakness was exploited by the Stuxnet virus, which was used as a digital weapon to gain remote access to the computers that controlled centrifuges at an Iranian uranium enrichment plant. This allowed the attackers to configure the fast-spinning centrifuges to tear themselves apart.

Print Nightmare patches are a temporary workaround that now requires admin rights to install printers. The admin rights requirement only protects a shared computer, where one user might have installed a printer driver with malware that would compromise others on the computer too. This change doesn’t fix the spooler privilege issue that is exploitable by a driver with malware, and it introduces user experience issues by forcing admin privileges just to install printers.

The proper solution is Windows Protected Print mode, as it removes the fundamental flaw of drivers and moves the world of printers forward to finally settle on the IPP standard. At PaperCut, we support Microsoft’s decision, even though it will cause some adoption friction.

As an aside, Windows isn’t the only operating system plagued by a vulnerable print platform. CUPS, used in Linux, macOS, and ChromeOS, also has a long history of security issues. In September 2024, new reports showed how it is possible to remotely execute code on a Linux computer without requiring authentication. Some Linux distributions, like Ubuntu, are planning to limit access to the rest of the operating system by moving CUPS into a containerised Snap App.

WPP uses modern standards and secure communication methods to ensure a robust and consistent printing experience. Here are some of the key details.

1. Printer and job delivery is based on Internet Printing Protocol (IPP)
   • WPP uses IPP as the core transport protocol - a well-established, open standard that provides a framework for printer discovery, job submission, and status tracking.
   • IPP allows WPP to support advanced features such as finishing options, job status updates, and access control, enabling a richer printing experience.
   • The port monitor used when adding a WPP print queue is Microsoft’s new IPP port, which provides a richer set of IPP functions.
2. No more third-party printer drivers and modules
   • WPP forces a driverless printing model. When it’s enabled, client computers can no longer load third-party printer drivers, eliminating the risk of attackers loading malicious code.
   • In addition to the printer drivers, the loading of other, less well-known modules, such as third-party print providers , is blocked.
   • WPP prevents Point and Print from ever installing third-party printer drivers. This eliminates the risk of an attacker pretending to be a printer and tricking users into installing malicious software.
3. Common print spooler tasks are now run at lower privilege level
   • Since the drivers are no longer required to run as SYSTEM, most common spooler tasks can now run as USER.
   • This reduces the risk of a rogue or a buggy program taking down the whole machine. The impact will be limited to actions only the user can perform.

When you switch on Windows Protected Print, the existing print queues and drivers on the computer will be permanently deleted. You won’t get them back if you decide to switch WPP off. It is an all-or-nothing setting.

You can’t use a driver for some printers while using Windows Protected Print mode for others. If WPP is enabled, print drivers are nonexistent.

Not all printers are equal. Based on a sample of thousands of printer models we assessed, roughly 70% of printers will work seamlessly over IPP. For the rest, they will either function with reduced speed, lower quality or not at all.

Existing scripts that system admins may have in use, such as printui scripts to manage printers, won’t work anymore.

Mopria has an online list of certified printers you can use to check your printer models.

Although a printer could be listed as Mopria-certified, it doesn’t necessarily mean it will work with WPP or that you will get the most out of your printer once you switch over to using IPP in WPP mode.

At the time of writing, Windows Protected Print Mode deems some IPP attributes mandatory, even though they are technically specified as optional according to Mopria standards, such as the hardware ID. Additionally, WPP requires some IPP values to be in a specific format that some printers do not follow.

Some printers that support IPP don’t necessarily support PDF-based spool files; instead, they only support formats like URF/raster or JPEG. This still follows the specification, but these spool files will be much larger and often print in lower quality. In addition to being larger, these formats require the entire print job to be submitted to the printer before the printer can start printing them, which results in slower printing or even failure to print larger documents as the printer can’t store the entire print job.

For now, the best way to confirm that your printer is ready for WPP is to enable WPP on a test Windows machine and printing to it. Check different finishing options, especially more advanced options like stapling and tray selection if the printer supports it.

We are making changes in PaperCut MF / NG and PaperCut Hive / Pocket to support printers that are WPP ready and also printers that are not WPP ready. Early Access sign-ups will be available early October 2024.

Alternatively, if your printers are not ready, your printer manufacturer may soon provide a firmware update if your printers are not too old, so keep an eye out.

Enable WPP mode via Settings

2. Click ‘Set Up’. Windows will display a warning message.

3. Additionally, if WPP-incompatible print queues (such as standard TCP/IP queues) were already installed, Windows would warn that they would be removed.

4. After successful completion, WPP should be turned on.

Enable WPP mode via Group Policy

Via Group Policy Editor > Administrative Templates > Printers > Configure Windows protected print > Edit

Note that these dates are subject to change:

• 1 October 2024: Microsoft releases WPP in release 24h2, switched off by default
• Early November 2024: first PaperCut MF / NG WPP release planned
• January 2025: first PaperCut Hive / Pocket WPP release planned
• 2027: WPP is switched on by default

See the official Microsoft Windows Protected Print announcement