Windows Protected Print in the Enterprise Environment

Microsoft names three fixed dates for changes to the provision and maintenance of third-party printer drivers. For enabling Windows Protected Print (WPP) by default, by contrast, there is so far no date. The driver deadlines do not mean a blanket shutdown of existing printers.

For your planning this means: check both the continued support for your existing drivers and the adjustments required for WPP. Allow enough time for tests with your line-of-business applications and business-critical print processes.

Microsoft: Timeline and answers on continued driver use

Microsoft: FAQ on enabling WPP by default in the future

The “Configure Windows protected print” policy is documented for Windows 11 from version 24H2 in the supported editions. For Intune, Microsoft names the OMA-URI
./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint.

Assess servers separately

The WPP policy documentation does not name Windows Server 2025 itself. The end-of-servicing plan for third-party drivers names it explicitly (“For Windows 11+ and Windows Server 2025+”), and the enterprise page addresses servers as well:

„By ensuring that both your client and servers have Windows protected print mode turned on, you can take full advantage of the security and reliability benefits it offers.“

The mention of Windows Server 2025 in the driver maintenance timeline alone does not imply WPP approval for every server configuration. Check the operating system version, the available policies and the approvals of your applications – in particular for print servers, SAPSprint and virtual workstations – including the question of how WPP behaves toward print queues that already exist.

Microsoft: Supported versions and printer policies

Yes. Your IT can use Group Policy (GPO) or Microsoft Intune to control on which supported Windows systems Windows Protected Print (WPP) is enabled and which remain excluded for the time being. This allows WPP to be introduced step by step while driver-based print processes that are still required continue to operate.

GPO stands for Group Policy Object. In it, IT bundles settings for Windows computers and assigns them centrally, for example within an Active Directory domain. Microsoft Intune is Microsoft’s cloud-based service for managing devices and their settings. With it, IT does not have to carry out the WPP configuration individually at each workstation.

For WPP, Microsoft documents the policy “Configure Windows protected print”. By assigning and configuring it, IT can limit a rollout to specific devices. Which management path is suitable depends on how the respective systems are managed and which operating system version is used.

A temporary exception can be, for example, a shipping workstation with a label printer driver that is still required. A SAPSprint host – that is, the Windows computer on which the SAPSprint service runs – is also a candidate if it outputs SAP print data via a third-party printer driver. For such a host, the support for the Windows version in use and the approvals for SAPSprint must additionally be checked; not every server can be managed via the same paths as a Windows workstation.

Such an exception gives you time for tests and adjustments. Record why it is needed, who is responsible for it and when you will review it again. Take into account the continued driver maintenance and the manufacturer’s support.

The WPP setting applies to the respective Windows system. A single printer with a third-party driver cannot be enabled separately within an active WPP mode.

Microsoft: Managing WPP with Group Policy and Intune

Microsoft: WPP policy and supported Windows versions

Assess every model together with its connection method and the functions it needs. A vendor list is not sufficient for this: even within a single product line, devices and firmware levels can differ.

Mopria certification provides a starting point for assessing compatible devices. What matters is the entry for the specific model. A manufacturer’s membership in the Mopria Alliance does not imply compatibility for its entire portfolio.

Evidence: Mopria membership and individual model certification

 

Label printing. The leading specialist vendors for industrial label printing – Zebra, Honeywell, SATO, TSC, Bixolon – are not members of the Mopria Alliance. Only those who join the Alliance at least as an adopter can certify. Members such as Brother, Epson or Toshiba Tec also carry industrial label printers in their portfolio; for these device classes, however, no Mopria certifications are listed.

 

How this finding is classified matters more than the finding itself: it is a market signal, not a technical barrier. Joining is open to any manufacturer. But anyone who bases their planning on this device category being certified in the future is planning on an intention that no manufacturer has declared so far

 

Large format and production printing. Several manufacturers that build plotters and production systems are Mopria members, and individual devices are certified. What matters here is a detail that makes a fleet assessment by brand useless: Certification follows the individual model, not the manufacturer and not the product line. Several HP DesignJet models are on the Mopria list, as are Canon imagePROGRAF PRO and Epson SureColor SC-P – but not the actual CAD and roll plotters from the same manufacturers.

 

What is missing in this category is therefore not the transport path. It is the control depth – and that used to reside in the driver, not in the device.

 

Mopria Alliance: Member Companies – Mopria Alliance: Mopria Certification

For label, CAD and production printing, you should also clarify which functions are currently handled by the application, the driver or the device. Only then can you assess whether a different connection method, a software adjustment or a device replacement makes sense.

Mopria: Search for certified devices

IPP also supports functions for finishing print jobs, for example via the attributes finishings-supported, finishings-default and finishings-col-database. What is decisive is which functions the device provides and which of them your application, Windows and a possible Print Support App actually use.

IPP Everywhere and Mopria are different certification programs. The test scope of one program does not allow any general conclusion about the other. For your operations, a functional test with the documents and settings actually used therefore counts as well.

Evidence: what the certification procedure tests – and what it does not

In the IPP Everywhere self-certification procedure (PWG 5100.20), finishing is not tested. The procedure covers DNS-SD discovery, IPP protocol conformance and the document formats PWG Raster, JPEG and PDF; the term “finishings” does not appear anywhere in the document.

 

The specification is stricter than its test procedure: IPP Everywhere v1.1 lists finishings-supported, finishings-default and finishings-col-database as conditionally required – “CONDITIONALLY REQUIRED for Printers with finishers”. A device with a finisher that does not publish the attributes therefore does not conform to the specification, but fails no test procedure.

 

The scope that the Mopria certification program tests beyond the open PWG procedures is not publicly documented. A finishing test can therefore not be inferred – but neither can the opposite be proven. For fleet planning, that is precisely the point: the statement “our devices are Mopria-certified” does not answer the question of functionality. It has to be measured per model and per firmware level.

 

PWG 5100.20: IPP Everywhere Printer Self-Certification Manual v1.1

In depth: Which functions do I lose with the IPP-based driver? Stapling, hole punching, tray selection and finishing in detail, including an assessment procedure using ipptool.

How to make the test meaningful

Query the device’s IPP properties, for example using ipptool . Compare them with the visible print options and the actual printout. For multifunction devices, include the scanning process in the test as well.

PWG: IPP Everywhere v1.1

Microsoft: additional functions via Print Support Apps

Many document workflows use a virtual printer: in the print dialog, employees select an archive or a PDF output, for example. If such a solution requires an unsupported printer driver, it cannot continue to run unchanged after WPP is activated.

Virtual printers are not ruled out under WPP in principle, however. Microsoft’s Print Support App architecture allows vendors to provide virtual printers as an MSIX app without classic V3 or V4 third-party drivers. This does not automatically make existing driver-based solutions compatible; the vendor has to develop and provide an accordingly adapted version.

One example that is already available is “OneNote (Desktop) – Protected virtual printer“. Microsoft documents that this virtual printer is installed by default in all OneNote Windows app versions from 2410 onwards under Windows 11 from version 26100 onwards; in our tests it continues to run with WPP enabled as well. It enables output to OneNote, but it does not replace an arbitrary PDF, archiving, email or fax solution.

Microsoft: OneNote as a virtual printer under WPP – retrieved on 16 September 2026

For existing driver-based solutions, however, the Print Support App architecture does not mean a migration but a reimplementation as an MSIX app. Whether and when an individual vendor takes this route depends on the manufacturer and has to be clarified case by case. For these workflows, you should ask the respective vendor about a WPP-compatible version and its range of functions.

Virtual printers are the most frequently overlooked part of the problem. PDF writers, “print to archive”, “print to email” and fax queues are not special cases from the perspective of Windows, but printer drivers – and therefore third-party drivers. In the same step, Microsoft also removes its own driver-based virtual printers.

This is the point at which WPP stops being a printing topic. Anyone who archives via a virtual printer today does not have a printing problem, but a document process chain attached to a Windows component that is being removed.

Also record what happens after the print command: is only a file created, or are documents indexed, archived and forwarded? A replacement has to cover the entire workflow.

Take digital workflows into account as well

A missing archive printer can interrupt a business process even though no paper is produced. Therefore include those responsible for DMS, archiving and line-of-business applications in the inventory

Microsoft: architecture for virtual printers without third-party drivers

Both common patterns are affected: the path via model-specific drivers that have to be installed on the VDA or terminal server, and the path via a universal driver. The second is not the better way out that it appears to be at first glance – a universal printer driver is also a printer driver from the perspective of Windows and therefore subject to WPP.

In article CTX223749, Citrix documents supported combinations of V3 and V4 drivers. However, this overview is not a WPP compatibility commitment. It is therefore not sufficient for assessing whether your current Citrix configuration is suitable.

Evidence: what Citrix documents – and what follows from it

 
In its support matrix for the Microsoft driver architectures, Citrix lists the V3 path as a supported scenario:

 

„Using V3 printer drivers on all VDAs, UPS and Receiver for Windows endpoints continues to be a supported scenario“

 
and explicitly rules out the reverse:

 

„Using a native V4 printer driver on both the VDA and the Client is not a supported scenario.“

 
The combination documented by Citrix as supported therefore relies on third-party drivers. And WPP removes third-party drivers – whether V3 or V4.

 

Two qualifications go with this. The Citrix article carries no date and evidently dates from the period before WPP; it is not a WPP statement from Citrix. And it is a support matrix, not a reference architecture. What is therefore reliable is only the observation that the documented path builds on drivers that WPP no longer permits.

Record the releases, print policies and connection paths in use. Coordinate with the manufacturer on which configuration is approved, and test typical sessions including printer mapping, logon and output from the line-of-business applications.

Plan the rollout across all systems involved

EA WPP rollout in a Citrix landscape is not a client topic. It affects the VDA, the Universal Print Server and the endpoint at the same time. A change on the endpoint device can affect printing from a session. Whether and which further components are affected follows from your specific architecture.

Supported V3/V4 driver combinations

The pressure to act is highest in this group, because here the highest process criticality meets the lowest compatibility. In warehousing, shipping and manufacturing, printouts are often an integral part of the process. Therefore prioritize the workflows in which a missing label or a faulty drawing would interrupt work.

Label printing

Many label printers process languages such as ZPL or EPL. These languages are not part of the IPP class driver stack, and the specialist vendors in this segment are not Mopria members. If the data stream is generated by a Windows vendor driver, this path is affected when WPP is enabled. If the application generates the data itself and sends it to the printer over a direct TCP raw path (raw socket), the Windows printer driver is not involved in this workflow. This path does have to be assessed per application, however, and cannot be administered via Windows Print Management – it solves the problem for individual processes, not for the fleet.

The most common case in warehousing and shipping environments is the packing station workstation that outputs labels from SAP EWM or WM via a Windows queue. Without a label, no shipping process continues; the outage is more expensive than with any office printer.

Also check barcodes, label dimensions, print speed and the feedback to the application. For a direct connection, administration, access rights and monitoring have to be organized as well.

Large format and CAD

Plotters and CAD output devices are not part of the target segment of WPP. Drawing output from Teamcenter, AutoCAD or SolidWorks also regularly relies on driver-side logic – missing roll formats, scale, pen assignment, roll selection, fold marks – for which there is no equivalent in the IPP core.

With drawings, more than a legible output is at stake. Test scale, line widths, roll selection, trimming and folding from your actual applications, for example AutoCAD, SolidWorks or Teamcenter. Which functions are available via IPP and supplementary software depends on the particular system.

IPDS, AFP and mainframe output

Production printing with IPDS or AFP follows its own control logic with a back channel and page integrity. The IPP-based driver does not cover it, and there is currently no known cloud print offering that addresses IPDS or AFP.

These environments use specialized data formats and processing steps. Check which component generates, transmits and, where applicable, converts the data. A switch to the IPP-based driver does not automatically replace this processing.

For every process a suitable solution

Clarify together with the application and device vendors whether the functions remain available through a compatible connection or whether additional preparation of the print data is required. A blanket statement for the entire device class would be too imprecise for this.

All three areas share one characteristic: they do not fit the model “Windows client speaks IPP to a certified MFP”. They cannot be fixed at the endpoint – neither by a firmware update nor by a Print Support App, because the device does not offer the function via IPP and the PSA cannot create it.

A replacement can make sense, if an older office device does not support the required IPP connection and is due to be replaced anyway. Have the required functions confirmed for the successor model and test them.

A replacement alone may not help, if the driver has so far been preparing documents, controlling paper trays section by section or forwarding data to an archive. These tasks must continue to be handled by a suitable component with a new printer as well.

With label printers, plotters, CAD output devices and production printers it does not help at all: For these categories there is no successor model that solves the problem, because the device category is not certified. Here a refresh shifts the budget without restoring the function.

The sound sequence is therefore not “assess the fleet, then replace”, but: first classify processes and data streams, then decide which part is a hardware topic and which is an architecture topic. The second category is not reduced by any procurement process.

Therefore assess the requirements of the business processes first. On that basis you can decide where a software update, a changed connection or new hardware delivers the greatest benefit.

WPP reduces the attack surface of the Windows print system. This includes excluding third-party drivers and additional protective measures, such as reduced permissions for certain spooler tasks.

The Windows print stack has been a known attack surface for years – PrintNightmare is the most prominent example. Third-party drivers run with high privileges, and their quality lies outside the operator’s control. Removing them and moving the print path into a mode with lower privileges is an understandable gain.

For a secure overall system you must additionally define who is allowed to output which documents, how jobs are transmitted and logged, and how confidential printouts are protected at the device. Check these requirements along the entire output path. In regulated environments these are the requirements examined in an audit – and they remain just as open after WPP is activated.

WPP is therefore a hardening of the driver model, not a print security strategy. Supplementary measures can include, for example, access controls, encrypted connections and authenticated print release at the device.

Microsoft: Security measures in WPP mode

1   Record print and document processes

List the applications from which documents are output: Office, ERP and SAP, PLM and CAD, DMS, archive and further line-of-business applications. Also record digital targets such as PDF and archive.

2   Trace preparation and handover

For each workflow, clarify where print-ready data is created and how it reaches the device. Take drivers, queues, conversions and required additional functions into account.

3   Document the systems involved

Record operating system and software versions, drivers, devices, firmware and WPP status. This also includes SAPSprint, Citrix and cloud print manager hosts.

4   Classify device categories and data streams

Mopria/IPP-capable MFPs, older office devices, ZPL/EPL label printers, plotters and large format, IPDS/AFP, virtual targets. For the IPP-capable devices it is worth querying the attributes with ipptoolto see which functions are actually published.

5   Test real workflows

In a suitable test environment, check the new printer setup and the WPP activation. Use typical documents with all required settings. Also keep a way of restoring the previous configuration available.

6   Prioritize measures by process relevance

Not “which device is affected”, but “which process comes to a standstill”. A label printer at the shipping station and an office printer in administration appear equivalent in the device list – in the prioritization they are not. Assess the consequences of a disruption together with the business departments. Document the required adjustments, the people responsible and the deadlines. Have the tested workflows confirmed by the respective process owners.

The result is a traceable overview: which workflows already work, which need adjustments, and where are approvals or tests still missing? On this basis you can justify effort, budget and rollout sequence. It is useful regardless of when Microsoft activates WPP by default – and it is the prerequisite for even asking the cost question seriously.