Windows Protected Print Mode blocks v3/v4 drivers on Windows 11 24H2. Runbook to check status, fix 0x00000709 and 0x00000BC4, deploy WPP via GPO or Intune, and plan the driver deprecation.
Windows Protected Print Mode (WPP) is a Windows 11 print stack that runs printing outside the legacy spoolsv.exe process, disables third-party v3/v4 print drivers, and requires printers to speak the IPP protocol with a Mopria-compatible Print Support App. If your users hit "printer not found," 0x00000709, "driver unavailable," or the printer install button is greyed out after upgrading to Windows 11 24H2 or Windows Server 2025, WPP is almost certainly the reason. This guide is the runbook I actually give my Tier 1 team, so it's opinionated in the places where the docs are vague.
WPP is on by default for new Windows 11 24H2 installs when the device has never had a v3/v4 driver, and Microsoft is progressively expanding that default through 2026 servicing updates.
WPP blocks ALL third-party v3 and v4 print drivers. Only inbox IPP class drivers and Mopria-compliant Print Support Apps (PSAs) from the Microsoft Store are permitted.
You can't toggle WPP per-printer. It's a machine-wide policy configured via Settings > Bluetooth & devices > Printers & scanners > Printer preferences, GPO (Printers node), Intune Settings Catalog, or the registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\RpcAuthnLevelPrivacyEnabled plus WindowsProtectedPrintMode.
PrintNightmare (CVE-2021-34527) and its 2024–2025 follow-ups are the reason WPP exists. It eliminates the entire class of spooler RCE vectors by removing arbitrary driver loading.
Universal Print, Mopria, and network-shared IPP queues remain fully supported under WPP. SMB/RPC-hosted printer shares with v3 drivers do not.
Rolling back WPP requires disabling the policy, restarting the Print Spooler, then re-adding printers. Old queues become non-functional stubs until you re-install them.
What is Windows Protected Print Mode?
Windows Protected Print Mode is a new print subsystem Microsoft introduced with Windows 11 23H2 and made the default install experience in 24H2. Instead of the classic spooler loading vendor-supplied kernel-adjacent drivers, WPP routes every print job through IPP (Internet Printing Protocol) and hands rendering off to a Mopria-standard Print Support App running in a low-privilege user context. The spooler process still exists, but its attack surface is drastically reduced. No filterpipelineprintproc.dll, no v3 monolithic drivers, no arbitrary Add-Printer from remote shares.
In my environment, the switch was invisible for users printing to modern Mopria printers over TCP/IP, and painful for anyone still on a shared \\PRINTSERVER01\HP4250 queue with an OEM driver. The tradeoff is exactly what Microsoft's threat model wants: the entire PrintNightmare class of vulnerabilities becomes uninstallable, because the plumbing that made them possible is gone.
Expected behavior when WPP is active: Get-Printer returns only IPP class drivers, Add-PrinterDriver silently fails for non-inbox drivers, and any attempt to install from a UNC path with rundll32 printui.dll returns error 0x00000BC4 ("The specified printer driver is currently in use").
How to check if WPP is enabled on a device
First, always confirm the actual state before you troubleshoot the symptom. I've seen at least three tickets where someone assumed WPP was off because the GPO said so, and it turned out a co-managed Intune policy was overriding it. Honestly, that lesson only sticks after you've burned an afternoon on the wrong diagnosis. Here's the one-liner I keep in my runbook:
Values: WindowsProtectedPrintMode = 1 means enabled. ConfiguredBy = 1 means "administrator/policy," and 0 means "user chose it in Settings." A missing key means WPP is off and the device is on the legacy stack. Cross-check the UI at Settings > Bluetooth & devices > Printers & scanners > Printer preferences > Let Windows protect your printing environment. If the toggle is greyed out, policy is winning.
For a whole fleet, wrap the check in a Configuration Manager or Intune proactive remediation and report on the two registry values plus Get-CimInstance Win32_OperatingSystem | Select-Object BuildNumber, UBR, because behavior differs between 24H2 builds 26100.2033 (opt-in default) and 26100.4061+ (progressively enforced default).
How to enable Windows Protected Print Mode
So, there are three supported ways to enable WPP, and one unsupported registry hack I don't recommend. Pick the mechanism that matches how you manage the device.
Interactive (single machine)
Open Settings > Bluetooth & devices > Printers & scanners.
Scroll to Printer preferences and expand it.
Toggle Let Windows protect your printing environment (recommended) to On.
Windows will remove every non-IPP printer from the queue list. Reboot when prompted (technically only a spooler restart is required, but a reboot is cleaner).
Group Policy (domain-joined)
Go to Computer Configuration > Administrative Templates > Printers > Configure Windows protected print. Set it to Enabled. This requires the Windows 11 24H2 or later ADMX templates. If you don't see the setting, copy Printing.admx and Printing.adml from a 24H2 reference machine into your Central Store at \\domain.local\SYSVOL\domain.local\Policies\PolicyDefinitions.
Intune Settings Catalog (managed)
In Intune, go to Devices > Configuration > Create > New Policy, Platform: Windows 10 and later, Profile type: Settings catalog.
Search for Windows Protected Print in the Printers category.
Set Configure Windows Protected Print to Enabled.
Assign to a pilot device group first. WPP is machine-scoped, not user-scoped.
How to disable Windows Protected Print Mode
To turn WPP off, reverse whichever mechanism enabled it. In Settings, toggle the switch to Off. In GPO, set Configure Windows protected print to Disabled (not "Not configured", because "Not configured" leaves the last state in place). In Intune, set the Settings Catalog value to Disabled and force a sync.
Then restart the spooler so the legacy stack loads:
# Run as admin
Stop-Service Spooler -Force
Start-Service Spooler
Get-Service Spooler | Select-Object Status, StartType
Expected output: Status: Running, StartType: Automatic. Now re-add printers using their original v3/v4 driver packages. Note that any printers listed with the "Print" queue but 0 KB driver footprint are ghost entries from the WPP session, so remove them via Remove-Printer -Name "PrinterName" before re-installing.
If WindowsProtectedPrintMode is stuck at 1 in the registry even after a GPO change, run gpupdate /force /target:computer, then verify with gpresult /h C:\Temp\gp.html /f that the "Configure Windows protected print" policy shows the winning GPO. A CSP policy from Intune outranks a GPO, so check Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin for CSP events matching ./Device/Vendor/MSFT/Policy/Config/Printers/.
Why is my printer not working after Windows 11 24H2?
The single most common ticket in my queue after the 24H2 wave was "my printer disappeared." The cause is nearly always one of these five, in rough order of frequency:
Legacy driver blocked: The queue was installed with a vendor v3 driver (HP Universal, Xerox Global, Konica UPDPCL). Under WPP, it's unloaded on next boot and the queue becomes non-functional. Fix: remove the printer, then re-add it using Add printer > The printer I want isn't listed > Add a printer using a TCP/IP address or hostname and let Windows install the inbox IPP class driver.
SMB print share unreachable: Under WPP, \\SERVER\printername only works if the server hosts the queue via IPP (Windows Server 2022+ with Print and Document Services role in IPP mode). Migrate print servers to Universal Print or reconfigure the server queue for IPP publishing.
Point and Print prompt loops: Group Policy Point and Print Restrictions combined with CVE-2021-34527 hardening requires admin credentials on install. Under WPP the install path changes, and the elevation prompt sometimes never surfaces. Fix: install once as admin, then let users connect.
USB printer needs a PSA: Older USB multifunction devices without a Print Support App show up as "Unspecified" in Devices. Search the Microsoft Store for the vendor's PSA (e.g., "HP Print Service Plugin", "Canon Print Service", "Brother Print Service").
Non-Mopria network printer: Very old LaserJets and Kyoceras from before 2015 speak only RAW/9100 with vendor-specific PDLs. They won't work under WPP. Either replace them, or run a Universal Print connector on a supported server to translate.
See the complete printer troubleshooting guide for the pre-WPP checklist that still applies to server-side issues, print jobs stuck in queue, and cross-platform macOS printing.
Print Support Apps (PSA) and Mopria explained
A Print Support App is a UWP/Store app that a printer vendor ships to expose device-specific features (tray selection, finishing, secure release, meter reads) on top of the IPP baseline. It replaces the classic v3 print driver and the v4 "printer extension" model. PSAs run in the low-privilege AppContainer sandbox, so a malicious print job can't pivot to SYSTEM the way a compromised v3 driver could.
Mopria is the industry certification for IPP printers, maintained by the Mopria Alliance. If a printer is on the Mopria Certified list, it works with the inbox Windows driver under WPP with zero installs. Every major vendor (HP, Canon, Epson, Brother, Xerox, Lexmark, Konica Minolta, Ricoh) certifies at least their post-2018 models.
To find the right PSA for a device:
# List currently installed Print Support Apps
Get-AppxPackage | Where-Object { $_.Name -like '*PrintService*' -or $_.Name -like '*PrintSupport*' } |
Select-Object Name, PackageFullName, Publisher
Expected output for an HP-equipped device: Name: HPInc.HPPrintService, Publisher: CN=HP Inc.. If the PSA is missing, deploy it via Intune's Microsoft Store app integration to your printer users. PSAs are per-user, so include them in your Autopilot user ESP profile.
Windows Update stopped shipping new third-party v3/v4 drivers
September 2025
New printer models must ship as Mopria+PSA. No new driver downloads via Update Driver from Windows Update.
Windows Update stopped shipping updates to existing v3/v4 drivers
September 2026
Existing drivers remain installable from vendor sites but no longer receive security patches through WU.
Windows Update fully removes v3/v4 driver listings
2027 (staged)
Any device relying on WU delivery for a v3 driver will fail to auto-install on OS reset.
WPP becomes the enforced default on all supported Windows 11 SKUs
Progressive through 2026–2027
New installs and clean upgrades default to WPP-on. Opt-out remains available via policy.
For enterprise planning, inventory your fleet now. This PowerShell snippet, run remotely via Invoke-Command or as an Intune remediation, tells you exactly what drivers are in play across your estate:
Rows where MajorVersion is 3 or 4 and Manufacturer is not Microsoft are your remediation targets. Cross-reference against the Mopria Certified list to decide whether to replace hardware or deploy a PSA.
Deploy WPP via GPO and Intune at scale
Rolling out WPP org-wide is a phased project, not a flag flip. In my last engagement we shipped it over eight weeks with three rings, and the process below is what actually worked (after two false starts I'd rather not repeat).
Ring 1: IT and pilot users (week 1–2)
Enable WPP on the IT team's own devices first. Use Intune Settings Catalog with a device group scoped to lab machines. Verify: users can print to at least one Mopria network printer, one Universal Print queue, and one USB printer via PSA. Document any vendor gaps.
Ring 2: Non-print-heavy business units (week 3–5)
Expand to teams with light printing needs (sales, marketing, execs). Deploy required PSAs as required Microsoft Store apps in Intune ahead of the policy assignment. Confirm the Group Policy troubleshooting baseline first. A broken GPO chain will silently skip the WPP setting, and you'll waste a week chasing ghosts.
Ring 3: Print-heavy departments (week 6–8)
Legal, finance, operations. These teams almost always surface an edge case (label printers, check printers, batch envelope stuffers) that needs vendor engagement. Have your Intune device enrollment process solid so replacement devices ship WPP-ready via Autopilot.
Common WPP error codes and fixes
These are the error codes that actually show up in my ticket queue after a WPP rollout, with the fix I've verified works. Order is by frequency, not severity.
0x00000709 — "Cannot connect to printer"
Under WPP this now usually means the source queue is on a legacy driver. Confirm on the print server: Get-Printer -Name "queue" | Select DriverName. If DriverName is not "Microsoft IPP Class Driver" or a Mopria class name, the queue is incompatible. Fix by republishing via IPP or migrating the queue to Universal Print.
0x00000BC4 — "The specified printer driver is currently in use"
Triggered when you try to install a v3 driver on a WPP-enforced client. Not a real "in use" situation. It's the WPP block returning a legacy error code, which is confusing on purpose. Fix: either disable WPP for this device via policy or use the inbox IPP class driver.
0x00000006 — "The handle is invalid" (during Add-Printer)
Almost always a stale queue that was migrated during the WPP flip. Clear it: Remove-Printer -Name "queue", restart Spooler, re-add. If the queue reappears via GPO Printers preference item, verify the preference targets a Mopria-compatible driver.
Event ID 372 in Microsoft-Windows-PrintService/Admin
"The print spooler failed to load a plug-in module." Under WPP this event fires when a v3 driver's rendering DLL is denied load. Cross-reference the DLL path in the event details with your driver inventory, and remove the driver package with Remove-PrinterDriver -Name "..." to stop the noise.
Event ID 4098 in Group Policy/Operational
"The user 'Group Policy Printers' preference item did not apply because it failed with error code..." Almost always a Point and Print restriction interaction. Review the linked GPO and confirm printer deployment via GPO Preferences is targeting IPP queues, not RPC/SMB queues.
Frequently Asked Questions
Is Windows Protected Print Mode enabled by default in Windows 11 24H2?
It depends on the install path. Clean installs of Windows 11 24H2 on devices with no prior v3/v4 drivers default to WPP on. Upgrades from 23H2 or earlier preserve the existing state, so WPP stays off unless you enable it. Microsoft is progressively expanding the default-on scope through 2026 cumulative updates.
Can I still use my old printer driver in 2026?
Yes, if WPP is off on the device. Legacy v3 and v4 drivers remain installable from vendor sites and continue to work on the classic print stack. What ends is Windows Update delivery, so new driver versions and security fixes stop shipping through WU on the September 2026 milestone. If you enable WPP, only the inbox IPP class driver and Mopria PSAs will function.
What is a Print Support App (PSA)?
A Print Support App is a Microsoft Store app from the printer vendor that exposes device-specific features (tray, finishing, secure release) on top of the IPP baseline. PSAs run sandboxed in AppContainer instead of loading kernel-adjacent drivers, which is why they're safe under WPP. HP, Canon, Brother, Epson, Xerox, and Lexmark all publish PSAs.
How do I know if my printer is Mopria certified?
Check the Mopria Alliance certified products search at mopria.org. As a rule of thumb, network printers manufactured after 2018 from major vendors are Mopria certified. If Get-Printer shows the DriverName as "Microsoft IPP Class Driver" after install, the device is Mopria-compliant in practice.
Does Windows Protected Print Mode work with Universal Print?
Yes. Universal Print is built on IPP, so it's fully compatible with WPP. In fact, running Universal Print for network queues plus WPP on clients is Microsoft's recommended long-term topology, since it eliminates both print server driver management and client-side driver risk.
Will WPP break my label printers and specialty devices?
Often, yes. Zebra ZPL, Dymo, Brady, and older thermal receipt printers frequently use vendor-specific PDLs and driver stacks that aren't IPP-native. Before enabling WPP for a department using such devices, confirm with the vendor that a PSA or Mopria-certified firmware exists. If not, exclude those devices from WPP via a scoped Intune policy.
Troubleshoot Intune Remote Help licensing, RBAC scopes, EPM elevation, and session errors. Real KQL, PowerShell, and network fixes from a helpdesk lead.
Fix Windows Server 2025 hotpatch failures the way I do in production: Azure Arc enrollment checks, baseline drift diagnostics, WSUS/WUfB conflicts, and clean rollback steps with PowerShell and CBS.log queries.
Close AVD tickets faster in 2026 with PowerShell, KQL, and portal steps for session host registration, RDP Shortpath, Entra ID join, FSLogix, App Attach, and autoscale plans.
