Windows Protected Print (WPP)

What is WPP?

Windows Protected Print (WPP) is a secure printing mode introduced by Microsoft in October 2024. It enhances print security by using the Microsoft IPP Class Driver and is designed to work with Mopria-certified printers. A list of Mopria-certified printers can be found on the Mopria website. WPP modernizes the print infrastructure by eliminating the need for traditional print servers and vendor-specific drivers, offering simplified, secure, and driverless printing experience.

WPP forces the use of the Microsoft IPP Class Driver for secure print queues. When enabled:

  • Legacy and third-party drivers are disabled for print queues.

  • Print jobs are encrypted and sent using IPP to Mopria-certified printers.

HP Insights Support for WPP

The Print Scout component of the HP Insights has been updated to support the new WPP mode with Secure Print printing.

Windows Protected Print mode is supported on Windows 11 24H2 or later. It supports Intel or Arm architecture. This flowchart shows how the system chooses which print driver to use, based on the type of computer processor (Intel or ARM) and whether Windows Protected Print (WPP) is turned on or off.

Windows on Arm-based Devices

For Arm-based PCs, enabling or disabling WPP does not have effect on the Print Scout installation. HP Insights will always use the Microsoft IPP driver. For more information on Windows Arm support, refer to the Windows Arm64 Support document.

Windows on Intel-based devices

For Intel-based systems, if WPP is enabled, HP Secure Printer uses the Microsoft IPP driver. If WPP is disabled, it defaults to the HP IPP Driver.

Below are known issues related to WPP mode on Windows 11 2H42 Intel machines.

Make sure to enable WPP first before installing Print Scout 8.0 on Intel machines

Enabling WPP after Print Scout 8.0 is installed creates two instances of the HP IPP Driver because Windows restores the old HP IPP Driver. Users will end up with HP IPP Driver with the HP IPP Driver as well as the new HP Secure Printer with Microsoft Class IPP Driver. This may confuse users. HP Insights recommends enabling WPP first before installing Print Scout 8.0 to prevent this issue from occurring.

If Print Scout is already installed, HP recommends the following steps in Windows 11 when recreating the HP Secure Printer after WPP is turned on.

  1. Uninstall the existing Print Scout installation.

  2. Reboot the workstation.

  3. Turn on Windows Protected Print (WPP) mode.

  4. Install the latest Print Scout.

Upgrading to Print Scout 8.0 is not recommended if WPP is enabled

Upgrading from older versions of Print Scout to version 8.0 or later is discouraged when WPP is enabled. We recommend a fresh installation of the Print Scout 8.0 to avoid potential issues.

Known Issues and Limitations

  • Fresh install: It’s advisable to start with a fresh install of Windows 11 24H2 machines. Enabling WPP first before installing Print Scout can help avoid issues such as the reappearance of the 'HP Secure Printer' queue.

  • Multi-Tenant Package Setup: Queue removal and re-adding of queues may not work when switching regions on Arm-based devices or on machines with Windows Protected Print mode enabled.

Note: We are partnering with Microsoft to address the issue. Stay tuned for updates.

Enabling or disabling Windows Protected Print (WPP)

WPP can be enabled in three ways:

  • Printers and Scanners in Settings

  • Group Policy

  • Registry Settings

Enable WPP via Settings

  1. Navigate to Settings > Bluetooth & devices > Printers & scanners.

  2. Find the "Printer preferences" section, and select "Set Up" next to Windows Protected Print mode.

  3. Click Yes, Continue to confirm the activation of WPP.

  4. Windows will uninstall any incompatible queues (e.g. IPP queues, third party queues).

  5. Windows Protected Print will be enabled.

Group Policy

Group Policy Path: Computer Configuration > Administrative Templates > Printers > Enable Windows Protected Print

  1. Open Group Policy Management Console.

  2. Go to Computer Configuration > Administrative Templates > Printers.

  3. Find and set Enable Windows Protected Print to Enabled.

  4. Apply the GPO to the target organizational unit (OU).

  5. Run gpupdate /force on client machines or reboot.

Registry Key

Registry Key: HKLM\Software\Policies\Microsoft\Windows NT\Printers\EnableWPP (DWORD: 1 = Enabled, 0 = Disabled)

  1. Open Registry Editor.

  2. Navigate to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers.

  3. Create a new DWORD (32-bit) Value: EnableWPP

  4. Set the value to 1.

  5. Restart the machine to apply changes.

Once WPP is enabled, all existing print queues and print drivers are removed, and printing will only be possible with Mopria certified printers using the Microsoft IPP Class Driver.