Windows Protected Print Mode

Microsoft is moving Windows printing from third-party print drivers to Windows Ready Print, a driverless model based on the Internet Printing Protocol (IPP). Windows Ready Print uses the Microsoft IPP Class Driver with Mopria-certified printers. Manufacturers can add device-specific features through Print Support Apps (PSA).

Windows Protected Print Mode (WPP) is a Windows setting that allows only Windows Ready Print. It is available on Windows 11 24H2 and later. Microsoft has stated that WPP will be enabled by default at a future date but has not announced a date. To enable or disable WPP, see the Microsoft documentation: Windows protected print mode and, for Group Policy and Intune, Windows protected print mode for enterprises.

This page describes how WPP and Microsoft's driver changes affect MyQ X, and what to check before and after you enable WPP. Even without WPP, Microsoft's end-of-servicing plan for third-party drivers already changes how new vendor drivers are signed and installed.

What WPP Changes

When WPP is enabled on a workstation:

• Printers that use third-party drivers (PCL, PostScript, or other v3/v4 drivers) are uninstalled, and third-party drivers cannot be installed.

• Printers that use the IPP Class Driver are kept. This includes IPPS printers that point to MyQ queues.

• Unsupported software printers are removed, such as Microsoft XPS Document Writer, Fax, and the classic OneNote (Desktop) printer.

• Scanning works only on Mopria-certified scanners.

• The workstation cannot use Print Management to manage print servers that have WPP disabled.

Turning WPP off does not restore removed printers. Reinstall them manually, or let MyQ Desktop Client provisioning reinstall them.

Third-Party Print Drivers

Microsoft is ending servicing for third-party printer drivers on Windows 11 and Windows Server 2025 and later. This affects every workstation that still uses vendor drivers, whether WPP is on or off.

Existing Microsoft-signed drivers can still be installed.

Driver ranking. The July 2026 change is controlled by the Group Policy Computer Configuration > Administrative Templates > Printers > Configure Windows Ready Print driver ranking. It is on unless configured otherwise. It affects only new printer installations: if users add a printer and get the IPP Class Driver instead of the vendor driver, this setting is the reason.

Manufacturer-signed drivers. Many new vendor drivers are signed with the manufacturer's own certificate instead of by Microsoft. Windows installs them silently only if that certificate is in the workstation's Trusted Publishers store. Otherwise MyQ Desktop Client printer provisioning fails. See Provisioning Manufacturer-Signed Windows Print Drivers. Under WPP, signing makes no difference, because all third-party drivers are blocked.

Impact on MyQ X

IPPS queues keep working under WPP and are the supported way to print to MyQ from WPP-enabled workstations. Workstations must trust the MyQ server certificate.

Print options. By default, MyQ IPPS queues offer standard options: copies, color mode, duplex, page range, paper size, and basic stapling and punching. In MyQ X 10.3, IPP pass-through lets direct and pull print queues present the IPP capabilities of a selected printer. Users then get options such as detailed stapling and punching or tray selection in the standard print dialog. See Jobs via IPPS.

Device Spooling uses RAW ports and does not work on WPP-enabled workstations. Plan an alternative for sites that rely on it. See Spooling Strategy.

MyQ Desktop Client provisioning. Printer Provisioning Profiles that use the built-in IPPS driver (MyQ X 10.2 patch 21 and later) work under WPP. Profiles that deploy vendor drivers fail with Configuring printers failed. See Troubleshoot Printer Provisioning with WPP.

Before Enabling WPP

Whether and when to enable WPP is your organization's decision. Enabling WPP uninstalls printers that use third-party drivers, so prepare your MyQ environment first. This also prepares you for when Microsoft enables WPP by default.

1. Inventory print paths. Find which workstations use vendor drivers, standard TCP/IP or LPR ports, Device Spooling, or IPPS. List ARM64 workstations separately.

2. Check your devices. Confirm which models are Mopria-certified and which finishing and tray options users need on each.

3. Deploy IPPS queues and test them. Use MyQ X 10.3 with IPP pass-through where users need advanced options. Test output for each device model before you remove standard queues.

4. Switch MDC provisioning to IPPS. Update Printer Provisioning Profiles to the built-in IPPS driver. In Central/Site environments, do this on every Site that workstations connect to.

5. Until then, manage driver certificates for vendor drivers that are still in use.

6. Replace Device Spooling where it is used.

7. Enable WPP on a pilot group first, using the method in the Microsoft documentation linked above, and run the checks below before you roll it out further.

After Enabling WPP

1. In Settings > Bluetooth & devices > Printers & scanners, confirm that WPP shows as on and that only compatible printers remain.

2. Print a test job to each IPPS queue. Confirm that the job appears under the correct user in the MyQ Web Interface. On pass-through queues, also confirm that the expected options appear in the print dialog.

3. If you use MDC provisioning, select Update my printers in MyQ Desktop Client. Confirm that no Configuring printers failed notification appears. If it does, see Troubleshoot Printer Provisioning with WPP.