How to Enable/Disable Windows Protected Print Mode in Intune

Start by logging into the Microsoft Intune admin center to create your Windows Protected Print Mode policy. This centralized console manages all device configurations across your organization.

Open your web browser and navigate to the Intune admin center:

https://endpoint.microsoft.com/

Once logged in, navigate to Devices > Configuration > Create > New policy. Select Platform: Windows 10 and later and Profile type: Templates > Custom.

Set up the foundational details for your Windows Protected Print Mode policy. Clear naming conventions help administrators understand the policy's purpose and scope.

In the Basics tab, configure these fields:

• Name: Windows Protected Print Mode - Enable (or "Disable" if creating a disable policy)
• Description: Enables Windows Protected Print Mode to restrict printing to Mopria-certified devices for enhanced security
• Platform: Windows 10 and later (already selected)
• Profile type: Custom (already selected)

Click Next to proceed to the configuration settings.

Configure the core OMA-URI setting that controls Windows Protected Print Mode. This method provides precise control over the WPP functionality.

In the Configuration settings tab, click Add to create a new OMA-URI setting:

• Name: Configure Windows Protected Print
• Description: Controls Windows Protected Print Mode state
• OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Printers/ConfigureWindowsProtectedPrint
• Data type: String
• Value: <enabled/> (to enable WPP) or <disabled/> (to disable WPP)

The OMA-URI path is case-sensitive and must be entered exactly as shown. This setting leverages the Windows Configuration Service Provider (CSP) for printer policies.

Assign the policy to specific device groups while considering the operational impact of Windows Protected Print Mode on your environment.

In the Assignments tab:

1. Click Add groups under Included groups
2. Select your target groups (start with a pilot group of 10-20 devices)
3. Consider excluding groups with legacy printers under Excluded groups
4. Review the assignment summary

Example assignment strategy:

Included groups:
- IT-Pilot-Devices
- Executive-Laptops
- Conference-Room-PCs

Excluded groups:
- Manufacturing-Workstations
- Legacy-Printer-Users
- Critical-Production-Systems

Complete the policy creation process and monitor the initial deployment to ensure successful application across your target devices.

In the Review + create tab:

1. Review all configuration details
2. Verify the OMA-URI path and value are correct
3. Confirm assignment groups are appropriate
4. Click Create to deploy the policy

After creation, monitor the deployment status:

1. Navigate to Devices > Monitor > Device configuration
2. Find your Windows Protected Print Mode policy
3. Check the Device status and User status tabs

Policy application typically occurs within 8 hours for standard check-ins, or immediately if you trigger a manual sync.

Confirm that Windows Protected Print Mode is properly configured on target devices using both registry checks and user interface verification.

On a target device, open PowerShell as Administrator and run:

Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Name "EnableWindowsProtectedPrintMode"

Expected output for enabled WPP:

EnableWindowsProtectedPrintMode : 1
PSPath                         : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Printers
PSParentPath                   : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT
PSChildName                    : Printers
PSDrive                        : HKLM
PSProvider                     : Microsoft.PowerShell.Core\Registry

Also verify through the Windows Settings interface:

1. Open Settings > Bluetooth & devices > Printers & scanners
2. Click Printer preferences
3. Look for Windows protected print setting (should be grayed out/enforced)

Validate that Mopria-certified printers continue to function while non-certified devices are properly restricted or removed.

Perform these tests on devices with WPP enabled:

1. Test Mopria-certified printers: Print a test page to confirm functionality
2. Check removed printers: Verify non-Mopria printers no longer appear in the printer list
3. Test print queue: Ensure print jobs process normally for certified devices
4. Verify XPS/Fax impact: Check if Microsoft XPS Document Writer or Windows Fax were removed

Use this PowerShell command to list current printers:

Get-Printer | Select-Object Name, DriverName, PortName | Format-Table -AutoSize

Document the results in a testing matrix:

Printer Name          | Mopria Certified | Status After WPP
---------------------|------------------|------------------
HP LaserJet Pro M404 | Yes              | Working
Canon PIXMA TR8620   | Yes              | Working
Old Epson Dot Matrix | No               | Removed
XPS Document Writer  | N/A              | Removed

Prepare a disable policy to quickly rollback Windows Protected Print Mode if issues arise or when legacy printer support is temporarily needed.

Follow the same process as the enable policy, but with these key differences:

1. Name: Windows Protected Print Mode - Disable
2. Description: Disables Windows Protected Print Mode to restore legacy printer compatibility
3. OMA-URI Value: <disabled/>

Assign the disable policy to a separate group initially (don't overlap with the enable policy assignments):

Disable Policy Assignment:
- WPP-Rollback-Group (empty initially)
- Legacy-Printer-Required-Users
- Emergency-Disable-Devices

To perform a rollback:

1. Move affected devices from the enable policy group to the disable policy group
2. Wait for policy application (or force sync)
3. Reinstall required legacy printer drivers
4. Re-enable XPS/Fax if needed via Optional Features

Establish ongoing monitoring and maintenance procedures to ensure Windows Protected Print Mode continues to meet your security and operational requirements.

Set up regular monitoring tasks:

1. Policy Compliance: Check Intune reports weekly for policy application failures
2. Printer Inventory: Maintain updated lists of Mopria-certified devices
3. User Support: Monitor help desk tickets related to printing issues
4. Security Events: Review Event Viewer logs for WPP-related entries

Use this PowerShell script to generate a compliance report:

# Check WPP status across domain computers
$computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name
$results = @()

foreach ($computer in $computers) {
    try {
        $wppStatus = Invoke-Command -ComputerName $computer -ScriptBlock {
            Get-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers" -Name "EnableWindowsProtectedPrintMode" -ErrorAction SilentlyContinue
        }
        $results += [PSCustomObject]@{
            Computer = $computer
            WPPEnabled = if ($wppStatus) { $wppStatus.EnableWindowsProtectedPrintMode } else { "Not Configured" }
            Status = "Online"
        }
    } catch {
        $results += [PSCustomObject]@{
            Computer = $computer
            WPPEnabled = "Error"
            Status = "Offline"
        }
    }
}

$results | Export-Csv -Path "WPP-Compliance-Report.csv" -NoTypeInformation