Who broke printing

Suspect 01 — Windows Protected Print

Driver Model & Spooler Isolation

1.1 Running third-party print drivers on Windows Server?

e.g. vendor-specific PCL/PS drivers not supplied by Microsoft

Required

1.2 Drivers updated since January 2026?

Windows Protected Print enforcement began rolling out in early 2026

Required

Suspect 02 — The Architecture Gap

Windows on ARM & Apple Silicon Heterogeneous Fleets

2.1 Deploying Windows on ARM devices into your fleet?

Includes Surface Pro X, Lenovo ThinkPad X13s, and similar Snapdragon devices

Required

2.2 Managing Apple Silicon Macs printing via older, Intel-built drivers?

Rosetta-translated drivers may silently fail on M-series Macs

Required

Suspect 03 — Printing in Zero Trust Environments

Network Micro-Segmentation & Discovery

3.1 Deployed Zero Trust network segmentation or micro-segmentation?

Network policies that restrict lateral traffic between endpoints and printers

Required

3.2 Has automatic printer discovery stopped working for any users recently?

mDNS/WS-Discovery may be blocked by segmentation policies

Required

Suspect 01

Exposed Worth checking Not currently exposed

Windows Protected Print (WPP)

High Notice — third-party drivers or missing updates put this environment in the WPP blast radius.

Moderate Notice — server environment has legacy drivers or pending update cycles. Review Mopria IPP compatibility.

Low Risk — current driver and update posture does not indicate a WPP collision.

How the removal of legacy v3/v4 driver frameworks alters printer discoverability and secure print queue routing.

Keep watching Microsoft’s protected print rollout and re-run this diagnostic after the next driver cycle.

Read the dossier

Suspect 02

Exposed Worth checking Not currently exposed

The Architecture Gap

Fleet Alert — Windows on ARM or Apple Silicon clients are already in the fleet with legacy print paths.

Fleet Notice — mixed processor architectures present in parts of the environment. Audit client print daemons.

Low Risk — no mixed-architecture print path was reported.

How mixed x86/x64 architectures can break print service discovery and daemon communication across the fleet.

Revisit this if Windows on ARM or Apple Silicon clients join the fleet.

Read the dossier

Suspect 03

Exposed Worth checking Not currently exposed

Printing in Zero Trust Environments

High Notice — segmentation or discovery failures are already blocking print paths.

Review Notice — Zero Trust or discovery changes may be affecting printer visibility.

Low Risk — no active network discovery blocks reported on current subnets.

Network policies that restrict lateral traffic between endpoints and printers can silently break mDNS and WS-Discovery.

mDNS/WS-Discovery may be blocked by segmentation policies.

Following years of PrintNightmare vulnerabilities, Microsoft is disabling traditional Type 3 and Type 4 drivers in favor of IPP.

Read the dossier

Want the full report emailed to you?

Plus get notified whenever Microsoft, Apple, or zero trust vendors push new print architecture updates. No sales calls, no gating.

Get the report

Complete the diagnostic to unlock your report

Answer all 6 questions above to generate a personalised threat assessment for your print infrastructure.

Start diagnostic

Analysing your responses...

Building a personalised threat assessment from the 6 diagnostic answers.

Watch all episodes in YouTube

GET THE REPORT

Ready to find out who broke printing, and how to fix it?

Download the ‘2026 Report on the State of the Modern Print Stack’.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Who broke printing?

Windows Protected Print (WPP)

The Architecture Gap

Printing in Zero Trust Environments

Watch the investigation

Ready to find out who broke printing, and how to fix it?