Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Printer Port 9100 Encryption
Transcript
- Lucas: So if you manage enterprise printers on Windows, you might have noticed something in the last couple of months: some older network printers just stopped working after a Windows update. Not a driver issue, not a queue problem. The print job gets sent, the spooler says it completed, but nothing comes out the other end. Luna: I've definitely heard that from IT friends. They blame the printer, replace it, and then the new one works. But it's not the hardware, is it? Lucas: No, it's not. The culprit is a quiet change Microsoft started enforcing in Windows 11 version 24H2, around July of last year, and it's now part of the mandatory security baseline as of this spring. It's about port 9100 encryption. Luna: Port 9100. That's the raw TCP/IP printing protocol, right? The one that's been around since the nineties? Lucas: Exactly. Raw printing over port 9100 is the simplest way to send a print job over a network—it's basically a direct TCP connection with no authentication, no encryption, no negotiation. The printer just receives the data stream and prints it. It's in practically every office printer ever made. And Microsoft has now mandated that any print job sent via port 9100 from Windows 11 must use Transport Layer Security. Luna: Wait, so the operating system is now refusing to send unencrypted print jobs over port 9100? That would break printers that don't support TLS on that port. Lucas: That's exactly what's happening. And it's a lot of printers. Most consumer and small-office printers simply don't support TLS on port 9100. Even some enterprise models from five years ago might have the hardware capability but the firmware doesn't enable it by default. Microsoft's change—which is in the Windows 11 security baseline as of the April 2026 update—means that if the printer doesn't advertise TLS support during the connection handshake, Windows drops the job silently. Luna: Silently. That's the nightmare scenario for IT. Users think they printed, they walk to the printer, nothing there, they print again, nothing. Tickets pile up. Lucas: Right. And the error isn't obvious in the event log either. You'll see an event ID 20 from the PrintService provider with a message like 'Document failed to print. The printer requires encryption.' But a lot of admins don't know to look for that specific event. So they spend hours reinstalling drivers or replacing print servers. Luna: So what's the fix? Is it a Group Policy setting they can disable? Lucas: There is a policy. It's under Computer Configuration > Administrative Templates > Printers. There's a setting called 'Configure port 9100 encryption'—it's not there by default in older policies, it was added in the 24H2 administrative templates. The default is 'Encryption required'. You can set it to 'Encryption optional' to restore the old behavior. But Microsoft has said that in future releases, 'Encryption required' will be the only option, and the policy will be removed. Luna: So this is a temporary reprieve. Long term, they want all print traffic encrypted. Lucas: Yes. And honestly, it's consistent with what they've done with SMB—remember when they started requiring SMB signing and encryption by default? And RDP now requires Network Level Authentication. Microsoft is methodically locking down every legacy protocol that sends data in the clear. Printing over port 9100 is one of the last holdouts. The thing is, it's a real security risk. If you're on a corporate network, anyone with packet capture tools can see everything sent to the printer—including confidential documents, contracts, medical records. Luna: I've never thought about that. I mean, we assume email is encrypted, web traffic is HTTPS, but print jobs are just raw data flying over the wire. Lucas: Exactly. And it's not just the content—the print job metadata often includes usernames, document names, sometimes even network paths. So from a security perspective, requiring encryption is the right thing. But the rollout has been messy because a lot of organizations weren't warned early enough. Luna: What about printers that do support TLS on port 9100? How do you configure that? Lucas: It varies by vendor. On HP Enterprise printers, for example, you can enable it through the embedded web server under Networking > Security > TLS. You need to upload a certificate—either a proper ca signed cert or a self-signed one for internal use. Brother's approach is similar, but they call it 'SSL/TLS' in the network settings. Canon, Xerox, they all have a page where you enable secure printing protocols. The tricky part is that some printers require a firmware update to even expose those settings. And most IT admins have never touched those options because printing 'just worked' before. Luna: So the recommendation for an IT admin today, July 2026, is what? Audit your printer fleet for TLS support, enable it where possible, and set the Group Policy to 'Encryption optional' as a fallback only while you upgrade? Lucas: That's exactly the playbook. First, inventory every network printer and check its firmware version and TLS capabilities. For any printer that doesn't support TLS on port 9100, you have two options: replace it with a model that does, or isolate it on a separate VLAN and use a print server that can do the encryption on behalf of the printer using IPP over TLS. But that's more complex. The simplest path is to set the policy to optional now, and then systematically upgrade or replace non-compliant printers over the next year. Microsoft hasn't announced a hard deadline for removing the optional setting, but I'd bet it's gone by Windows 12. Luna: And what about the Small and Medium Business audience who might not have a dedicated IT person? How do they handle this? Lucas: For smaller businesses, the best bet is to check if their printer vendor has a tool. HP has the HP Print and Scan Doctor, which can test port 9100 TLS connectivity. Brother has a firmware update utility. But honestly, if you're running a small office with a three-year-old $200 printer, it probably doesn't support TLS on port 9100. In that case, you might need to either upgrade the printer or use a different printing method—like IPP or even USB direct connect. Windows still supports IPP printing, and that does support encryption natively. Luna: This is exactly the kind of quiet mandate that catches people off guard. It's not a flashy feature, it's a security baseline change that breaks things silently. Lucas: And that pattern is deliberate. Microsoft is trying to raise the security floor across the entire Windows ecosystem. The problem is that enterprise hardware rotates slowly. Printers can last a decade in some offices. So when the OS changes the rules, there's a painful migration period. But I think most organizations would rather have encrypted print jobs than deal with a data breach because someone sniffed their network traffic. Luna: Yeah, it's the right direction. But the execution could have been better. A clearer warning in Windows Update or a notification in the print dialog would have saved a lot of helpdesk hours. Lucas: Absolutely. And that's why we're talking about it—to spread the word. If you manage Windows clients, check your printers now before the optional policy disappears. Luna: Before we dive deeper into the technical workarounds, I want to touch on something related to how we keep this show going. Lucas and I don't run ads on these episodes. That's a deliberate choice—we want the conversation to be focused, no interruptions. If you find value in these deep dives into Windows enterprise changes, and you'd like to support that, we have a simple page: buy me a coffee dot com slash fexingo. No pressure, just a way to keep the show ad-free. Lucas: Yeah, and we mean that. The coffee link is just there if the show saves you time or helps you avoid a headache. It's not about perks or rewards. It's about keeping the content independent. Now, back to the technical side—one workaround I've seen deployed is to use a print server that runs a print spooler service and connects to the printer via IPP over TLS, then clients connect to the server via standard Windows printing. That way the server handles the encryption, and the printer doesn't need to support TLS. Luna: That's a clever intermediate step. So you're essentially wrapping the unencrypted printer in an encrypted tunnel from the server. Lucas: Exactly. Windows Server can do this with the Print and Document Services role. You set up an IPP print queue that points to the printer's raw port 9100, but the server connects to the printer over a secure channel. Clients then print to the server using standard Windows protocols, which are already encrypted if you have signing enabled. It's a bit more setup, but it buys you time while you phase out older printers. Luna: What about the impact on print performance? Encryption adds overhead. Lucas: For most office printing, the overhead is negligible. TLS handshake adds maybe a few hundred milliseconds per job, and the encryption itself is handled by the CPU, but modern processors handle it easily. On very high-volume print servers handling thousands of jobs a day, you might see a slight increase in CPU usage, but nothing that would bottleneck a typical office. The bigger issue is printer firmware. Some printers have very weak CPUs, and enabling TLS can slow them down significantly. In those cases, the IPP server workaround is better because the server does the heavy lifting. Luna: So the key takeaway: audit, upgrade, or use a server intermediary. And don't assume your printers will just work with the latest Windows 11 updates. Lucas: Exactly. And if you want to test, you can manually try to print from Windows 11 to a printer over port 9100 and see if it fails. The quickest way is to open a command prompt and run 'netstat -an | findstr 9100' while a print job is pending to see if the connection is established. If it's not, and you see the event ID 20, you know encryption is the blocker. Luna: That's a useful diagnostic step. Lucas, do you see any other legacy protocols that Microsoft might target next? We've seen SMB, RDP, now printing. Lucas: I think the next one could be SNMP—Simple Network Management Protocol. Many printers and network devices use SNMP for monitoring, and it's often sent in the clear. Microsoft hasn't made any announcements, but it's a logical next step. Also, the Windows Time Service doesn't use authentication by default, and there have been security advisories about that. So I'd expect more encryption mandates coming in the next two years. Luna: Good to know. We'll keep an eye on that. For now, if you're dealing with printer issues post-Windows 11 update, check port 9100 encryption first. Lucas: That's the episode. Thanks for listening.