Configure the Windows Settings Catalog policy Turn off downloading of print drivers over HTTP and set it to Enabled. This blocks Windows from retrieving non-local print-driver packages over HTTP. It does not disable printing to HTTP printers, remove drivers already installed, or replace Point and Print security controls.
Microsoft exposes the device policy as ./Device/Vendor/MSFT/Policy/Config/Connectivity/DisableDownloadingOfPrintDriversOverHTTP for Windows Pro, Enterprise, Education and IoT Enterprise editions from Windows 10 version 1709 onward. See the Connectivity Policy CSP.
What the policy controls
The setting concerns one specific operation: downloading a print-driver package that is not already installed locally over HTTP. When enabled, that retrieval is prohibited.
| Control or scenario | What happens |
|---|---|
| Downloading a non-local print driver over HTTP | Blocked when this policy is enabled. |
| Printing to an Internet or intranet printer over HTTP | Not blocked by this policy. |
| Using an inbox, pre-staged or already installed driver | Can continue to work. |
| Point and Print from a print server | Governed by separate Point and Print and driver-installation policies. |
| Administrator-installed drivers | Controlled separately from this setting. |
Microsoft documents the distinction in the Connectivity Policy CSP and the ADMX_ICM Policy CSP. Do not confuse this setting with Turn off printing over HTTP, which is a different policy that prevents printing to Internet printers over HTTP.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall#1 Best Overall
Supported scope and Windows versions
Device policy
The recommended organizational baseline is the device-scoped policy:
./Device/Vendor/MSFT/Policy/Config/Connectivity/DisableDownloadingOfPrintDriversOverHTTP- Scope: Device
- Supported editions: Pro, Enterprise, Education, IoT Enterprise and IoT Enterprise LTSC
- Minimum documented version: Windows 10 version 1709
- Data type: String/character format
The CSP supports Add, Delete, Get and Replace operations. Microsoft also documents a user-scoped ADMX-backed variant, ./User/Vendor/MSFT/Policy/Config/ADMX_ICM/DisableWebPnPDownload_1, for supported Windows 10 releases beginning with version 2004 (with the documented update requirement) and Windows 11 version 21H2 and later. Use the user variant only when user-level targeting is intentional.
Rank #2
- Affordable Versatility - A budget-friendly all-in-one printer perfect for both home users and hybrid workers, offering exceptional value
- Crisp, Vibrant Prints - Experience impressive print quality for both documents and photos, thanks to its 2-cartridge hybrid ink system that delivers sharp text and vivid colors
- Effortless Setup & Use - Get started quickly with easy setup for your smartphone or computer, so you can print, scan, and copy without delay
- Reliable Wireless Connectivity - Enjoy stable and consistent connections with dual-band Wi-Fi (2.4GHz or 5GHz), ensuring smooth printing from anywhere in your home or office
- Scan & Copy Handling - Utilize the device’s integrated scanner for efficient scanning and copying operations
Administrative Template and registry mapping
The underlying Administrative Template setting is in Computer Configuration → Administrative Templates → Windows Components → Internet Communication Management → Internet Communication settings. Its mapping is:
ADMX file: ICM.admx
ADMX setting: DisableWebPnPDownload_2
Registry key: HKLMSOFTWAREPoliciesMicrosoftWindows NTPrinters
Value: DisableWebPnPDownloadConfigure the policy in Intune
- Open the Intune admin center, go to Devices → Configuration, select Create, and create a policy for Windows 10 and later using the Settings catalog profile. Microsoft’s procedure is described in Use the Settings Catalog.
- Select Add settings and search for the exact phrase
Turn off downloading of print drivers over HTTP. Select the result under Internet Management → Internet Communication settings. Intune labels can change, so searching by the full phrase is more reliable than relying on menu placement. - Set Turn off downloading of print drivers over HTTP to Enabled. The wording is counterintuitive: enabling the policy enables the restriction, so HTTP driver downloading is disabled. Microsoft states that Disabled or Not configured allows the download.
- Give the profile a clear name, review its settings, and assign it first to a pilot device group. Include shared-printer users, print-server connections and standard-user devices in the pilot.
- After testing, assign the profile to production groups and use exclusions for documented exceptions. Check for overlapping Intune profiles, domain Group Policy and unintended user-scoped assignments.
For built-in Administrative Template controls, the Settings Catalog is preferable to a custom OMA-URI: it supplies the policy representation without requiring you to build an ADMX payload. See Microsoft’s ADMX settings in the Settings Catalog guidance.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- Affordable Versatility - A budget-friendly all-in-one printer perfect for both home users and hybrid workers, offering exceptional value
- Crisp, Vibrant Prints - Experience impressive print quality for both documents and photos, thanks to its 2-cartridge hybrid ink system that delivers sharp text and vivid colors
- Effortless Setup & Use - Get started quickly with easy setup for your smartphone or computer, so you can print, scan, and copy without delay
- Reliable Wireless Connectivity - Enjoy stable and consistent connections with dual-band Wi-Fi (2.4GHz or 5GHz), ensuring smooth printing from anywhere in your home or office
- Scan & Copy Handling - Utilize the device’s integrated scanner for efficient scanning and copying operations
Verify deployment
Check Intune first
- Open the profile’s device and per-setting status and confirm the target device reports success.
- On the endpoint, use Settings → Accounts → Access work or school → select the work account → Info → Sync.
- Review MDM diagnostic reports and relevant Windows event logs if the status is pending or failed.
- Run
gpresultwhen domain Group Policy is also present, because another management source can configure the same setting.
Check the local policy mapping
This PowerShell command reads the documented machine-level registry location:
Get-ItemProperty `
-Path 'HKLM:SOFTWAREPoliciesMicrosoftWindows NTPrinters' `
-Name DisableWebPnPDownload `
-ErrorAction SilentlyContinueA configured value should correspond to the enabled restriction. Do not treat immediate registry visibility as universal proof of Intune application: MDM processing can be delayed, policy translation can vary by build, and Group Policy or another tool may have written the value.
Rank #4
- AFFORDABLE ALL-IN-ONE FOR HOME AND HOME OFFICE: Print, copy, and scan on one compact wireless printer designed for everyday home office printing, schoolwork, documents, and reports. Produce beautiful prints for results that stand out.
- EASY TO USE WITH CLOUD APP CONNECTIONS: Print from and scan to popular Cloud apps(2), including Google Drive, Dropbox, Box, OneDrive, and more from the simple-to-use 1.8” color display on your printer.
- FULL-SIZE FEATURES IN A COMPACT DESIGN: This printer includes automatic duplex (2-sided) printing, a 20-sheet single-sided Automatic Document Feeder (ADF)(3), and a 150-sheet paper tray(3). Engineered to print at fast speeds of up to 16 pages per minute (ppm) in black and up to 9 ppm in color(4).
- MULTIPLE CONNECTION OPTIONS: Connect your way. Interface with your printer on your wireless network or via USB.
- MOBILE PRINTING MADE EASY: Go mobile with the Brother Mobile Connect app(5) that delivers easy onscreen menu navigation for printing, copying, scanning, and device management from your mobile device. Monitor your ink usage with Page Gauge to help ensure you don’t run out(6).
What it does not block
- It does not turn off printing over HTTP. Use the separate Turn off printing over HTTP policy for that requirement.
- It does not uninstall drivers that are already present.
- It does not block every printer installation method, including inbox drivers, pre-staged packages, administrator deployment or non-HTTP server protocols.
- It is not a complete Point and Print or PrintNightmare mitigation.
Troubleshoot a printer that fails after rollout
- Confirm the affected device is assigned the profile and that Intune reports the setting successfully.
- Sync the device and recheck policy status.
- Determine whether the printer workflow attempts to retrieve a missing driver over HTTP.
- Check whether an inbox, package-aware or previously staged driver is available locally.
- Identify whether the connection uses an approved print server, SMB, RPC or another deployment path instead of HTTP.
- Stage an approved driver through Intune, PowerShell or another software-distribution method, then retry the printer connection.
- Check for conflicting profiles, Group Policy and vendor deployment tools.
- If business operations are blocked, temporarily exclude a small pilot group while correcting the deployment process; do not disable the control globally as the first response.
A printer may still install even when the policy is enabled because its driver is already local, supplied by Windows, installed by an administrator or delivered through a different protocol. Conversely, a legacy Internet Printing workflow may fail because it depended on HTTP driver retrieval.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Companion controls for printer security
Use this setting as defense in depth, not as a complete printer policy. Consider:
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- Wireless Bluetooth Printer: Portable thermal printer compatible with iPhone, Android phones, iPad and tablet computers via Bluetooth. For smartphones, please download the "Nada Print" App. You can also connect to laptops and computers for printing using a USB-C cable. (Note: Laptops and computers can only be connected via USB and require the installation of a driver first. Bluetooth connection is not supported.)
- No-ink printing: Only supports US Letter and A4 size thermal paper.(Doesn't support regular paper) The no-ink portable thermal printer uses direct thermal technology, requiring no ink, toner or ribbons, making it environmentally friendly, cost-effective and time-saving. The thermal printer package comes with a roll of US Letter thermal printing paper. Note: When installing the paper, remember to switch the paper size switch on APP
- Clear Print: NDYIN N80 portable thermal printer adopts high-definition printing technology, with a 203DPI resolution to provide you with clear printing results. This mobile printer is compatible with roll paper, folded paper and tattoo transfer paper, supporting printing from your mobile phone PDF, Word, pictures and web pages anytime and anywhere. It is recommended to use our NDYIN thermal paper to achieve good printing quality
- Portable wireless printer for travel: The thermal printer is equipped with a built-in 1500mAh rechargeable battery, which can print 160 sheets of 8.5" x 11" thermal paper after being fully charged. It weighs only 1.5 pounds and is compact in size. This ink-free portable printer can be easily carried in a backpack or briefcase! It is perfect for business travel, cars, small offices, construction sites, schools and homes. You can print documents, contracts, invoices and boarding passes anytime and anywhere
- The N80 thermal printer has a wide range of uses. The package includes the N80 printer, a roll of US Letter paper(7m/roll), a user manual, a guide card, a type-C soft cable and a type C adapter. Note: The charging adapter is not included. Special thermal paper is required for use; ordinary paper cannot be used. This ink-free portable thermal printer is suitable for various scenarios such as home, school, travel, office, and outdoor, meeting the printing needs of different groups of people. This tattoo template printer is also compatible with tattoo transfer paper, making it an ideal choice for tattoo art
- Point and Print Restrictions to limit approved servers and control prompts.
- Package Point and Print only to require package-aware drivers and signature validation where compatible; see Microsoft’s ADMX_Printing Policy CSP.
- RestrictDriverInstallationToAdministrators to limit driver installation to administrators on supported Windows versions.
- Approved print-server lists, driver-signature controls and driver-exclusion policies.
Microsoft documents Point and Print settings in the Printers Policy CSP. The post-2021 security changes described in KB5005010 and KB5005652 are separate from this HTTP-download restriction.
Approved alternatives to arbitrary HTTP driver retrieval
Pre-stage drivers with Intune
Package a tested vendor driver as a Win32 app, PowerShell deployment or other approved application. Install it before mapping the printer, and add detection and remediation logic where practical. This makes versions, elevation and assignments auditable, but packaging remains vendor-specific and must be tested for dependencies and spooler behavior.
Use package-aware drivers and approved servers
Combine package-aware drivers with restricted print servers and administrator-only installation. Test each printer model because compatibility and vendor features differ.
Evaluate modern print platforms
Universal Print and other modern Windows print capabilities can reduce legacy driver retrieval, but they are not automatic replacements for every on-premises or branch-office design. Evaluate printer compatibility, required features, cloud connectivity, licensing, offline operation and existing server investments. Microsoft’s overview is Modern print platform.
Recommended rollout
Enable the Settings Catalog control on a representative pilot, verify printer installation and driver-update workflows for standard users, then expand by device group. Keep approved drivers pre-staged and document exceptions. The policy is a focused reduction of HTTP-based driver retrieval; its strongest result comes when paired with controlled print servers, package-aware drivers and administrator restrictions. Security benchmarks such as the CIS Intune for Windows 11 benchmark and government guidance such as the Australian Cyber Security Centre hardening guide treat it as one control within a broader baseline.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
