Printer troubleshooting technician providing live chat help

Joe B.

Reviewed for technical accuracy

Specialities: Windows printing (v3/v4), WDAC/Device Guard, Code Integrity logs, catalog/INF signing, Point and Print hardening, pnputil/Add-PrinterDriver

Windows blocks unsigned PPD/INF — WDAC (Device Guard) policy, package-aware drivers, catalog (.cat) signing & safe overrides

Technician avatar Technician
Let’s stabilize your print deployment under Device Guard / WDAC. When Windows reports “blocked due to policy” or “unsigned PPD/INF”, it’s usually Application Control (Code Integrity) rejecting a non-signed print driver package or a raw PPD without a trusted catalog (.cat).
Quick check: Windows version/edition, how you install (Point and Print, print server, or local pnputil /add-driver), exact model, and recent Event Viewer → Applications and Services Logs → Microsoft → Windows → CodeIntegrity → Operational events (IDs like 3077/3089).
Customer
Windows 11 Enterprise with WDAC enforced. We push a PS driver with a custom PPD. Install fails unless we disable the policy. Event log shows Code Integrity blocking unsigned files; Point and Print now asks for admin.
Technician avatar Technician
That tracks. Since the Point and Print security changes, only admins can install or update printer drivers, and WDAC further restricts what binaries and driver package files may load. A naked PPD or non-package-aware v3 driver without a trusted catalog signature will be blocked. We’ll: 1) move to a package-aware signed driver (v3 package-aware or v4 class), 2) if you must keep the custom PPD, generate a catalog and sign it, 3) add a FilePublisher or Hash allow rule to WDAC, 4) stage via pnputil with admin.
Customer
We have a vendor v3 package, but our customized PPD isn’t signed. How do we sign the whole thing so WDAC trusts it?
Technician avatar Technician
Step 1 — Make the driver package-aware & create a signed catalog
• Ensure the INF declares a package-aware driver (so Windows validates the .cat across all files including the PPD).
• Build a catalog with inf2cat (or OEM build chain), then sign the .cat using a trusted code-signing cert (signtool sign /fd SHA256 /tr http://timestamp /td SHA256).
• Do not sign the PPD directly — Windows trusts the .cat that hashes the PPD/INF/DLLs. Import the issuing CA to Trusted Root on devices if it’s internal PKI.
Customer
WDAC still blocks during staging. We’re deploying with Intune; policy is Enforced. What allow rule should we add?
Technician avatar Technician
Step 2 — Add a WDAC allow
In your App Control for Business / WDAC policy, add a FilePublisher rule that trusts your signer (the cert that signed the .cat). That whitelists updated builds without re-hashing each file.
If you can’t sign with a vendor or corporate cert, use a Hash rule for the catalog and core binaries as a temporary measure. Deploy in Audit first, confirm via CodeIntegrity → Operational, then flip to Enforce.
Customer
Can we bypass Point and Print prompts for users? They can’t approve the driver install.
Technician avatar Technician
Since 2021 changes, installing or updating print drivers via Point and Print requires admin. The supportable path is: pre-stage the signed package with admin using pnputil /add-driver <INF> /install /reboot or via your MDM as system. Users then connect without installing new code. Avoid legacy overrides that weaken security.
Customer
We’re on an older OEM v3 set. Should we move to a v4 class or the Windows IPP class driver instead?
Technician avatar Technician
If the OEM offers a v4 class or modern package-aware v3 that’s Microsoft-signed or vendor-signed with a trusted catalog, take it — fewer moving parts under WDAC. For custom features tied to your PPD, keep v3 but ensure the whole package is catalog-signed and trusted by policy.
Customer
Any way to test without breaking users? We need evidence before enforcing.
Technician avatar Technician
Yes — deploy the updated WDAC policy in Audit mode first. Install your catalog-signed driver, stage with pnputil, then review CodeIntegrity → Operational for “would be blocked” events. Once clean, switch to Enforce. Keep a signed rollback policy handy.
Customer
What exact steps should my packaging team follow from zero to done?
Technician avatar Technician
Packaging checklist
1) Get the OEM’s latest package-aware driver or ensure INF has package entries.
2) Place INF/PPD/DLLs in a build folder → run inf2cat for your OS list → sign the generated .cat with a trusted cert (signtool).
3) Import the issuing CA into devices (if internal PKI).
4) Update WDAC: add a FilePublisher allow for your signer; deploy in Audit → verify logs → move to Enforce.
5) Stage as SYSTEM/admin: pnputil /add-driver *.inf /install. Distribute via Intune/ConfigMgr.
6) Users map printers — no new code install prompts.
Customer
After signing the catalog and adding a FilePublisher allow, install works without disabling WDAC. Looks good!
Technician avatar Technician
Summary: WDAC/Device Guard isn’t a bug — it’s enforcing driver/package signing. Use a package-aware driver, generate and sign a catalog that covers your PPD/INF, then allow the signer in App Control. Stage with pnputil, not user prompts. Need hands-on help packaging or editing your WDAC XML? Open the chat.

Quick answer: the accepted fix

Accepted fix for “Device Guard blocks unsigned PPD”: switch to a package-aware driver, generate a catalog (.cat) with inf2cat, sign it (trusted code-signing cert), add a FilePublisher allow in WDAC, then stage via pnputil /add-driver /install. Avoid disabling policy; pre-stage so users don’t see Point and Print prompts.

Why WDAC blocks unsigned PPD/INF (Code Integrity, driver signing, Point and Print)

Windows Defender Application Control (Device Guard) enforces code integrity—only trusted, signed code and driver packages can load. A loose PPD or mixed vendor files without a valid catalog signature fail validation. Since 2021, Point and Print requires admin for driver installs; combine that with WDAC and you must pre-stage a signed, package-aware driver or approve it via policy.

Validation: audit first, then enforce

Deploy your updated WDAC policy in Audit. Install the catalog-signed driver, then check Event Viewer → CodeIntegrity for would-block vs allowed events. If clean, enforce the policy. Keep a signed rollback policy and document your signer thumbprint for future driver refreshes.

Packaging & security best practices

Keep security posture while enabling printer deployments.

Prefer vendor v4 class or package-aware v3 drivers with trusted catalogs. Sign customizations via the package .cat, not per-file. Use FilePublisher rules over Hash to future-proof updates. Stage drivers as SYSTEM with pnputil; avoid weakening Point and Print policies.

Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, mechanics, vets, and more.

Expert will respond in minutes

We match you with an Expert who specializes in your situation. Talk, text, or chat — whichever you prefer.

Save time & money

No scheduling hassles or expensive consults. Membership can save you significant time and money each month.

FAQ

Does Device Guard block PPD files specifically or the whole driver?

WDAC (App Control) evaluates the driver package. If your PPD/INF/DLLs aren’t covered by a trusted catalog, Code Integrity blocks the install or load, which looks like “unsigned PPD”.

What’s the supportable override when users can’t install printers?

Pre-stage a catalog-signed package as admin (pnputil /add-driver /install) and add a FilePublisher allow in WDAC. Avoid disabling policies or weakening Point and Print.

Do we need to sign the PPD itself?

No. Generate and sign the catalog (.cat) that includes a hash of the PPD, INF, and related binaries. Windows trusts the catalog signature.

Is moving to a v4 class driver required?

Not required, but recommended if available. v4 or modern package-aware v3 drivers with trusted catalogs deploy cleaner under WDAC.

Sources

Matt Verified Icon
Matt ● replies in < 1 min
Technician Expert
⭐⭐⭐⭐⭐ Trusted by 27,000+ customers
Avatar
Alex · Expert's Assistant
5 Tech Support Specialists are online right now.