Windows 11 26H2 Gets New Security Baseline for Printers and TLS

Microsoft has released a new security baseline package for Windows 11 version 26H2, giving IT administrators updated security recommendations for testing and deploying the operating system.

The new baseline introduces two main changes involving printer driver selection and encryption protocol support. Microsoft has made the package available through the Microsoft Security Compliance Toolkit.

Windows 11 26H2 prioritizes the Windows Ready Print driver

Microsoft recommends enabling Printer\Configure Windows Ready Print driver ranking, which makes Windows prefer its native IPP class driver over third-party printer drivers, including vendor V3 and V4 drivers.

According to Microsoft, prioritizing the IPP class driver can reduce the printer-related attack surface associated with third-party OEM drivers.

The policy applies when users install printers through IPP-compatible connection methods, including USB connections and network multicast discovery.

Printers without IPP support remain unaffected. The change also does not apply to printers installed directly as TCP/IP printers.

TLS 1.1 support is removed from the baseline

Windows 11 26H2 also changes the Turn off encryption support policy by removing TLS 1.1 from the list of supported protocols, meaning the policy now supports only TLS 1.2 and TLS 1.3.

Microsoft considers TLS 1.1 obsolete and recommends that enterprises stop relying on the older encryption protocol.

If you haven’t got the update yet, there’s a Windows 11 26H2 Enablement Package available.

Via Neowin