RpcAuthnLevelPrivacyEnabled: what it does and when to change it

Applies to: Windows 11, Windows 10 and Windows Server that share printers.

What RpcAuthnLevelPrivacyEnabled does

When you print to a printer shared from another PC, your PC talks to that PC’s print spooler over RPC (remote procedure call). Before 2021, that connection could run at a low authentication level, which made the spoofing attack tracked as CVE-2021-1678 possible.

Microsoft’s fix raises the RPC authentication level to packet privacy, which means the traffic is authenticated and encrypted. RpcAuthnLevelPrivacyEnabled is the switch for that check on the print server, meaning the PC that shares the printer. Microsoft rolled it out in stages: the January 2021 updates added the value, and from the September 2021 updates onward the stricter check is on by default.

That is why the value matters on the sharing PC, not on the PC that shows a printer error. Changing it on a client PC that only connects to shared printers doesn’t change what the print server accepts.

Values and the default

Value	What it means	Security
1	The print server requires packet-privacy RPC connections.	Protected. Microsoft’s intended setting.
Not present	On a print server with the September 2021 or later updates, behaves like 1.	Protected.
0	The print server accepts connections at the older, lower authentication level.	Exposed to CVE-2021-1678. Not recommended.

Most PCs never have the value at all, and that’s normal. You only see it if someone, or a fix guide, added it.

Check the current value

On the PC that shares the printer, open Command Prompt and run:

reg query "HKLM\System\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled

If you see ERROR: The system was unable to find the specified registry key or value, the value isn’t set and the protected default applies. If you see 0x0, the check is turned off. 0x1 means it’s on.

You can also look in Registry Editor: press Windows + R, type regedit, press Enter and go to HKEY_LOCAL_MACHINE > SYSTEM > CurrentControlSet > Control > Print.

Set or remove the value

All of these commands go in Command Prompt as administrator on the PC that shares the printer. Restart the print spooler afterwards (the last two lines) so the change takes effect.

Turn the protection back on (recommended). Either delete the value, which restores the default:

reg delete "HKLM\System\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /f
net stop spooler
net start spooler

or set it to 1 explicitly:

reg add "HKLM\System\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /t REG_DWORD /d 1 /f
net stop spooler
net start spooler

Turn the protection off (last resort only, see the next section first):

reg add "HKLM\System\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /t REG_DWORD /d 0 /f
net stop spooler
net start spooler

If you prefer to restart the PC instead of the spooler, that works too. Back up the key first if you’re not used to editing the Registry: in Registry Editor, right-click the Print key and choose Export.

When people change it

Almost everyone who searches for this value has hit printer error 0x0000011b (“Operation failed”) when adding or printing to a printer shared from another PC. Setting the value to 0 on the sharing PC usually makes that error go away, because the server stops demanding the higher level the client can’t meet.

Before you do that, try the fixes that keep the protection on:

• Install all Windows updates on both PCs and restart them. Many failures happen because only one side is up to date.
• If the printer has its own network connection, add it on each PC by its IP address instead of through the shared PC.
• If it’s a USB printer shared from another PC, add it through a Local Port that points to \\PC-NAME\PrinterShare. Our 0x0000011b guide walks through both methods step by step.

Windows 11 version 22H2 and later also connect to shared printers using RPC over TCP by default. Microsoft’s guidance for mixed setups says that if you force clients back to RPC over named pipes, the print server’s RpcAuthnLevelPrivacyEnabled has to be 0, with the same security trade-off. In a company network, leave these decisions to IT, since the setting affects every PC that prints through that server.

What it is not

Fix guides from 2021 often mix up several printer security changes. RpcAuthnLevelPrivacyEnabled is only about the RPC authentication level for CVE-2021-1678. It is not:

• The PrintNightmare driver restriction. That’s a different value, RestrictDriverInstallationToAdministrators, under HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint, which controls who may install printer drivers (Microsoft KB5005010).
• A spooler on/off switch. It doesn’t stop or start the Print Spooler service. If the spooler itself keeps failing, see print processor does not exist instead.
• A file-sharing setting. Shared folders and NAS sign-in use different settings, such as LmCompatibilityLevel.

Related guides

• Error 0x0000011b: fix “Windows cannot connect to the printer”
• How to share a printer in Windows 11
• Printer error 0x000003e3: “Operation could not be completed”
• Print processor does not exist: how to fix it
• LmCompatibilityLevel: LAN Manager authentication levels

Official sources: for more detail, see Microsoft’s own documentation:

• Microsoft Support: Managing deployment of Printer RPC binding changes for CVE-2021-1678 (KB4599464)
• Microsoft Learn: RPC connection updates for print in Windows 11

Frequently asked questions

Should RpcAuthnLevelPrivacyEnabled be 0 or 1?

1, or not present. That’s the protected setting Microsoft intends. Use 0 only as a temporary workaround on a small, trusted network when nothing else gets a shared printer working.

Do I set it on the client or the print server?

On the print server, the PC that shares the printer. The client that shows error 0x0000011b is usually not where the value needs to change.

Do I need to restart after changing it?

Restart the Print Spooler service (net stop spooler then net start spooler) or restart the PC.

Will a Windows update reset the value?

Microsoft can change how this value is honoured in future updates, so check it again if shared printing breaks after a big update. A value you set yourself normally stays in the Registry.