Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Manage processing of Queue-specific files

This registry value controls which queue-specific files Windows processes when installing a print queue or a connection to a shared printer.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\Software\Policies\Microsoft\Windows NT\Printers\CopyFilesPolicy

This registry value controls which queue-specific files Windows processes when installing a print queue or a connection to a shared printer. A vendor-supplied installation component can associate such files with a particular queue. Clients connecting to the print server download the files that the policy permits.

The supported values have the following meanings:

  • 0: Queue-specific files aren't allowed or processed.
  • 1: Only files conforming to the standard color-profile scheme are allowed. The corresponding CopyFiles\ICM entries must use the COLOR directory and mscms.dll as the module.
  • 2: Queue-specific files of all types are allowed and processed.

When the associated policy is disabled or not configured, Windows defaults to the behavior represented by value 1.

Notes

Security

Value 2 expands the content that a print server can deliver to connected clients to include arbitrary file types. Queue-specific files can include DLLs and other execution-relevant components, so this setting increases exposure to an untrusted or compromised print server.

Microsoft introduced CopyFilesPolicy as part of its response to CVE-2021-36958. The Microsoft security baseline limits processing to standard color profiles handled by the Windows inbox mscms.dll module. Value 0 blocks this transfer mechanism completely, while value 1 retains the intended color-profile functionality without accepting arbitrary vendor-specific files.

This setting doesn't replace print-server access controls or other Point and Print security policies. Its scope is limited to the processing of queue-specific files.

Possible side effects

With value 0, color profiles can't be delivered to print clients through this mechanism. Device-specific color reproduction may therefore be affected.

With value 1, Windows rejects vendor-specific files that don't conform to the expected ICM color-profile scheme. Printers or optional features that depend on those files might install incompletely or fail to operate as intended.

Notes

The inbox administrative policy is documented for Windows 11, version 22H2 and later. The registry value itself was introduced earlier as a security measure and was also delivered through Microsoft's Windows 10, version 22H2 security baseline. The availability of the registry behavior should therefore be distinguished from the presence of the corresponding policy in the local administrative templates.

Microsoft documentation

Microsoft Learn: Printers Policy CSP — ConfigureCopyFilesPolicy

Microsoft Learn: Installing queue-specific files

See also