A short checklist of unused MFP protocols you should disable today

Office MFPs ship with dozens of network protocols enabled by default. Most offices use a small fraction of these in actual operation, while the rest sit listening on their default ports as available attack surface. Every enabled protocol is a potential entry point, even when it provides no value to the office's workflow. The ten protocols below are commonly enabled by default but rarely needed in modern office environments. Disabling each one takes one menu click and reduces the device's exposed attack surface in proportion. The checklist below covers each protocol, its purpose, and the safe replacement where one is needed.

How to use this checklist

Work through each MFP in the office fleet, comparing the device's current protocol settings against the list. Disable any protocol that the office does not actively use. Most offices find they can safely disable seven to nine of the ten protocols listed without affecting any current workflow. The remaining one or two protocols may need to stay enabled depending on specific office requirements.

Telnet

Plain text remote shell access for device administration. Port 23. Telnet transmits all credentials and commands in cleartext, making it visible to anyone capturing the network traffic. The protocol predates modern security expectations and has no defensible use case on a current office MFP.

Replacement. Use HTTPS admin panel access (port 443) or SSH if the device supports it for shell access (port 22).

FTP server

File transfer to and from the device using the original FTP protocol. Port 21. Like Telnet, FTP transmits credentials in cleartext. Some MFPs use FTP for firmware updates or for scan to FTP workflows, though both can be served by secure alternatives.

Replacement. Use SFTP (port 22) for file transfers, HTTPS for firmware updates, or scan to SMB3 / scan to email for scan workflows.

HTTP admin panel

Unencrypted web access to the device admin panel. Port 80. HTTP transmits admin credentials and configuration data in cleartext. Modern devices include HTTPS support that should be used instead.

Replacement. Enable HTTPS only (port 443). Disable HTTP and HTTPS redirect to HTTPS.

SNMPv1 and SNMPv2c

The older versions of SNMP for device monitoring. Port 161. SNMPv1 and v2c use community strings as cleartext credentials. The default community string on most devices is "public" or "private", widely known and exploited.

Replacement. Use SNMPv3, which adds authentication and encryption. Configure unique credentials per device.

SMBv1

The first version of the Server Message Block protocol, used for Windows file sharing including scan to folder. Port 445. SMBv1 has documented vulnerabilities (EternalBlue and others) and is disabled by default on current Windows servers.

Replacement. Use SMBv2 or SMBv3 for scan to folder. Current Windows servers require this.

Raw TCP printing on port 9100

JetDirect style raw printing, which transmits print data in cleartext. Port 9100. Widely used on office networks but exposes print job content to anyone capturing the traffic between workstation and printer.

Replacement. Use IPPS (IPP over TLS) for encrypted printing.

LPR / LPD

The Berkeley Line Printer Daemon protocol from the BSD era. Port 515. Cleartext print protocol with no modern security features. Rarely needed on current office networks since most workstations use IPP or SMB based printing.

Replacement. Use IPPS for cross platform printing or SMB based printing on Windows networks.

AppleTalk

Legacy Apple networking protocol for Mac OS Classic. AppleTalk has been deprecated since Mac OS X 10.6 (Snow Leopard) in 2009. Current Mac systems use IPP based printing instead, making AppleTalk on a modern office MFP entirely unnecessary.

Replacement. AirPrint (mDNS based) or IPPS for current Mac systems.

NetWare and IPX/SPX

Legacy Novell networking protocols. NetWare reached end of life in 2010 and IPX/SPX has not been a meaningful office network protocol for over two decades. Any MFP shipping with these enabled has them enabled purely as a vendor default.

Replacement. None needed. The protocols serve no current office workflow.

WSD (Web Services on Devices) unencrypted

Microsoft's discovery and print protocol for Windows. Port 5357. WSD includes useful features but the unencrypted variant transmits some data in cleartext. Many offices use WSD for discovery while running actual print traffic over a different protocol.

Replacement. Use mDNS / Bonjour for discovery and IPPS for printing.

The procedure for disabling these protocols

How to work through the checklist on each MFP

Log in to the device's admin panel using the admin credentials
Navigate to Network Settings or Protocol Settings, sometimes labelled Service Settings
Locate each protocol from the list above and disable it unless the office actively uses it
Save and apply the changes. The device may need to restart for some protocol changes to take effect
Test the office's primary print and scan workflows to confirm the disabled protocols were not silently in use
Document the changes in the device inventory, noting which protocols are enabled going forward
Apply the same configuration to each MFP in the fleet, with a brief test cycle on each
Schedule a quarterly review of the protocol configuration to catch any drift from firmware updates that may re enable disabled protocols

What happens if a workflow breaks after disabling a protocol

The most common workflow break after the disable round affects scan to folder when SMBv1 is disabled and the file server has not yet been upgraded to support SMBv2 or SMBv3. The fix is upgrading the file server rather than re enabling SMBv1, since SMBv1 has been documented as vulnerable for years and continues to be exploited in production attacks. Other workflow breaks tend to be edge cases involving legacy applications that the office can identify and address individually.

When a workflow does break, the temptation to immediately re enable the disabled protocol is strong but counterproductive. The break confirms that the protocol was carrying real traffic; the right response is to migrate the workflow to a modern equivalent rather than to keep the vulnerable protocol running. Most workflow migrations take a few hours per affected workflow and produce permanent security improvements.

The quarterly maintenance angle

Firmware updates occasionally re enable previously disabled protocols, particularly major firmware version changes that reset some settings to factory defaults. The quarterly review catches this drift and reapplies the disable configuration. Documenting the expected protocol state for each device makes the review fast: compare current settings against the documented baseline, correct any deltas, and complete the device in under five minutes.

Continue with the network security cluster

This piece covers the protocol disable checklist. The preceding pieces in the cluster handle encryption and authentication: TLS encryption, 802.1X authentication setup, and IPSec for MFP traffic. The cluster closes with the quarterly firmware patching routine.