From 8f10bef9044cc1e8b83c084315f11f161c3ff4b7 Mon Sep 17 00:00:00 2001
From: IgorRachkov <89467086+igor04091968@users.noreply.github.com>
Date: Fri, 1 May 2026 15:50:02 +0300
Subject: [PATCH] Limit print title fallback to masked Russian document names

---
 .../windows/dlp-endpoint-signals-collector.ps1    | 15 +++++++++++++--
 windows/dlp-endpoint-signals-collector.ps1        | 15 +++++++++++++--
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1 b/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
index 8ee44f5..b943477 100644
--- a/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
+++ b/install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
@@ -402,6 +402,17 @@ function Test-LooksLikeMojibakeQuestionMarks {
     return $Value -match '\?{2,}'
 }
 
+function Test-LooksLikeRussianTitleMaskedAsQuestionMarks {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
+
+    $trimmed = $Value.Trim()
+    if ($trimmed -match '[A-Za-zА-Яа-я0-9]') { return $false }
+
+    # Typical broken Cyrillic print title shape: multiple words of question marks.
+    return $trimmed -match '^\?{3,}(\s+\?{3,})+$'
+}
+
 function Normalize-OwnerForMatch {
     param([AllowNull()][string]$Value)
     if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -709,12 +720,12 @@ while ($true) {
                 if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
                 $script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
 
-                $printerName = [string]$job.Name
+                $printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
                 $documentName = [string]$job.Document
                 $owner = [string]$job.Owner
                 $documentNameOriginal = $documentName
 
-                if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
+                if (Test-LooksLikeRussianTitleMaskedAsQuestionMarks -Value $documentName) {
                     $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
                     if ($eventDocumentName) {
                         $documentName = $eventDocumentName
diff --git a/windows/dlp-endpoint-signals-collector.ps1 b/windows/dlp-endpoint-signals-collector.ps1
index 8ee44f5..b943477 100644
--- a/windows/dlp-endpoint-signals-collector.ps1
+++ b/windows/dlp-endpoint-signals-collector.ps1
@@ -402,6 +402,17 @@ function Test-LooksLikeMojibakeQuestionMarks {
     return $Value -match '\?{2,}'
 }
 
+function Test-LooksLikeRussianTitleMaskedAsQuestionMarks {
+    param([AllowNull()][string]$Value)
+    if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
+
+    $trimmed = $Value.Trim()
+    if ($trimmed -match '[A-Za-zА-Яа-я0-9]') { return $false }
+
+    # Typical broken Cyrillic print title shape: multiple words of question marks.
+    return $trimmed -match '^\?{3,}(\s+\?{3,})+$'
+}
+
 function Normalize-OwnerForMatch {
     param([AllowNull()][string]$Value)
     if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -709,12 +720,12 @@ while ($true) {
                 if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
                 $script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
 
-                $printerName = [string]$job.Name
+                $printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
                 $documentName = [string]$job.Document
                 $owner = [string]$job.Owner
                 $documentNameOriginal = $documentName
 
-                if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
+                if (Test-LooksLikeRussianTitleMaskedAsQuestionMarks -Value $documentName) {
                     $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
                     if ($eventDocumentName) {
                         $documentName = $eventDocumentName