Improve print DLP telemetry reliability

windows/ActivityWatch.Windows.Common.psm1

@@ -20,6 +20,17 @@ function New-ActivityWatchDirectory {
     }
 }
 
+function Enable-ActivityWatchPrintTelemetry {
+    $policyPath = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
+    if (-not (Test-Path -LiteralPath $policyPath)) {
+        New-Item -Path $policyPath -Force | Out-Null
+    }
+    New-ItemProperty -Path $policyPath -Name 'ShowJobTitleInEventLogs' -Value 1 -PropertyType DWord -Force | Out-Null
+
+    & wevtutil.exe sl 'Microsoft-Windows-PrintService/Operational' /e:true | Out-Null
+}
+
+
 function Get-ActivityWatchPackageUrl {
     param(
         [string]$Version = 'v0.13.2'
@@ -465,6 +476,9 @@ param(
 Set-StrictMode -Version Latest
 `$ErrorActionPreference = 'Stop'
 
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+Add-Type -AssemblyName System.Net.Http
+
 function Get-DeploymentConfig {
     param([string]`$Path)
     return Get-Content -LiteralPath `$Path -Raw | ConvertFrom-Json
@@ -502,8 +516,21 @@ function Invoke-AwJsonPost {
         [Parameter(Mandatory = `$true)][string]`$Json
     )
 
-    `$bytes = [Text.Encoding]::UTF8.GetBytes(`$Json)
-    Invoke-RestMethod -Method Post -Uri `$Uri -ContentType 'application/json; charset=utf-8' -Body `$bytes | Out-Null
+    `$httpClient = New-Object System.Net.Http.HttpClient
+    try {
+        `$content = New-Object System.Net.Http.StringContent(`$Json, [System.Text.Encoding]::UTF8, 'application/json')
+        `$response = `$httpClient.PostAsync(`$Uri, `$content).Result
+        if (-not `$response.IsSuccessStatusCode) {
+            return `$false
+        }
+        return `$true
+    }
+    catch {
+        return `$false
+    }
+    finally {
+        `$httpClient.Dispose()
+    }
 }
 
 function Ensure-Bucket {
@@ -532,7 +559,9 @@ function Ensure-Bucket {
     } | ConvertTo-Json -Compress
 
     try {
-        Invoke-AwJsonPost -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" -Json `$body
+        if (-not (Invoke-AwJsonPost -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" -Json `$body)) {
+            return
+        }
     }
     catch {
         try {

windows/deploy-domain-users.ps1

@@ -52,6 +52,7 @@ $examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json'
 
 New-ActivityWatchDirectory -Path $StateRoot
 New-ActivityWatchDirectory -Path $logsRoot
+Enable-ActivityWatchPrintTelemetry
 
 $archivePath = Get-ActivityWatchArchive -PackageZipPath $PackageZipPath -PackageUrl $PackageUrl -Version $Version -WorkingRoot $workingRoot
 Install-ActivityWatchPackage -ArchivePath $archivePath -InstallRoot $InstallRoot -WorkingRoot $workingRoot -BackupRoot $backupRoot | Out-Null

windows/dlp-endpoint-signals-collector.ps1

@@ -13,6 +13,9 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = 'Stop'
 
+[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
+Add-Type -AssemblyName System.Net.Http
+
 function Get-DeploymentConfig {
     param([string]$Path)
     if ($Path -and (Test-Path -LiteralPath $Path)) {
@@ -39,8 +42,20 @@ function Invoke-AwJsonPost {
         [Parameter(Mandatory = $true)][string]$Json
     )
 
-    $bytes = [Text.Encoding]::UTF8.GetBytes($Json)
-    Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes | Out-Null
+    $httpClient = New-Object System.Net.Http.HttpClient
+    try {
+        $content = New-Object System.Net.Http.StringContent($Json, [System.Text.Encoding]::UTF8, 'application/json')
+        $response = $httpClient.PostAsync($Uri, $content).Result
+        if (-not $response.IsSuccessStatusCode) {
+            Write-EndpointLog ("POST {0} returned {1}" -f $Uri, [int]$response.StatusCode)
+        }
+    }
+    catch {
+        Write-EndpointLog ("POST error {0}: {1}" -f $Uri, $_.Exception.Message)
+    }
+    finally {
+        $httpClient.Dispose()
+    }
 }
 
 function Ensure-Bucket {
@@ -409,7 +424,7 @@ function Test-DocumentNameNeedsFallback {
     $trimmed = $Value.Trim()
     if (Test-LooksLikeMojibakeQuestionMarks -Value $trimmed) { return $true }
     if ($trimmed -match '^[0-9]+$') { return $true }
-    if ($trimmed -match '^(?i)(print document|document|local downlevel document)$') { return $true }
+    if ($trimmed -match '^(?i)(print document|document|local downlevel document|печать документа)$') { return $true }
     return $false
 }
 
@@ -807,11 +822,13 @@ while ($true) {
                 $documentName = [string]$job.Document
                 $owner = [string]$job.Owner
                 $documentNameOriginal = $documentName
+                $documentNameSource = 'win32-printjob'
 
                 if (Test-DocumentNameNeedsFallback -Value $documentName) {
                     $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -JobId $jobId -Owner $owner -PrinterName $printerName
                     if ($eventDocumentName) {
                         $documentName = $eventDocumentName
+                        $documentNameSource = 'printservice-307-fallback'
                     }
                 }
 
@@ -819,6 +836,7 @@ while ($true) {
                     printerName  = $printerName
                     documentName = $documentName
                     documentNameOriginal = $documentNameOriginal
+                    documentNameSource = $documentNameSource
                     owner        = $owner
                     printJobId   = $jobId
                 }
@@ -865,6 +883,7 @@ while ($true) {
                     printerName  = $printerName
                     documentName = if ($resolvedDocument) { $resolvedDocument } else { $documentName }
                     documentNameOriginal = $documentName
+                    documentNameSource = if ($resolvedDocument) { 'printservice-307-fallback' } else { 'printservice-307' }
                     owner        = $owner
                     eventRecordId = $recordId
                     eventSource = 'printservice-307'

windows/hardening-recovery.ps1

@@ -87,6 +87,7 @@ else {
 
 New-ActivityWatchDirectory -Path $effectiveStateRoot
 New-ActivityWatchDirectory -Path $effectiveLogsRoot
+Enable-ActivityWatchPrintTelemetry
 
 if ($RepairPackage) {
     $workingRoot = Join-Path $env:TEMP 'activitywatch-windows-deploy'

windows/validate-deployment.ps1

@@ -24,6 +24,20 @@ $recoveryScript = [string]$config.paths.recoveryScript
 $afkExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'afkEnabled') { [bool]$config.collectors.afkEnabled } else { $true }
 $windowExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]$config.collectors.windowEnabled } else { $true }
 $fileOpsExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'fileOpsEnabled') { [bool]$config.collectors.fileOpsEnabled } else { $true }
+$printServiceOperationalEnabled = $false
+try {
+    $printServiceLog = Get-WinEvent -ListLog 'Microsoft-Windows-PrintService/Operational' -ErrorAction Stop
+    $printServiceOperationalEnabled = [bool]$printServiceLog.IsEnabled
+}
+catch {
+}
+$printJobTitlePolicyEnabled = $false
+try {
+    $printPolicy = Get-ItemProperty -LiteralPath 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'ShowJobTitleInEventLogs' -ErrorAction Stop
+    $printJobTitlePolicyEnabled = ([int]$printPolicy.ShowJobTitleInEventLogs -eq 1)
+}
+catch {
+}
 $requiredFiles = @(
     $collectorScript,
     $endpointCollectorScript,
@@ -120,8 +134,13 @@ $result = [ordered]@{
             ($sessionCollectorProcesses.Count -ge 1)
         )
     }
+    printTelemetry = [ordered]@{
+        operationalLogEnabled = $printServiceOperationalEnabled
+        jobTitlePolicyEnabled = $printJobTitlePolicyEnabled
+        ok = [bool]($printServiceOperationalEnabled -and $printJobTitlePolicyEnabled)
+    }
 }
 
-$result.overallOk = [bool]($result.files.ok -and $result.tasks.ok -and $result.processes.ok)
+$result.overallOk = [bool]($result.files.ok -and $result.tasks.ok -and $result.processes.ok -and $result.printTelemetry.ok)
 
 $result