From b7a7ac42e464ef568612c85a31f3bc57508a6905 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sat, 2 May 2026 22:45:48 +0000 Subject: [PATCH] Improve print DLP telemetry reliability --- windows/ActivityWatch.Windows.Common.psm1 | 35 ++++++++++++++++++++-- windows/deploy-domain-users.ps1 | 1 + windows/dlp-endpoint-signals-collector.ps1 | 25 ++++++++++++++-- windows/hardening-recovery.ps1 | 1 + windows/validate-deployment.ps1 | 21 ++++++++++++- 5 files changed, 76 insertions(+), 7 deletions(-) diff --git a/windows/ActivityWatch.Windows.Common.psm1 b/windows/ActivityWatch.Windows.Common.psm1 index 137620f..b42a252 100755 --- a/windows/ActivityWatch.Windows.Common.psm1 +++ b/windows/ActivityWatch.Windows.Common.psm1 @@ -20,6 +20,17 @@ function New-ActivityWatchDirectory { } } +function Enable-ActivityWatchPrintTelemetry { + $policyPath = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' + if (-not (Test-Path -LiteralPath $policyPath)) { + New-Item -Path $policyPath -Force | Out-Null + } + New-ItemProperty -Path $policyPath -Name 'ShowJobTitleInEventLogs' -Value 1 -PropertyType DWord -Force | Out-Null + + & wevtutil.exe sl 'Microsoft-Windows-PrintService/Operational' /e:true | Out-Null +} + + function Get-ActivityWatchPackageUrl { param( [string]$Version = 'v0.13.2' @@ -465,6 +476,9 @@ param( Set-StrictMode -Version Latest `$ErrorActionPreference = 'Stop' +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +Add-Type -AssemblyName System.Net.Http + function Get-DeploymentConfig { param([string]`$Path) return Get-Content -LiteralPath `$Path -Raw | ConvertFrom-Json @@ -502,8 +516,21 @@ function Invoke-AwJsonPost { [Parameter(Mandatory = `$true)][string]`$Json ) - `$bytes = [Text.Encoding]::UTF8.GetBytes(`$Json) - Invoke-RestMethod -Method Post -Uri `$Uri -ContentType 'application/json; charset=utf-8' -Body `$bytes | Out-Null + `$httpClient = New-Object System.Net.Http.HttpClient + try { + `$content = New-Object System.Net.Http.StringContent(`$Json, [System.Text.Encoding]::UTF8, 'application/json') + `$response = `$httpClient.PostAsync(`$Uri, `$content).Result + if (-not `$response.IsSuccessStatusCode) { + return `$false + } + return `$true + } + catch { + return `$false + } + finally { + `$httpClient.Dispose() + } } function Ensure-Bucket { @@ -532,7 +559,9 @@ function Ensure-Bucket { } | ConvertTo-Json -Compress try { - Invoke-AwJsonPost -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" -Json `$body + if (-not (Invoke-AwJsonPost -Uri "`$(`$script:ApiBase)/buckets/`$BucketId" -Json `$body)) { + return + } } catch { try { diff --git a/windows/deploy-domain-users.ps1 b/windows/deploy-domain-users.ps1 index ae12146..5a6ee7a 100755 --- a/windows/deploy-domain-users.ps1 +++ b/windows/deploy-domain-users.ps1 @@ -52,6 +52,7 @@ $examplePolicySource = Join-Path $PSScriptRoot 'dlp-policy.example.json' New-ActivityWatchDirectory -Path $StateRoot New-ActivityWatchDirectory -Path $logsRoot +Enable-ActivityWatchPrintTelemetry $archivePath = Get-ActivityWatchArchive -PackageZipPath $PackageZipPath -PackageUrl $PackageUrl -Version $Version -WorkingRoot $workingRoot Install-ActivityWatchPackage -ArchivePath $archivePath -InstallRoot $InstallRoot -WorkingRoot $workingRoot -BackupRoot $backupRoot | Out-Null diff --git a/windows/dlp-endpoint-signals-collector.ps1 b/windows/dlp-endpoint-signals-collector.ps1 index 471ad0a..6d3b721 100644 --- a/windows/dlp-endpoint-signals-collector.ps1 +++ b/windows/dlp-endpoint-signals-collector.ps1 @@ -13,6 +13,9 @@ param( Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' +[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 +Add-Type -AssemblyName System.Net.Http + function Get-DeploymentConfig { param([string]$Path) if ($Path -and (Test-Path -LiteralPath $Path)) { @@ -39,8 +42,20 @@ function Invoke-AwJsonPost { [Parameter(Mandatory = $true)][string]$Json ) - $bytes = [Text.Encoding]::UTF8.GetBytes($Json) - Invoke-RestMethod -Method Post -Uri $Uri -ContentType 'application/json; charset=utf-8' -Body $bytes | Out-Null + $httpClient = New-Object System.Net.Http.HttpClient + try { + $content = New-Object System.Net.Http.StringContent($Json, [System.Text.Encoding]::UTF8, 'application/json') + $response = $httpClient.PostAsync($Uri, $content).Result + if (-not $response.IsSuccessStatusCode) { + Write-EndpointLog ("POST {0} returned {1}" -f $Uri, [int]$response.StatusCode) + } + } + catch { + Write-EndpointLog ("POST error {0}: {1}" -f $Uri, $_.Exception.Message) + } + finally { + $httpClient.Dispose() + } } function Ensure-Bucket { @@ -409,7 +424,7 @@ function Test-DocumentNameNeedsFallback { $trimmed = $Value.Trim() if (Test-LooksLikeMojibakeQuestionMarks -Value $trimmed) { return $true } if ($trimmed -match '^[0-9]+$') { return $true } - if ($trimmed -match '^(?i)(print document|document|local downlevel document)$') { return $true } + if ($trimmed -match '^(?i)(print document|document|local downlevel document|печать документа)$') { return $true } return $false } @@ -807,11 +822,13 @@ while ($true) { $documentName = [string]$job.Document $owner = [string]$job.Owner $documentNameOriginal = $documentName + $documentNameSource = 'win32-printjob' if (Test-DocumentNameNeedsFallback -Value $documentName) { $eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -JobId $jobId -Owner $owner -PrinterName $printerName if ($eventDocumentName) { $documentName = $eventDocumentName + $documentNameSource = 'printservice-307-fallback' } } @@ -819,6 +836,7 @@ while ($true) { printerName = $printerName documentName = $documentName documentNameOriginal = $documentNameOriginal + documentNameSource = $documentNameSource owner = $owner printJobId = $jobId } @@ -865,6 +883,7 @@ while ($true) { printerName = $printerName documentName = if ($resolvedDocument) { $resolvedDocument } else { $documentName } documentNameOriginal = $documentName + documentNameSource = if ($resolvedDocument) { 'printservice-307-fallback' } else { 'printservice-307' } owner = $owner eventRecordId = $recordId eventSource = 'printservice-307' diff --git a/windows/hardening-recovery.ps1 b/windows/hardening-recovery.ps1 index 2eca49f..0a7123f 100755 --- a/windows/hardening-recovery.ps1 +++ b/windows/hardening-recovery.ps1 @@ -87,6 +87,7 @@ else { New-ActivityWatchDirectory -Path $effectiveStateRoot New-ActivityWatchDirectory -Path $effectiveLogsRoot +Enable-ActivityWatchPrintTelemetry if ($RepairPackage) { $workingRoot = Join-Path $env:TEMP 'activitywatch-windows-deploy' diff --git a/windows/validate-deployment.ps1 b/windows/validate-deployment.ps1 index 20c4260..41b6bd9 100644 --- a/windows/validate-deployment.ps1 +++ b/windows/validate-deployment.ps1 @@ -24,6 +24,20 @@ $recoveryScript = [string]$config.paths.recoveryScript $afkExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'afkEnabled') { [bool]$config.collectors.afkEnabled } else { $true } $windowExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'windowEnabled') { [bool]$config.collectors.windowEnabled } else { $true } $fileOpsExpected = if ($config.PSObject.Properties.Name -contains 'collectors' -and $config.collectors.PSObject.Properties.Name -contains 'fileOpsEnabled') { [bool]$config.collectors.fileOpsEnabled } else { $true } +$printServiceOperationalEnabled = $false +try { + $printServiceLog = Get-WinEvent -ListLog 'Microsoft-Windows-PrintService/Operational' -ErrorAction Stop + $printServiceOperationalEnabled = [bool]$printServiceLog.IsEnabled +} +catch { +} +$printJobTitlePolicyEnabled = $false +try { + $printPolicy = Get-ItemProperty -LiteralPath 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'ShowJobTitleInEventLogs' -ErrorAction Stop + $printJobTitlePolicyEnabled = ([int]$printPolicy.ShowJobTitleInEventLogs -eq 1) +} +catch { +} $requiredFiles = @( $collectorScript, $endpointCollectorScript, @@ -120,8 +134,13 @@ $result = [ordered]@{ ($sessionCollectorProcesses.Count -ge 1) ) } + printTelemetry = [ordered]@{ + operationalLogEnabled = $printServiceOperationalEnabled + jobTitlePolicyEnabled = $printJobTitlePolicyEnabled + ok = [bool]($printServiceOperationalEnabled -and $printJobTitlePolicyEnabled) + } } -$result.overallOk = [bool]($result.files.ok -and $result.tasks.ok -and $result.processes.ok) +$result.overallOk = [bool]($result.files.ok -and $result.tasks.ok -and $result.processes.ok -and $result.printTelemetry.ok) $result